SEX3 Ransomware

Cybercriminals have unleashed a new, damaging ransomware threat, based on the previously identified SATANA Ransomware. The new variant is being tracked as the SEX3 Ransomware, and its threatening capabilities should not be underestimated. If deployed on the victim's device, the threat will impact a vast portion of the data stored there and leave it in an unusable state. The names of all impacted files will be modified by having '.SEX3' attached to them as a new file extension.

The SEX3 Ransomware drops two different ransom notes on the breached devices. The shorter message will be displayed to victims as a new desktop background image. It simply states that the encrypted data can be restored, but victims must first contact the threat actors. The main ransom note will be contained inside a newly-created text file named '!satana!.txt.'

According to the main ransom-demanding message, the threat actors are trying to extort the sum of 0.5 BTC (Bitcoin), which at the current exchange rate of the cryptocurrency stands at just above $8000. The money must be transferred to the crypto-wallet address found in the ransom note. Victims also will have to message the 'geraashurakovv@mail.ru' email address with the specific code assigned to them in the note.

The full text of SEX3 Ransomware's note is:

'The harddisks of your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page
E-mail: geraashurakovv@mail.ru - this is our mail
CODE: 14B4030A8A7F8B8D7B1101720567C27E this is code; you must send
BTC: 17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV here need to pay 0,5 bitcoins
continue the normal download on your computer. Good luck! May God help you!'

The desktop background message is:

'ALL YOUR FILES HAVE BEEN LOCKED!!
YOU HAVE TO PAY FOR UNLOCK IT
AFTER PAYMENT WE WILL SEND YOU THE UNLOCK-TOOL
THAT DECRYPT ALL YOUR FILES'