'tedmundboardus@aol.com' Ransomware
The 'tedmundboardus@aol.com' Ransomware carries out a typical encryption ransomware attack, making the victim's files useless by enciphering them with a strong encryption algorithm. The 'tedmundboardus@aol.com' Ransomware Trojan is a variant of the Phobos Ransomware family. The 'tedmundboardus@aol.com' Ransomware attack is nearly identical to the vast majority of ransomware Trojans currently active, and computer users are advised to take steps to protect their data and devices from these malware threats.
How the 'tedmundboardus@aol.com' Ransomware Trojan Attacks a Computer
The 'tedmundboardus@aol.com' Ransomware attack is typically delivered to the victim's computer by taking advantage of poorly protected Remote Desktop Protocol connections or via corrupted spam email attachments. The 'tedmundboardus@aol.com' Ransomware will scan the victim's computer for the user-generated files and then use AES encryption to make the victim's files inaccessible. The following are examples of the files that the 'tedmundboardus@aol.com' Ransomware targets when attacking a computer:
.jpg, .jpeg, .raw, .tif, .gif, .png, .bmp, .3dm, .max, .accdb, .db, .dbf, .mdb, .pdb, .sql, .dwg, .dxf, .cpp, .cs, .h, .php, .asp, .rb, .java, .jar, .class, .py, .js, .aaf, .aep, .aepx, .plb, .prel, .prproj, .aet, .ppj, .psd, .indd, .indl, .indt, .indb, .inx, .idml, .pmd, .xqx, .xqx, .ai, .eps, .ps, .svg, .swf, .fla, .as3, .as, .txt, .doc, .dot, .docx, .docm, .dotx, .dotm, .docb, .rtf, .wpd, .wps, .msg, .pdf, .xls, .xlt, .xlm, .xlsx, .xlsm, .xltx, .xltm, .xlsb, .xla, .xlam, .xll, .xlw, .ppt, .pot, .pps, .pptx, .pptm, .potx, .potm, .ppam, .ppsx, .ppsm, .sldx, .sldm, .wav, .mp3, .aif, .iff, .m3u, .m4u, .mid, .mpa, .wma, .ra, .avi, .mov, .mp4, .3gp, .mpeg, .3g2, .asf, .asx, .flv, .mpg, .wmv, .vob, .m3u8, .dat, .csv, .efx, .sdf, .vcf, .xml, .ses, .qbw, .qbb, .qbm, .qbi, .qbr , .cnt, .des, .v30, .qbo, .ini, .lgb, .qwc, .qbp, .aif, .qba, .tlg, .qbx, .qby , .1pa, .qpd, .txt, .set, .iif, .nd, .rtp, .tlg, .wav, .qsm, .qss, .qst, .fx0, .fx1, .mx0, .fpx, .fxr, .fim, .ptb, .ai, .pfb, .cgn, .vsd, .cdr, .cmx, .cpt, .csl, .cur, .des, .dsf, .ds4, , .drw, .eps, .ps, .prn, .gif, .pcd, .pct, .pcx, .plt, .rif, .svg, .swf, .tga, .tiff, .psp, .ttf, .wpd, .wpg, .wi, .raw, .wmf, .txt, .cal, .cpx, .shw, .clk, .cdx, .cdt, .fpx, .fmv, .img, .gem, .xcf, .pic, .mac, .met, .pp4, .pp5, .ppf, .nap, .pat, .ps, .prn, .sct, .vsd, .wk3, .wk4, .xpm, .zip, .rar.
Once the victim's files have been compromised, the 'tedmundboardus@aol.com' Ransomware delivers ransom notes in the form of text and HTA file named 'info.txt' and 'info.hta.' The text of the ransom note reads as follows:
'All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the email tedmundboardus@aol.com
Write this ID in the title of your message [Victim ID]
In case of no answer in 24 hours write us to this e-mail: tylecotenji@aol.com
If there is no response from our mail, you can install the Jabber client and write to us in support of phobos_helper@xmpp.jp
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information. (databases,backups,large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click ‘Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://coindesk.com/information/how-can-i-buy-bitcoins/
Jabber Client installation instructions:
• Download the jabber (Pidgin) client from hxxps://pidgin.im/download/windows
• After installation, the Pidgin client will prompt you to create a new account.
• Click 'Add.'
Protecting Your Data from the 'tedmundboardus@aol.com' Ransomware
The best protection against threats likes the 'tedmundboardus@aol.com' Ransomware is to have backup copies of your data. Apart from file backups, a security program should be used to anticipate these attacks. Safeguarding any RDP connections and being careful when handling unsolicited emails can also help prevent the 'tedmundboardus@aol.com' Ransomware attacks.
