Thx Ransomware

The primary objective of the Thx Ransomware threat is to encrypt data. When the encryption process occurs, the files on the breached device will be locked and no longer accessible. The Thx Ransomware also modifies the original filenames by appending a victim's ID, the 'cluster1@outlook.sa' email address, and the '.thx' extension.

For instance, a file originally named '1.pdf' would be changed to '1.pdf.id-1E857D00.[cluster1@outlook.sa].thx,' while '2.png' would be transformed into '2.png.id-1E857D00.[cluster1@outlook.sa].thx,' and so forth. Along with the file encryption, the Thx Ransomware displays a pop-up window and generates a file called 'info.txt' that contains a ransom note from the threat actors. According to cybersecurity researchers, Thx is categorized as ransomware belonging to the Dharma malware family.

The Thx Ransomware can Impact Numerous Types of Data

The ransom note dropped by the Thx ransomware informs victims about the encryption of their files. To restore the encrypted files, the note instructs them to establish contact via the provided email addresses, namely 'cluster1@outlook.sa' or 'cluster@mailfence.com.' As a gesture of goodwill, the ransomware operators offer to decrypt up to 3 files free of charge. However, there are conditions that must be obeyed in this offer. The files to be decrypted must be smaller than 3Mb in size and should not contain valuable or sensitive information.

Furthermore, the note provides detailed instructions on how to acquire Bitcoins, which are the preferred form of payment for the ransom. It explicitly warns against renaming the encrypted files or attempting decryption using third-party software, as such actions could result in permanent data loss or an increase in the decryption price.

However, paying the ransom is not recommended, as there is no guarantee that the necessary decryption tools will be provided. Instead, it is highly advised to promptly eliminate the ransomware from the infected systems to prevent further data loss or damage. Taking immediate action to mitigate the ransomware threat is crucial in safeguarding the integrity and security of the affected files.

Make Sure that Your Devices and Data Have Sufficient Security against Ransomware Threats

To safeguard devices and data from ransomware infections, users can implement a range of proactive measures. These precautions help create a robust defense against ransomware attacks and diminish the risk of data encryption and subsequent extortion.

One fundamental aspect of protection is maintaining up-to-date security software on all devices. This includes anti-malware and firewall solutions, which can detect and prevent ransomware infections. Regularly updating these security programs ensures they stay equipped with the latest threat definitions and protective measures.

Users should exercise extreme caution when opening email attachments or clicking on suspicious links, as these are common entry points for ransomware. Being vigilant and verifying the authenticity of email senders and the content they share can help avoid falling victim to phishing attempts or threatening downloads.

Regularly backing up data is an effective defense mechanism against ransomware. By maintaining offline or cloud-based backups, users can restore their files without succumbing to the demands of ransomware operators. It is recommended to ensure that backups are performed regularly and that the backup copies are isolated from the primary network to prevent their encryption during an attack.

Educating oneself about the latest ransomware trends and attack techniques is vital. Staying informed about emerging threats helps users recognize potential risks and take appropriate precautions to mitigate them. Furthermore, users should stay updated with security patches and software updates provided by device and software manufacturers, as these often include critical security fixes.

In summary, taking proactive measures such as maintaining up-to-date security software, exercising caution when interacting with emails and websites, regularly backing up data, implementing strong passwords and multi-factor authentication, and staying informed about the evolving ransomware landscape can significantly enhance device and data protection against ransomware infections.

The ransom note displayed as a pop-up window is:

'All your files have been encrypted!
Don't worry, you can return all your files!
If you want to restore them, write to the mail: cluster1@outlook.sa YOUR ID 1E857D00
If you have not answered by mail within 12 hours, write to us by another mail:cluster@mailfence.com
Free decryption as guarantee
Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 3Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins

Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

The message delivered to victims as a text file is:

all your data has been locked us
You want to return?
write email cluster1@outlook.sa or cluster@mailfence.com'