Cash Ransomware

Sa digital age, ang kahalagahan ng pag-iingat sa iyong mga device at data ay hindi maaaring palakihin. Ang mga banta sa cyber, lalo na ang ransomware, ay naging mas sopistikado, na nagdudulot ng mga seryosong panganib sa mga indibidwal at organisasyon. Ang isa sa mga umuusbong na banta ay ang Cash Ransomware, isang nagbabantang software na idinisenyo upang i-encrypt ang mga file sa mga nahawaang device at humingi ng bayad para sa paglabas nito. Ang pag-unawa sa banta na ito at ang pagpapatupad ng matatag na kasanayan sa seguridad ay mahalaga sa pagprotekta sa iyong mga digital na asset.

Ano ang Cash Ransomware?

Ang Cash Ransomware ay isang partikular na uri ng malware na kilala sa pag-encrypt ng data sa mga nakompromisong device at paghingi ng ransom para sa pag-decryption. Ang ransomware na ito ay iniuugnay sa parehong mga aktor ng pagbabanta sa likod ng Cash RAT (Remote Access Trojan) at MintStealer, na nagpapahiwatig ng isang maayos at patuloy na cybercriminal group.

Paano Gumagana ang Cash Ransomware

Kapag na-activate na sa isang nakompromisong device, ang Cash Ransomware ay nag-e-encrypt ng mga file at nagdaragdag ng extension na '.CashRansomware' sa bawat apektadong file. Halimbawa, ang '1.doc' ay nagiging '1.doc.CashRansomware,' at ang '2.pdf' ay pinalitan ng pangalan na '2.pdf.CashRansomware.' Kasunod ng proseso ng pag-encrypt, ang ransomware ay lumilikha ng tatlong natatanging ransom notes: isang bagong desktop wallpaper, isang pop-up window, at isang HTML file na pinangalanang 'Cash Ransomware.html.'

Mga Hinihiling at Babala sa Pantubos

Ang mga tala ng pantubos, bagama't hindi magkapareho, ay nagbibigay ng parehong kritikal na impormasyon:

• Abiso ng pag-encrypt ng file.
• Isang ransom demand na 80 USD sa Monero (XMR) cryptocurrency.
• Ang mga babala laban sa pag-restart ng device o pagpapatakbo ng mga anti-malware program ay maaaring mag-render ng mga file na hindi ma-decrypt.
• Mga tagubilin upang maiwasan ang pagdiskonekta mula sa network upang matiyak ang negosasyon at pagbawi.

Tinukoy din ng mga tala na ang mga file ay na-encrypt gamit ang mga advanced na cryptographic algorithm: XChaCha20, Poly1305, at AES-256-GCM. Gayunpaman, ang mga eksperto sa cybersecurity ay nag-iingat na ang pagbabayad ng ransom ay hindi ginagarantiyahan ang pagbawi ng data, dahil ang mga cybercriminal ay kadalasang hindi nagbibigay ng decryption key kahit na pagkatapos ng pagbabayad.

Pinakamahuhusay na Kasanayan sa Seguridad para Pigilan ang Mga Pag-atake sa Ransomware

Ang pag-iwas sa ransomware, kabilang ang Cash Ransomware, ay nangangailangan ng isang proactive na diskarte sa cybersecurity. Narito ang ilan sa mga pinakamahuhusay na kagawiang dapat ipatupad ng mga user para mapahusay ang kanilang depensa laban sa ransomware at iba pang banta ng malware:

Ang pagtaas ng mga banta sa ransomware tulad ng Cash Ransomware ay nagpapakita ng kritikal na pangangailangan para sa pagbabantay at matatag na mga hakbang sa cybersecurity. Sa pamamagitan ng pag-unawa sa likas na katangian ng mga banta na ito at pagpapatupad ng pinakamahuhusay na kagawian sa seguridad, mababawasan ng mga user ang mga pagkakataong maging biktima ng mga pag-atake ng ransomware Tandaan, ang pag-iwas ay palaging mas mahusay kaysa sa paggamot, at ang isang maagap na diskarte sa cybersecurity ay ang iyong pinakamahusay na depensa laban sa mga digital na banta.

Ang ransom note na ipinakita sa isang pop-up window:

'Cash RANSOMWARE

YOUR FILES
ARE ENCRYPTED
BY CASH RANSOMWARE

What happend?

Dear , We regret to inform you that your files have been compromised by the insidious Cash Ransomware program. This ruthless malware has infiltrated your system, encrypting your precious data and holding it hostage until its demands are met. Below are the chilling details of this dire situation:

Rapid scanning of your storage drives has been executed, leaving no corner untouched by the malicious claws of Cash Ransomware.
Utilizing the advanced XChaCha20 encryption algorithm, your files have been ensnared with unbreakable tags and a deadly combination of Poly1305 or AES-256-GCM, meticulously chosen by the ransomware's constructors to ensure maximum devastation.
To further fortify its grip on your data, Cash Ransomware employs a hybrid bulletproof encryption technique, rendering any attempts at decryption futile against its impenetrable defenses.
Files bearing specific extensions have been singled out for priority encryption, ensuring that your most critical data is held captive, intensifying the fear and desperation of your predicament.
As a final blow to any hopes of recovery, Cash Ransomware deploys a double-key encryption mechanism, thwarting any attempts at deception or circumvention, leaving you no recourse but to comply with its demands.
In light of this harrowing situation, we implore you to refrain from taking any actions that may exacerbate the damage and worsen your plight:

Do not download antivirus software: Any attempts to combat Cash Ransomware with conventional means will only serve to alert its creators, potentially triggering further encryption or irreversible data loss.
Do not disconnect from the network: Isolation will not shield you from the relentless reach of Cash Ransomware; instead, it may hinder potential avenues of negotiation or resolution.
Do not reboot your systems: Restarting your devices could disrupt ongoing encryption processes, rendering your files irretrievable and sealing your fate in the clutches of this merciless malware.
We understand the gravity of your situation and stand ready to assist you in navigating this crisis. However, time is of the essence, and decisive action is imperative to mitigate the extent of the damage inflicted by Cash Ransomware.

How to decrypt my files?

Your files are heavily encrypted, and none can be decrypted without the decryption key.
To obtain the decryption key, you need to make a payment to the specified amount to the XMR / Monero wallet.
Once you've made the payment, you should contact the attackers via email or Telegram to receive the decryption key.
After receiving the decryption key, you need to input it into the decryption panel in Cash.
Once you hit the decryption button, your files will be decrypted.'

Ang ransom note ay inihatid bilang isang HTML file:

'ATTENTION!'ATTENTION!

YOUR FILES ARE ENCRYPTED BY Cash RANSOMWARE

Dear user, We regret to inform you that your files have been compromised by the insidious XChaCha20 encryption algorithm, your files have been ensnared with unbreakable tags and a deadly combination of Poly1305 or AES-256-GCM, meticulously chosen by the ransomware's constructors to ensure maximum devastation.
To further fortify its grip on your data, Cash Ransomware employs a hybrid bulletproof encryption technique, rendering any attempts at decryption futile against its impenetrable defenses.
Files bearing specific extensions have been singled out for priority encryption, ensuring that your most critical data is held captive, intensifying the fear and desperation of your predicament.
As a final blow to any hopes of recovery, Cash Ransomware deploys a double-key encryption mechanism, thwarting any attempts at deception or circumvention, leaving you no recourse but to comply with its demands.
In light of this harrowing situation, we implore you to refrain from taking any actions that may exacerbate the damage and worsen your plight:

Do not download antivirus software: Any attempts to combat Cash Ransomware with conventional means will only serve to alert its creators, potentially triggering further encryption or irreversible data loss.
Do not disconnect from the network: Isolation will not shield you from the relentless reach of Cash Ransomware; instead, it may hinder potential avenues of negotiation or resolution.
Do not reboot your systems: Restarting your devices could disrupt ongoing encryption processes, rendering your files irretrievable and sealing your fate in the clutches of this merciless malware.

We understand the gravity of your situation and stand ready to assist you in navigating this crisis. However, time is of the essence, and decisive action is imperative to mitigate the extent of the damage inflicted by Cash Ransomware.

85kCbkZzeaeiSx8h47yFjwUJ8u41FqgbpFbqGp5C93Rpa9eU 7pcYdp5Y7LNSrHkEVmTYa4oCuLeNnHGxVBLH78Uo2XEkXpZ
Copy Monero

dolores@bpe.cash
Copy Email

80$
Copy Amount'

Mensahe na ipinapakita sa mga biktima bilang isang larawan sa background sa desktop:

'CASH RANSOMWARE'All computer got infected by Cash Ransomware.
All your personal files are encrypted
Using an unique and advanced encryption algorithm.'All computer got infected by Cash Ransomware.
All your personal files are encrypted
Using an unique and advanced encryption algorithm.

If you need your computer or your files
Please kindly follow steps on the software.
You can contact people that infected that
Computer by sending an email
Please check the Ransomware to get the email.

Avoid to install an anti-virus, installing a anti-virus
Will delete the Ransomware without decrypting files.
Please note that we won't be able to help you
If you're trying to bypass our system.

CASHRANSOMWARE'