Toa Ransomware

The Toa Ransomware targets Windows systems and locks the data on them with a strong cryptographic algorithm. Affected users will find themselves unable to access any of their documents, pictures, photos, archives, databases and more. The operators of ransomware threats use the encrypted data as leverage to extort their victims for money. 

Following the established behavior observed in most ransomware threats, Toa also modifies the names of the files it encrypts. The threat does so by appending a string of four random characters to the original file names. In addition, victims will be left with a text file named 'read_it.txt' placed on the desktop of the breached devices.

The file contains the malware's ransom note. The attackers state that the Toa Ransomware has deleted the Shadow Copies of the encrypted files and disabled the Windows Recovery. The note instructs the affected users that to receive a decryptor from the cybercriminals, they will need to pay a ransom of exactly $274. However, the money must be sent using the Bitcoin cryptocurrency. 

The full text of the ransom-demanding message is:

'Your Windows PC is infected with the Toa Ransomware. Without the key, files can't, and won't, be returned. However, you can get yourself out of this mess. By buying our decryptor software. you can return all of your infected files. The price for this software is $274 in USD. payment can be made in BTC only. If you don't know how to get Bitcoin, Google how. once payment is recevied, a email will contact you and send you the decrypter. If you dont get the decryptor, check your spam folder. Windows Recovery is disabled and all Shadow Copies are deleted as well as the backup catalog. Once you sent the Bitcoin, from the email that infected you, send them your Public Key.

Public Key:

BTC Adress: 0xDe3cbc738a2B57168FD5906B39941Ce8958dB044'