Tohj Ransomware
The Tohj Ransomware is a variant of the infamous STOP/Djvu Ransomware family. Despite this fact, the threat's destructive potential should not be underestimated in the slightest. When executed on infected devices, the Tohj Ransomware will leave most of the data stored on them in a completely unusable state. Thanks to the strong encryption process utilized by this malware strain, victims will be unable to access their documents, PDFs, archives, databases and many other file types.
The names of the encrypted files will be modified via the addition of '.tohj' as a new file extension. The threat also will create a text file named '_readme.txt' on the breached devices. The file contains a ransom note with detailed instructions for the victims. According to Tohj's ransom-demanding message, its victims will need to pay the sum of $980 to the threat actors. If the note can be believed, the cybercriminals will then send back a decryptor tool and the necessary decryption keys.
Like a typical STOP/Djvu variant, the Tohj Ransomware also states that victims who initiate communication within the first 72 hours will need to pay only half of the initial ransom amount. Impacted users or corporate entities apparently also can send a single encrypted file to be unlocked for free. The email addresses mentioned in the note are 'restorealldata@firemail.cc' and 'gorentos@bitmessage.ch.' The operators of Tohj Ransomware also leave a Telegram account - '@datarestore,' that could be used to contact them.
The full text of the note is:
'ATTENTION!
Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-WbgTMF1Jmw
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:
restorealldata@firemail.ccReserve e-mail address to contact us:
gorentos@bitmessage.chOur Telegram account:
@datarestoreYour personal ID:'
Tohj Ransomware Video
Tip: Turn your sound ON and watch the video in Full Screen mode.
