xSpace Ransomware

The xSpace Ransomware threat is a variant from the VoidCrypt Ransomware family. Users should not underestimate its destructive potential, though. Despite being a variant of the already identified VoidCrypt Ransomware, xSpace can cause significant damage to the breached devices. Indeed, victims will be left completely locked out from nearly all of their data, such as documents, PDFs, images, photos, archived, databases, etc. 

Whenever the xSpace Ransomware locks a file, it also will change that file's original's name drastically. The threat will append an ID string, the 'HelpMe@mailfence.com' email address controlled by the attackers, and finally '.xSpace.' Victims will be left with two identical ransom notes. One will be displayed in a pop-up window created via a 'Decryption-Guide.hta' file while the other will be delivered as a similarly named text file - 'Decryption-Guide.txt.'

Ransom Note's Overview

The ransom-demanding message of the xSpace Ransomware doesn't reveal the exact sum that the attackers want to extort from their victims. However, it does state that victims must find a specific file on the infected device and send it to the cybercriminals. This file should have been created in the C:/ProgramData folder and may have a name similar to 'RSAKEY-SE-24r6t523' or 'RSAKEY.KEY.' Without the information from this file, even the hackers will be unable to restore the encrypted files. To contact the threat actors, affected users can try messaging the two email addresses mentioned in the note - 'HelpMe@mailfence.com' and 'Recoverme@msgsafe.io.'

The full text of xSpace Ransomware's note is:

'Your Files Are Has Been Locked

Your Files Has Been Encrypted with cryptography Algorithm

If You Need Your Files And They are Important to You, Dont be shy Send Me an Email

Send Test File + The Key File on Your System (File Exist in C:/ProgramData example : RSAKEY-SE-24r6t523 pr RSAKEY.KEY) to Make Sure Your Files Can be Restored

Make an Agreement on Price with me and Pay

Get Decryption Tool + RSA Key AND Instruction For Decryption Process

Attention:

1- Do Not Rename or Modify The Files (You May loose That file)

2- Do Not Try To Use 3rd Party Apps or Recovery Tools ( if You want to do that make an copy from Files and try on them and Waste Your time )

3-Do not Reinstall Operation System(Windows) You may loose the key File and Loose Your Files

4-Do Not Always Trust to Middle mans and negotiators (some of them are good but some of them agree on 4000usd for example and Asked 10000usd From Client)  this Was happened

Your Case ID :MJ-JE2360897415

OUR Email :HelpMe@mailfence.com

 in Case of no answer: Recoverme@msgsafe.io'