Daz 勒索软件

Daz Ransomware 是 VoidCrypt Ransomware 的威胁变体。尽管该威胁与所有其他VoidCrypt变种没有太大区别，但它保留了恶意软件家族破坏受感染系统的能力。事实上，在被破坏的设备上激活后，Daz Ransomware 将针对各种不同的文件类型，并通过不可破解的加密锁定它们。受害者甚至无法访问他们的大部分文件、图像、照片、档案、数据库等。

受影响文件的其他更改可以在其名称中找到。作为其行动的一部分，Daz Ransomware 将在每个锁定文件的原始名称中附加一个 ID 字符串、一个电子邮件地址和一个新的扩展名。为每个特定受害者生成 ID 字符串，而电子邮件 ('Sc0rpio0@tutanota.com') 和文件扩展名 ('.Daz') 保持一致。该威胁还将在被破坏系统的桌面上放置一个名为“unlock-info.txt”的文本文件。

当受害者打开文件时，他们会找到带有说明的勒索信。根据传递的消息，攻击者想要作为赎金收到的确切金额将取决于每个受害者与他们建立通信所需的时间。该说明提到了“Sc0rpio@cock.li”的辅助电子邮件地址。它还澄清了攻击者只会接受使用比特币加密货币进行的付款。可以发送不包含任何重要数据且大小小于 1MB 的单个加密文件进行免费解密。

Daz Ransomware 删除的整套指令是：

'All your files have been encrypted!

All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail; Sc0rpio0@tutanota.com

Write this ID in the title of your message : -

In case of no answer in 24 hours write us to theese e-mails: Sc0rpio@cock.li

You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.

Free decryption as guarantee

Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)

How to obtain Bitcoins

The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.

hxxps://localbitcoins.com/buy_bitcoins

Also you can find other places to buy Bitcoins and beginners guide here:

hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/

Attention!

Do not rename encrypted files.

Do not try to decrypt your data using third party software, it may cause permanent data loss.

Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.'