Ransom.Win32.THTLOCKER.A.note

This Ransomware may be dropped by other malware.

Arrival Details

This Ransomware may be dropped by the following malware:

• Ransom.Win32.THTLOCKER

Other Details

This Ransomware does the following:

• This is the Trend Micro detection for:
  • Ransom notes dropped by Ransom.Win32.THTLOCKER malware family.

Ransomware Routine

This Ransomware leaves text files that serve as ransom notes containing the following text:

• Hello. Sorry, your company's server hard drive was encrypted by us.
  
  We use the most complex encryption algorithm (AES256).Only we can decrypt.
  
  Please contact us: {BLOCKED}hackerteam@protonmail.com (Please check spam,Avoid missing mail)
  
  Identification code: {BLOCKED}d9qrvM (Please tell us the identification code)
  
  Ransom: Please pay bitcoins.After the payment is successful, we will tell the Password.
  (If the contact is fast, we will give you a discount.)
  
  In order for you to believe in us, we have prepared the test server.Please contact us and we will tell the test server and decrypt the password.
  
  How to buy and pay for Bitcoin:
  
  http://www.localbitcoins.com
  Or you can google search "How to buy Bitcoin"
  If you know other trading websites better.
  
  
  
  We are a professional hacker team, not a virus.We only take directional attacks.We know everything about your company.If you refuse to pay, we will disclose important documents that we have(file,email,contracts and many more).
  
  
  We are a reputable organization and definitely not a liar.Our business covers more than 20 countries around the world. There are hundreds of companies that have successfully unlocked.