There is a new Ransomware Trojan that popped up a few days ago. It is called "hairullah@inbox(.)lv". It is distributed like most ransomwares do - through email attachments with malicious content, aggressive spam or through websites hosting exploit kits.
If you get infected, the Trojan will stay hidden for a while until it scans your system seeking to exploit files with the following extensions: txt, zip, rar, pdf, jpg, msi, iso, xml, inf, dwg, rtf, csv, avi, doc, xlx, db. After such files are found, they will be encrypted with the extension “id-0123456789_hairullah@inbox(.)lv”, where the numbers in the extension may vary. After the encryption the user will be asked to pay a ransom to unlock his files via a message that can re-appear after every restart of the machine.
Some researchers believe that this particular Ransomeware targets files only on a computer’s data storage that have been mapped and assigned a letter, such as HDDs, SSDs, and any removable drives.
Do you know any information regarding this Ransomeware? If you have come across it – with what security software did you remove it and have you somehow managed to get your files decrypted?
