Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Bloccato Ransomware (.bloccato) Help & Support - LEGGI QUESTO FILE.txt


  • Please log in to reply
No replies to this topic

#1 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,251 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:08:12 PM

Posted 18 May 2016 - 06:02 PM

A new ransomware has been was spotted that is possibly targeting victims in Italy. This ransomware encrypts files using AES-256, and adds the extension ".bloccato".

 

The ransom note "LEGGI QUESTO FILE.txt" is left on the desktop with the following contents.

 

 

EGREGIO AMICO, I SUOI FILES SONO STATI CRIPTATI CON UN ALGORITMO AD ELEVATA CIFRATURA

LA CHIAVE PER RIPRISTINARE I SUOI FILES È STATA MEMORIZZATA SU UN NOSTRO SERVER SEGRETO\nPER AVERLA DOVRÀ PAGARE CON 5 BITCOIN ENTRO MASSIMO 3 GIORNI
QUALORA NON DOVESSE PAGARE ENTRO I TERMINI SPECIFICATI, IL COSTO DELLA CHIAVE SALIRÀ AUTOMATICAMENTE A 10 BITCOIN
E AVRÀ SOLO ALTRE 72 ORE DI TEMPO PER PAGARE.
SE RIFIUTA DI PAGARE LA CHIAVE VERRÀ DISTRUTTA DEFINITIVAMENTE
MEDESIMO DESTINO SE PROVERÀ A RIMUOVERE O A ELIMINARE QUESTO PROGRAMMA
PER SAPERE COME FARE AD EFFETTUARE IL PAGAMENTO IN BITCOIN VADA SU QUESTO SITO: WWW.COMPRABITCOIN.IT O SU WWW.BITCOIN.ORG/IT O BISTAMP.NET
SE RISCONTRASSE DIFFICOLTÀ LA INVITO A RIVOLGERSI AD UN ESPERTO INFORMATICO PER FARSI AIUTARE
QUESTO È L'INDIRIZZO BITCOIN A CUI INVIARE IL DENARO: 1FVGnjjRNg8k7RgXMsvQpVdeRyJtHsXV6T
ENTRO 72 ORE DAL RICEVIMENTO DEL PAGAMENTO LE INVIEREMO IL CODICE,
E TUTTE LE INFORMAZIONI UTILI ALLO SBLOCCO DI TUTTI I SUOI FILES.
CERTO DI UN SUO FAVOREVOLE RISCONTRO LE PORGO I MIEI PIÙ CORDIALI SALUTI
 
The following extensions are targeted for encryption.
 

 

.avi, .csv, .dbf, .dif, .doc, .docx, .dwg, .dxf, .eps, .fm3, .html, .jpeg, .jpg, .mdb, .mov, .odt, .pdf, .png, .pps, .ppt, .pptx, .psd, .rar .rtf, .sql, .txt, .wks, .xls, .xlsx, .xml, .zip

 

 

An odd reference is made to the Italian Prime Minister Matteo Renz as part of the form, source code, and the name of the executable. This possibly suggests the developer is attempting to distribute it via spam. The file originally is named as "matteo-renzi.exe" with a description of "matteo_renzi".

 

Mmgd9zu.png

 

If you or someone has been hit by this ransomware, do not pay and post here for assistance.


Edited by Demonslay335, 18 May 2016 - 06:07 PM.

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


BC AdBot (Login to Remove)

 


m



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users