[Jun, 8, 2020] - Version: 188.8.131.52
Zorab pretends to be a ransomware decryptor, but instead re-encrypts it's victims files with AES-256 and adds the extension ".ZRB" to files.
The ransom note "--DECRYPT--ZORAB.txt" contains the following text:
—+-= ZORAB =-+— Attention! Attention! Attention! Your documents, photos, databases and other important files are encrypted and have the extension: .ZRB Don't worry, you can return all your files! The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. if you want to decrypt your files The only method of recovering files is to purchase decrypt tool This tool will decrypt all your encrypted files. To get this software you need write on our e-mail: [email protected] What guarantees do we give to you? Its just a business. We absolutely do not care about you and your deals, except getting benefits. You can send 2 your encrypted file from your PC and we decrypt it for free. +--Warning--+ DONT try to change files by yourself, DONT use any third party software for restoring your data Your personal id: [redacted hex]