ransomware with loader crash contact chinaobd2@protonmail.com extension

After our experts have examined submitted files, they typically will only reply about the submission if they can assist or need further information. If not, then the submissions were not helpful. Although they try, our crypto malware experts simply do not have the time to respond to individual topics which is why we use one support topic for each ransomware and everything related to it.
 
As such, I don't know if more file samples will be of any benefit.

The first mention of this ransomware was in 2022:
https://mhhauto.com/Thread-Rosstech-has-now-introduced-ransomware-virus-in-its-latest-versions-Vcds--346228?page=4

I need several encrypted files of the same type, as well as encrypted/unencrypted pairs.

Edited by rivitna, 06 November 2024 - 05:05 PM.

Yes, this discrediting has been going on for more than two years.

The name and the ransom email-login is based on legit software and hardware https://www.chinaobd2.com/

The fact that Russian information sites of some companies were hacked for some time directly indicates who was the initiator of this extortion campaign.

Distribution vector - via downloaded files, look for malicious files and archives in your downloads. Upload they to VT.

Insert result-link to message. So it will be clear, is this an new campaign or the remains of an old one. 

Edited by Amigo-A, 07 November 2024 - 04:10 AM.