DeathRansom Ransomware (.wctc; read_me.txt)

[akc3416 0]

This is the text file..

 

?????????????????????????

??????DEATHRansom ???????

?????????????????????????

Hello dear friend,

Your files were encrypted!

You have only 12 hours to decrypt it

In case of no answer our team will delete your decryption password

Write back to our e-mail: [email protected]

 

 

In your message you have to write:

1. YOU LOCK-ID: PUmZiYT3OkC9IpVXHpZFOFzZ5Y7+dLuV9cYUSZ30UyPLeMPEPO4TZ79CCCbiTpSltqKKBv3oFqgH0O6lyre7hv3CJH9Dj22QqbrG/TDRsN7I51ByXUmbeXy2O4OFxPXuUBUPiFdevwY/9KEb1c+vfP9sDY2i2e5m8rtlFsig7F4ZGPlOPmf/zxGbP1frxuW+NA9KUN0eR2C9NSH1AmDZ4rAAvCjmDKgOhCniLiT2UE+TAIDExPdCHmiKIAg1wEGg4udkRpIpn8BYSr1O+mFkBCOinIpOHAyAgnraDDjTcqtYAUO3WlglahxoufFQlwml3Sn7g0G1UAgauxSHrHZNsppuiTvCbEFLVjVGSVfsrQFIaINiTldYjjoLM05lNhjIjIW+TIRFu0PSdp3+7CdV/UoRJtpI1qrp/ltJG5Gn+q5n2/fIMnJpkxIXlqlUcmHomfpGxzFcT2x+hsAQiPmaqXpKZ2dUHjeCHYlMBVIWEj3IzPPp5mxLESliaDT2dU3XS8ONNMfhLa6ObVpg9IZKoFlQFDDMb4o6RtExkfoWSzBLl2GD+8uHbpQvPPXm4NfSYOhpd2J5rnHZtVUYkg+k2DrS+F9FJKRw0OkgMsiVHZAenm2+u2q38/D3+/cPeRns/3aDg5J8DrUyTPrvZ46d393P9C+FZzvdF+d04nxMcg15PdvFXjvfRZEOps1qpwbbuqzO3LtV3MzTmNRFf2LRVQ==

2. Time when you have paid 0.1 btc to this bitcoin wallet:

1J9CG9KtJZVx1dHsVcSu8cxMTbLsqeXM5N

 

 

After payment our team will decrypt your files immediatly

 

 

Free decryption as guarantee:

1. File must be less than 1MB

2. Only .txt or .lnk files, no databases

3. Only 1 files

 

 

How to obtain bitcoin:

The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.

https://localbitcoins.com/buy_bitcoins

Also you can find other places to buy Bitcoins and beginners guide here:

http://www.coindesk.com/information/how-can-i-buy-bitcoins/

[Amigo-A 44]

Hello @akc3416

This is Wacatac or DeathRansom Ransomware

The first version, it seems, did not encrypt the files - several researchers of the first option reported this.
But in newer versions, like your case, the files are already encrypted.

This is a new ransomware and it is being researched.
There is hope for recovering some types of files. But so far there is no evidence to which I can give a link.

Encrypted files and ransom notes need to be saved, it is possible that in the future there will be a decryptor.

[GT500 594]

I recommend keeping an eye on BleepingComputer's news feed, as they usually report when new decrypters are available, that way you'll know if a decrypter is released for this ransomware:
https://www.bleepingcomputer.com/

[Amigo-A 44]

You also need to follow the new answers in the support topic, to which we send victims.