.Devos Ransomware

[EiTsang 0]

Computer files are encrypted

.Devos Ransomware

Is there a solution now?

[Amigo-A 132]

Attach a ransom note and several encrypted files to message. 

If nothing has changed, then this is Phobos Ransomware. But we need to look at the files to confirm this.

[EiTsang 0]

!!!All of your files are encrypted!!!
IMPORTANT!!! WRITE TO US AT ONCE ON TWO SPECIFIED E-MAIL!!! TWO AT ONCE!!!
[email protected], [email protected]

★Communication methods left by gangsters，Bitcoin transactions

 

[Amigo-A 132]

Need a ransom note file and several encrypted files. They need to be attached to the message. Quoting is not necessary.

[GT500 812]

You can attach a copy of the ransom note and an encrypted file to a reply, which will help us identify the ransomware for you. Either drag and drop them into the reply field, or use the "choose files" link next to the paperclip icon at the bottom of the reply field.

[EiTsang 0]

新文字文件（2）.reg.id [B89DA01C-2692]。[[email protected]]。德沃斯LOGO180x180.PNG.id [B89DA01C-2692]。[[email protected]]。德沃斯OPP計劃-B20181116.pdf.id [B89DA01C-2692]。[[email protected]]。德沃斯

20160318公交會性別平等.docx.id[B89DA01C-2692].[[email protected]].Devos

[EiTsang 0]

德沃斯OPP 。新文字文件（2）.reg.id [B89DA01C-2692]。[[email protected]]。德沃斯LOGO180x180.PNG.id [B89DA01C-2692]。[[email protected]]。德沃斯info.htaOPP計劃-B20181116.pdf.id [B89DA01C-2692]。[[email protected]]。德沃斯

info.txt

[GT500 812]

The ransom notes were empty, however this appears to be Phobos:
https://id-ransomware.malwarehunterteam.com/identify.php?case=284e2d553e29b00c7be452e1e459ebcffc0a3787