Screenshot of a message encouraging users to pay a ransom to decrypt their compromised data: Removal of the ransomware does not decrypt files, it simply prevents the malware from causing any further encryption. Typically, the only way to avoid being scammed and recover files without making payment is to restore them from an existing backup. Only the people who develop ransomware (in this case, RedRum) hold tools that can decrypt files encrypted by the program. Victims supposedly receive these assets after payment, however, you are not advised to trust or pay any cyber criminals (ransomware developers) - they often send no decryption tools, even if victims meet all demands. The cost of the decryption tools is unknown, however, it is made clear that decryption without them is impossible. They are encouraged to do so immediately, since, once 60 hours after encryption has passed, the cost of decryption software and key will increase by 10% per day. The 'decryption.txt' text file states that victims must contact cyber criminals via the (or email address and provide the appointed ID. It also stores ransom messages in the form of text files (named ' decryption.txt') in all folders that contain encrypted files. redrum' extension.įor example, ' 1.jpg' might be changed to ' 1.' or similar (updated variants append '.

RedRum encrypts files, rendering them inaccessible unless victims recover them with decryption software and keys that can purchased from the cyber criminals who designed this ransomware. RedRum renames all encrypted files by adding the victim's ID and email address to their filenames and appending the '.

Redrum victims of our circumstances rar