This ransomware encrypts user data with Salsa20, and then requires you to write to email to learn how to pay the ransom and return the files. The extension is added to the encrypted files:.
In fact, the compound extension according to the template is used: .mailto [kokoklock@cock.li]. .mailto []. Sub . there may be numbers and letters in lower case. Examples of encrypted files: original_filename.mailto [kokoklock@cock.li] .1be018 and original_filename.mailto [kokoklock@cock.li] .d0e731
Mailto, (Netwalker) Ransomware Signatures
Family: TrojanProxy:Win32/Bunitu.HA!MTB
MD5: d60d91c24570770af42816602ac19c97
SHA256: 416556c9f085ae56e13f32d7c8c99f03efc6974b2897070f46ef5f9736443e8e
Mailto, (Netwalker) Ransomware Download
