If the victim is ready to pay the ransom quickly, within 72 hours, the size of the ransom is halved to $490. Attackers demand a ransom of $980 in exchange for a key and a decryptor. Criminals report that all files on the computer are encrypted, and only the key and decryptor can decrypt these files and restore access to their contents. The contents of this file are a ransom demand message. Screenshot of the contents of ‘_readme.txt’ file (ransom demand message) An example of the contents of this file is given below. The criminals place such a file in every directory where there is at least one encrypted file. This message is in a file called ‘_readme.txt’. This is reported by the authors of Eucy virus, in a message that they leave on the infected computer. To decrypt it, you must use the key and the decryptor. So, every “Eucy file” is an encrypted file. Thus, the following types of files can be encrypted: The ransomware only does not encrypt files in the Windows system directories, files with the extension.

No matter where the file is located, on the internal drive or network storage, this file will be encrypted. Each file on the victim’s computer becomes the target of the Eucy virus. This means the following, if the file was named ‘document.docx’, then after it is encrypted, it will be called ‘’. This gives hope that the ransomware victims will be able to decrypt files without paying ransom.Įucy virus renames each encrypted file by adding the extension. The offline key is fixed and can be determined by security researchers. The main difference between an online key and an offline key is that the online key is in the hands of criminals and cannot be determined. If the connection to the command server has not been established, then the virus uses a fixed key (so-called ‘offline key’). If this succeeds, the virus sends data about the infected computer to the server, and from it receives a key (so-called ‘online key’) necessary for file encryption. After that, Eucy virus tries to connect to its command server. Upon execution, the virus creates a directory in the Windows system directory, copies itself to this directory, changes some OS settings, and also collects information about the infected computer. Typically, ransomware such as Eucy can infect a computer when installing programs downloaded from torrent web-sites as well as when running cracked games, freeware, key generators and other similar software.

Eucy virus sneaks into the system without any visible symptoms, which is why users notice that their computer is infected too late, when the files are already encrypted.

Screenshot of files encrypted by Eucy virus (‘.eucy’ file extension) QUICK LINKSĮucy ransomware is a new malware that is created to encrypt files located on the victim’s computer, and then extort money to decrypt them.

Photorec testdisk bitcoin .wallet