It adds that the email messages must contain the unique ID (generated individually for each victim). The ransom message in the pop-up window provides more information concerning the encryption. If they wish to recover it, they are instructed to send a message to the cyber criminals behind the ransomware infection via email. The text file (' FILES ENCRYPTED.txt') informs victims that their data has been encrypted. Updated variants of this ransomware use the ' extension for encrypted files. For example, a file such as ' 1.jpg' would appear as something similar to ' following encryption.Īfter this process is complete, a text file (' FILES ENCRYPTED.txt') is created on the desktop and a pop-up window is displayed.

Systems infected with this malware have their data encrypted and demand ransom payments for decryption.ĭuring the encryption process, all compromised files are renamed according to the following pattern: original filename, unique ID assigned to the victims, cyber criminals' email address and the '. Discovered by Jakub Kroustek, PLEX is malicious software belonging to the Crysis/Dharma ransomware family.

Plex file renaming tool