,
7 tweets,
2 min read
Read on Twitter
New Fake 'Eva Richter' Resume Spam Aims to Destroy Files - by @LawrenceAbrams
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
A new spam campaign is underway that targets German speaking users with the Ordinypt data destroying malware,
This campaign pretends to be a job application from 'Eva Richter' and has an attached image and zip file containing her resume. From the victims we have seen, the campaign started on approximately 9/11/19. 
The zip file contains EXE trying to masquerade as a PDF because Microsoft refuses to show extensions by default.
When installed, it looks just like a normal ransomware. It appends extensions, drops ransom notes, and even has a Tor payment site. The ransom payment is set to 0.1473766 BTC or approximately $1,518.92 USD from the victims we have seen.
The files, though, are filled with garbage data and can longer be decrypted. Therefore, paying for the decryptor achieves nothing.
This is third campaign that we are aware of that Ordinypt targeted German users.
