FANDOM


Defray or Defray777 is a dangerous crypto extortionist that seeks to gain profit from various companies (health care industry in particular) and home users by encrypting their data and demanding ransom. 

After being discovered in 2017, Defray came back at the end of 2018 and continued its activity in 2019 with a few new distinct features.

Behavior

Unlike other similar malware, Defray does not rename or append extensions to encrypted files.

Payload

Transmission

Defray can be distributed by infected email attachments (macros), torrent websites, malicious ads.

Infection

Once infiltrated, Defray encrypts stored data using AES-256, RSA-2048, and SHA-2 cryptographies

Following successful encryption, the virus creates two text files: "HELP.txt" (placed on the desktop) and "FILES.txt" (placed in all existing folders). Both contain identical ransom-demand messages.

This malware is distributed using spam emails that contain a malicious attachment - an MS Office document with an embedded executable. Furthermore, most ransomware-type viruses are aimed at private users, however, Defray specifically targets hospitals or even large manufacturing companies. Cyber criminals tailor the aforementioned messages to the targeted company or organization (for example, it may include the company logo or other specific details). In this way, criminals attempt to make the document appear authentic in order to trick victims into running the malware.

As mentioned above, Defray generates two text files. These contain an identical message informing victims of the encryption and making ransom demands of the equivalent of $5000 in Bitcoins. Defray malware employs AES, RSA, and SHA cryptographies. Therefore, decryption requires several unique keys. These are stored on a remote server controlled by Defray's developers, and victims are encouraged to pay a ransom to receive them.

Ransom-demand message presented within Defray ransomware text files ("HELP.txt" and "FILES.txt"):

Don't panic, read this and contact someone from IT department.
Your computer has been infected with a virus known as ransomware.
All files including your personal or business documents, backups and projects are 
encrypted.
Encryption is very sophisticated and without paying a ransom you won't get your files 
back.
You could be advised not to pay, but you should anyway get in touch with us.
Ransom value for your files is 5000$ to be paid in digital currency called Bitcoin.
If you have questions, write us.
If you have doubts, write us.
If you want to negotiate, write us.
If you want to make sure we can get your files back, write us.

glushkov@protonmail.ch
glushkov@tutanota.de
igor.glushkov.83@mail.ru

In case we don't respond to an email within one day, download application called 
BitMessage and reach to us for the fastest response.
BitMessage BM-2cVPKqFb5ZRaMuYdryqxsMNxFMudibvnY6

#########################################################################

To someone from IT department

This is custom developed ransomware, decrypter won't be made by an antivirus
company. This one doesn't even have a name. It uses AES-256 for encrypting
files, RSA-2048 for storing encrypted AES-256 password and SHA-2
for keeping the encrypted file integrity. It's written in C++ and have passed
many quality assurance tests. To prevent this next time use offline backups.

#########################################################################
Community content is available under CC-BY-SA unless otherwise noted.