DEFI Ransomware ([email protected])

The Defi virus belongs under the ransomware type of malicious agent. Ransomware of this type encrypts all user’s data on the PC (photos, documents, excel sheets, audio files, videos, etc) and appends its extra extension to every file, creating the +README-WARNING+.txt files in every folder which contains the encrypted files.

Defi virus: what is known so far?

The pattern of renaming is the following: .defi1328. After the encryption, a file entitled, for example, “report.docx” will be altered to “report.docx.[1D02AF5A].[[email protected]].defi1328”.

In every folder with the encrypted files, a +README-WARNING+.txt text document will appear. It is a ransom money note. It contains information on the ways of contacting the racketeers and some other remarks. The ransom note usually contains a description of how to purchase the decryption tool from the ransomware developers. You can obtain this tool after contacting [email protected], [email protected] through email. That is how they do it.

Defi Summary:

The +README-WARNING+.txt file accompanying the Defi ransomware states the following:

::: Greetings :::

Little FAQ:

.1.
Q: Whats Happen?
A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen.

.2.
Q: How to recover files?
A: If you wish to decrypt your files you will need to pay us.

.3.
Q: What about guarantees?
A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests.
To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.

.4.
Q: How to contact with you?
A: You can write us to our mailboxes: [email protected] or [email protected]

.5.
Q: How will the decryption process proceed after payment?
A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.

.6.
Q: If I don t want to pay bad people like you?
A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money.

:::BEWARE:::
DON\'T try to change encrypted files by yourself!
If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files!
Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

In the screenshot below, you can see what a directory with files encrypted by the Defi looks like. Each filename has the “.defi1328” extension added to it.

How did Defi ransomware end up on my PC?

There are many possible ways of ransomware infiltration.

Nowadays, there are three most exploited ways for hackers to have the Defi virus planted in your system. These are email spam, Trojan infiltration and peer-to-peer file transfer.

• Another thing the hackers might try is a Trojan horse model. A Trojan is a program that infiltrates into your computer disguised as something else. Imagine, you download an installer for some program you want or an update for some program. However, what is unpacked reveals itself a harmful agent that encrypts your data. Since the installation file can have any name and any icon, you’d better be sure that you can trust the source of the stuff you’re downloading. The best thing is to use the software companies’ official websites.
• As for the peer-to-peer file transfer protocols like BitTorrent or eMule, the threat is that they are even more trust-based than the rest of the Web. You can never guess what you download until you get it. So you’d better be using trustworthy resources. Also, it is a good idea to scan the directory containing the downloaded files with the antivirus as soon as the downloading is done.

How do I get rid of ransomware?

It is crucial to note that besides encrypting your data, the Defi virus will most likely install Vidar Stealer on your computer to seize your credentials to various accounts (including cryptocurrency wallets). The mentioned spyware can derive your credentials from your browser’s auto-filling cardfile.

How сan I avert ransomware injection?

Defi ransomware has no superpower, neither does any similar malware.

You can protect your system from ransomware injection taking three easy steps:

• Ignore any emails from unknown mailers with unknown addresses, or with content that has likely no connection to something you are expecting (how can you win in a lottery without participating in it?). If the email subject is more or less something you are expecting, check all elements of the suspicious email carefully. A hoax letter will always have mistakes.
• Do not use cracked or untrusted software. Trojan viruses are often shared as an element of cracked software, most likely under the guise of “patch” which prevents the license check. Understandably, dubious programs are very hard to distinguish from trustworthy ones, as trojans may also have the functionality you seek. Try to find information about this software product on the anti-malware message boards, but the best way is not to use such software.

FAQ

🤔 Is it possible to open “.defi1328” files?

There’s no way to do it, unless the files “.defi1328” files are decrypted.

🤔 The encrypted files are very important to me. How can I decrypt them quickly?

It’s good if you have fаr-sightedly saved copies of these important files elsewhere. In case you haven’t, there is still a chance that you do have a Restore Point from some time ago to roll back the whole system to the moment when it had no virus yet, but already had your files. The rest of the methods require patience.

🤔 What should I do if the Defi virus has blocked my computer and I can’t get the activation key.

🤔 What could help the situation right now?

Some of the blocked files can be located elsewhere.

• If you sent or received your important files through email, you could still download them from your online mailbox.
• You might have shared images or videos with your friends or family members. Just ask them to give those images back to you.
• If you have initially got any of your files from the Internet, you can try downloading them again.
• Your messengers, social media pages, and cloud disks might have all those files too.
• It might be that you still have the needed files on your old computer, a notebook, cellphone, memory stick, etc.

HINT: You can employ data recovery programs¹ to retrieve your lost information since ransomware blocks the copies of your files, deleting the original ones. In the tutorial below, you can learn how to use PhotoRec for such a recovery, but remember: you can do it only after you kill the virus with an anti-malware program.

1. Here’s the list of Top 10 Data Recovery Software Of 2024.