Eaf virus: what is known so far?

The renaming will be executed according to the following scheme: [contact_email][victimID].original_file_name.EAF. In the process of encryption, a file entitled, for instance, “report.docx” will be renamed to “[][9ECFA84E]report.docx.EAF”.

In every folder with the encrypted files, a #FILES-ENCRYPTED.txt text file will be created. It is a ransom money memo. It contains information about the ways of contacting the racketeers and some other remarks. The ransom note most probably contains a description of how to purchase the decryption tool from the tamperers. You can get this tool after contacting by email. That is how they do it.

The #FILES-ENCRYPTED.txt document coming in package with the Eaf ransomware provides the following dispiriting information:

ATTENTION!
At the moment, your system is not protected.
We can fix it and restore files.
To get started, send a file to decrypt trial.
Don\'t pay any money, when we didn\'t decrypt trial file.
You can trust us after opening the test file.
To restore the system write to this address:


Email 1: 
Email 2:  

In the image below, you can see what a directory with files encrypted by the Eaf looks like. Each filename has the “.EAF” extension added to it.

How did Eaf ransomware end up on my PC?

There are currently three most exploited ways for hackers to have ransomware working in your system. These are email spam, Trojan infiltration and peer networks.

If you access your mailbox and see emails that look like familiar notifications from utility services companies, postal agencies like FedEx, web-access providers, and whatnot, but whose mailer is strange to you, beware of opening those emails. They are most likely to have a viral item attached to them. So it is even riskier to download any attachments that come with letters like these.

Another thing the hackers might try is a Trojan virus model². A Trojan is a program that infiltrates into your computer disguised as something different. Imagine, you download an installer for some program you need or an update for some program. But what is unboxed reveals itself a harmful program that corrupts your data. Since the installation wizard can have any title and any icon, you’d better be sure that you can trust the source of the files you’re downloading. The best thing is to trust the software companies’ official websites.

As for the peer-to-peer file transfer protocols like torrents or eMule, the danger is that they are even more trust-based than the rest of the Web. You can never know what you download until you get it. So you’d better be using trustworthy resources. Also, it is reasonable to scan the directory containing the downloaded objects with the antivirus as soon as the downloading is done.