Dirty App: Payuranson Ransomware – How To Stop and Remove

Ransomware continues to pose a serious threat to computer users worldwide, with new variants emerging regularly. Among these, a Skynet ransomware variant dubbed Payuranson has recently caught the attention of cybersecurity experts. This article delves into the specifics of Payuranson, its impact, and the steps you can take to protect your system and recover your files.

What is Payuranson Ransomware?

Payuranson is a ransomware variant identified during a routine inspection of malware samples on the VirusTotal site. This malicious software is designed to encrypt files on the victim’s computer, effectively locking them until a ransom is paid. Once infected, Payuranson renames files by appending the “.payuranson” extension. For instance, a file named “1.jpg” becomes “1.jpg.payuranson,” rendering it inaccessible without the decryption key.

The Ransom Note: What to Expect

The ransomware leaves a ransom note titled “SkynetData.txt,” which is presented in multiple languages, including Russian, English, and French. The note informs the victim that their files have been encrypted and offers a decryption tool for $130, payable only in cryptocurrency. The attackers provide cryptocurrency wallet addresses for both Bitcoin (BTC) and Ethereum (ETH) and instruct victims to contact them via email (imhear.ru(at)protonmail.com) or Telegram (@payurransom) to confirm payment and begin the decryption process.

The Payuranson ransom note is worded like the following:

________________________________________________________________________

———————— ALL YOUR FILES ARE ENCRYPTED ————————
—-> Оставайтесь сосредоточенными. <—-
Все ваши файлы зашифрованы
Ваш компьютер заражен вирусом-вымогателем.
Ваши файлы зашифрованы, и вы не будете
сможете расшифровать их без нашей помощи.
Что я могу сделать, чтобы восстановить файлы?
Вы можете купить наше программное обеспечение для дешифрования, это программное обеспечение позволит вам восстановить все ваши данные и удалить
программы-вымогатели с вашего компьютера.
Цена программного обеспечения составляет 130 долларов США (0,0027 BTC).
 может быть произведена только в биткойнах.
Как оплатить, где я могу получить биткойны?
Покупка биткойнов варьируется от страны к стране, лучше всего выполнить быстрый поиск в Google.
Сами узнайте, как купить биткойн.
Многие из наших клиентов отмечают, что эти сайты работают быстро и надежно:
Коинмама — hxxps://www.coinmama.com
Битпанда — hxxps://www.bitpanda.com
BTC : 19DpJAWr6NCVT2oAnWieozQPsRK7Bj83r4
ETH : 0x55069B5317529E07ccABAaA5AaE22a9bfa1C3E12
Для подтверждения покупки свяжитесь с администратором по электронной почте или в Telegram:
Электронная почта — imhere.ru@protonmail.com
ТЛГ – @payurransom
———————————————-
—-> Stay focused. <—-
All your files have been encrypted
Your computer has been infected with a ransomware virus. Your files have been encrypted and you won’t be
be able to decipher them without our help. What can I do to recover my files?
You can buy our decryption software, this software will allow you to recover all your data and delete the ransomware from your computer.
The price of the software is $130 (0.0027 BTC).
Payment can only be made in Bitcoin.
How to pay, where can I get Bitcoin?
Buying Bitcoin varies from country to country, it’s best to do a quick Google search.
Yourself to find out how to buy Bitcoin.
Many of our customers have reported these sites to be fast and reliable:
Coinmama – hxxps://www.coinmama.com
Bitpanda – hxxps://www.bitpanda.com
BTC : 19DpJAWr6NCVT2oAnWieozQPsRK7Bj83r4
ETH : 0x55069B5317529E07ccABAaA5AaE22a9bfa1C3E12
To confirm your purchase, please contact the administrator via email or Telegram:
Email – imhere.ru@protonmail.com
TLG – @payurransom
———————————————-
—-> Restez concentré. <—-
Tous vos fichiers ont été cryptés
Votre ordinateur a été infecté par un virus ransomware. Vos fichiers ont été cryptés et vous ne le serez pas pouvoir les décrypter sans notre aide.
Que puis-je faire pour récupérer mes fichiers ?
Vous pouvez acheter notre logiciel de décryptage, ce logiciel vous permettra de récupérer toutes vos données et de supprimer les
ransomware depuis votre ordinateur.
Le prix du logiciel est de 130 $ ( 0,0027 BTC).
Le paiement peut être effectué uniquement en Bitcoin.
Comment payer, où puis-je obtenir du Bitcoin ?
L’achat de Bitcoin varie d’un pays à l’autre, il est préférable de faire une recherche rapide sur Google.
Vous-même pour découvrir comment acheter du Bitcoin.
Beaucoup de nos clients ont signalé que ces sites étaient rapides et fiables :
Coinmama – hxxps://www.coinmama.com
Bitpanda – hxxps://www.bitpanda.com
BTC : 19DpJAWr6NCVT2oAnWieozQPsRK7Bj83r4
ETH : 0x55069B5317529E07ccABAaA5AaE22a9bfa1C3E12
Pour confirmer votre achat, veuillez contacter l’administrateur via mail ou Telegram :
Mail – imhere.ru@protonmail.com
TLG – @payurransom

Should You Pay the Ransom?

Paying the ransom is strongly discouraged. There is no guarantee that the attackers will provide the decryption tool after receiving the payment. Moreover, paying the ransom only encourages further criminal activity. Instead, victims are urged to explore alternative methods for file recovery, such as using third-party decryption tools or restoring files from backups.

Removing Payuranson Ransomware

If your computer is infected with Payuranson, it is crucial to remove the ransomware immediately. Failure to do so may result in additional file encryption and the potential spread of the malware within your network. Anti-malware programs are highly effective in identifying and removing ransomware from infected systems. By running a comprehensive scan, you can detect and eliminate Payuranson before it causes further damage.

Understanding Ransomware

Ransomware is a type of malware designed to encrypt files on a victim’s device, making them inaccessible. Attackers then demand a ransom in exchange for the decryption key. While the temptation to pay the ransom can be strong, it is important to resist. The act of paying does not guarantee the recovery of your files and may lead to further exploitation.

How Did Payuranson Infect Your Computer?

Ransomware can infiltrate your system through various means, most commonly via malicious links or attachments in fraudulent emails. Visiting compromised or malicious websites, downloading pirated software, or clicking on malicious advertisements can also result in infection. Additionally, ransomware often exploits vulnerabilities in outdated software or operating systems, making regular updates essential for security.

Protecting Yourself from Ransomware Infections

To safeguard your system against ransomware, it is vital to practice caution when interacting with online content. Here are some key steps to protect yourself:

1. Be Wary of Suspicious Emails: Avoid clicking on links or downloading attachments from unsolicited emails, especially those from unknown senders.
2. Download Software from Reputable Sources: Stick to clean websites and app stores when downloading software, and steer clear of pirated programs or cracking tools.
3. Keep Software Updated: Regularly update your operating system, software, and antivirus programs to patch vulnerabilities that ransomware could exploit.
4. Avoid Questionable Websites: Refrain from visiting sites that may be compromised or engaging with ads and pop-ups on such sites.

If your system has already fallen victim to Payuranson, taking swift action is crucial. Downloading and installing a reliable anti-malware program can help you automatically detect and remove this ransomware, preventing further damage and securing your files.

Ransomware like Payuranson continues to evolve, posing an ever-growing threat to users worldwide. By understanding how ransomware works and taking proactive measures to protect your system, you can significantly reduce the risk of falling victim to these malicious attacks. Remember, prevention is always better than cure—stay vigilant, stay protected.