In this message, the criminals report that all the files were encrypted and the only way to decrypt them is to buy a decryptor and key.

This file contains a message from Robm creators. But the contents of this file are the same everywhere. Screenshot of the contents of ‘_readme.txt’ file (Robm ransom note)Īll directories with encrypted files have this file. It encrypts file by file, when all the files in the directory are encrypted, it drops a new file in the directory, which is called ‘_readme.txt’. Therefore, files located in network attached storage and external devices can also be encrypted. Robm ransomware can encrypt files located on all drives connected to the computer. If a file was called ‘document.docx’, then after encryption, it will be named ‘’. bkpĮach file that has been encrypted will be renamed. Thus, the following common file types can be easily encrypted: Robm ransomware has the ability to encrypt files of any type, regardless of what is in them. This key is the same for different victims, which makes it possible in some cases to decrypt files that were encrypted during the ransomware attack. If the ransomware cannot establish a connection with its command and control server (C&C) before starting the encryption process, then it uses an offline key. For each victim, it uses a unique key with a small exception. Robm encrypts files using a strong encryption method, which eliminates the possibility of finding a key in any way. Like other variants, it encrypts all files on the computer and then demands a ransom for decryption. Robm ransomware is a new malware, the latest variant of STOP (djvu) ransomware. Screenshot of files encrypted by Robm virus (‘.robm’ file extension) QUICK LINKS

Hitmanpro alert blocks disk format tool