Paradise

Paradise is a ransomware virus advertised as RAAS (Ransomware As A Service). The developers allow affiliates to perform minor changes (for example, change the contact email address and ransom amount) and, by doing so, they avoid the task of malware distribution - they use affiliates to proliferate the malware. Developers generate revenue by taking a percentage of the ransom payments. After infiltration, Paradise encrypts the stored data using RSA-1024 cryptography and adds the extension "id-[affiliate_id].[affiliate_email].paradise" to the encrypted file names. For example, "sample.jpg" could be renamed "sample.jpgid-3VwVCmhU.[info@decrypt.ws].paradise". After a successful encryption, Paradise creates three text files ("Files.txt", "Failed.txt", and "#DECRYPT MY FILES#.txt") placing them on the desktop.