Available_for_trial, catalogued in July 2023, is a Windows encryptor that discards the original file name altogether. Each file is renamed to available_for_trial. followed by a long random string, a second short random block and ._locked, producing a name resembling available_for_trial.835qq2k5633278334k67s214c.rhtaoe._locked. The ransom note is how_to_decrypt.hta, an HTML application that opens on screen. The note is written for businesses: it says the whole network, including documents, databases and backups, has been encrypted and copied to the attackers' servers, threatens to release the data should 48 hours pass without contact, and directs the victim to a Tor site. Several engines detect the sample as Trigona, which uses the same ._locked suffix and how_to_decrypt.hta note name; the name is most likely a Trigona trial or test build, so assume data was taken until ruled out. Trigona has its own entry on this site; files that keep their original names with ._locked tacked on belong there, not here.
Sources: In-house research
File extensions: ._locked
Ransom note filenames: how_to_decrypt.hta
Decryptor: Decryptor availability has not been recorded.
From the ransom note how_to_decrypt.hta:
the entire network is encrypted your business is losing money All documents, databases, backups and other critical data were encrypted and transfered to our servers We are using AES encryption, which makes recovery possible only using our software If you refuse to contact us, your data will be released to auction, competitors, media, clients, authorities, etc To recover your data, please follow the instructions […]
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161