Everbe 2.0 is the second generation of the Everbe family, first seen in July 2018. Each build appends the operator's email in brackets and a build tag, so the extension varies: the build calling itself EVIL LOCKER used .[evil[@]cock.lu].EVIL, and other 2.0 builds used tags such as .HYENA, .divine, .NOT_OPEN and .EVEREST with their own addresses. The note is !_HOW_RECOVERY_FILES_!.txt, a block of 512 hexadecimal characters, probably the encrypted key, is written into each encrypted file, and shadow copies are deleted. The note asks victims to email the operator with a personal ID and offers to decrypt up to three unimportant files as proof. This generation has no leak site on record and no history of data theft. It follows Everbe 1.0, whose builds used .everbe, .embrace and .pain and the note !=How_recovery_files=!.txt; a free tool exists for 1.0 files but was not built for 2.0, so the note name and extension decide which page applies.
Sources: ID Ransomware
File extensions: .EVIL
Contact addresses: evil[@]cock[.]lu, evillock[@]cock[.]li
Decryptor: Decryptor availability has not been recorded.
From the ransom note !_HOW_RECOVERY_FILES_!.txt:
>>>>>>>>>>>>>>>>>>>>>>>>>>>> EVIL LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<< HELLO, DEAR FRIEND! 1. [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ] Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the decryption program. 2. [ HOW TO RECOVERY FILES? ] […]
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161