Resq100 is a Windows ransomware build from the BTC-azadi family, which descends from Proxima. It was active in June and July 2023. It adds .resq100 to each file, so 1.jpg becomes 1.jpg.resq100, and drops a note named resq_Recovery.txt. The operators ask to be contacted at resq100[@]onionmail.org or resq100[@]cyberfear.com. It hits Windows machines with no known sector focus. The note makes no claim of data theft and no leak site is linked to it. Sibling builds from the same family in 2023 used extensions such as .havoc, .Antoni and .alvaro.
Sources: In-house research
File extensions: .resq100
Ransom note filenames: resq_Recovery.txt
Contact addresses: resq100[@]cyberfear[.]com, resq100[@]onionmail[.]org
Decryptor: Decryptor availability has not been recorded.
From the ransom note resq_Recovery.txt:
YOURWHOLE NETWORK HAS BEEN PENETRATED BY resq100! As you can see we have penetrated your whole network due some critical network insecurities All of your files such as documents, dbs and... Are encrypted and we have uploaded many important data from your machines, and believe we us we know what should we collect. […]
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161