VoNiX is a Windows ransomware strain from the Xorist family, seen in 2023. It appends .VoNiX with mixed-case letters and writes HOW TO DECRYPT FILES.txt as its note. The same demand, about 0.04 Bitcoin, also shows in an error box and on the wallpaper. No data theft or leak site is tied to this strain.
Sources: In-house research
File extensions: .VoNiX
Decryptor: Decryptor availability has not been recorded.
From the ransom note HOW TO DECRYPT FILES.txt:
Hello All your files have been encrypted if you want to decrypt them you have to pay me 0.04 bitcoin. Make sure you send the 0.04 bitcoins to this address: bc1q2ne303wy3f2lv7wweq47khanvqmpe4c4nctwlq If you do not own bitcoin, you can easily buy it from this sites: www.coinmama[.]com www.bitpanda[.]com www.localbitcoins[.]com www.paxful[.]com You can find a larger list here: hxxps[://]bitcoin[.]org/en/exchanges […]
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161