ZinoCrypt is a Windows ransomware found in March 2017. It encrypts files with AES, appends .ZINO and drops ZINO_NOTE.TXT on the desktop. The note calls itself the 2017 edition, gives a personal ID and asks for Bitcoin through ZinoCrypt[@]protonmail.com. It aimed at English-speaking home and small-office users. No data theft or leak site is tied to it, and its lineage is not known.
Sources: In-house research
File extensions: .ZINO
Ransom note filenames: ZINO_NOTE.TXT
Contact addresses: ZinoCrypt[@]protonmail[.]com
Decryptor: Decryptor availability has not been recorded.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161