As it is often the case with brand new malware discoveries, this sample is buggy and not yet ready to infect any system because it crashes in it's current state. However, the threat actor's reply shows they are active and might have already published versions that work. It's usually just a matter of time until those flaws are fixed. The problematic choice of the Fernet encryption method may take its toll on systems while they try to encrypt gigabyte sized files in RAM all at once.
Some parts of the code show an intention of also infecting Darwin and Linux systems, which may be added later on.
Unfortunately, there is currently no known way to decrypt files without the key.
![[correlate]](/data/avatars/s/79/79653.jpg?1556985072){kind=avatar}