FunFact is a type of ransomware that encrypts your files and demands a ransom to decrypt them. Attackers spread this ransomware through malicious emails or websites. Once your computer is infected, this ransomware will encrypt your files and append the ".funfact" extension to them. For example, "sample.jpg" would become "sample.jpg.funfact". FunFact will then display a ransom note that instructs you on how to pay the ransom and decrypt your files.

History

FunFact was first discovered by security researcher Michael Gillespie on May 11th, 2017. FunFact is a variant of Locky Ransomware. FunFact Ransomware uses the same RSA-2048 encryption algorithm as Locky Ransomware.

What types of files does FunFact Ransomware encrypt?

This ransomware will encrypt most types of files including documents, images, music, videos, and more. Any file that has the following extensions will be encrypted: .3fr, .accdb, .ai, .arw, .cdr, .cer, .cr2, .crt,.csv, .dbf, .dng,.docm,.docx,.dwg,,.dxg,.eps,.erf,.indd,.jpe,.jpg,.kdc,.mdb,.mdf,,.mef,,.mrw,.nef,.nrw,,.odb,,.odc,,.odm,,.odp,,.ods,.odt,.orf,.p12,.p7b,.p7c,.pdd,.pef,,.pem,.pfx,,.pptm,.pptx,,.PSD,.rw2,.rwl,,.sr2,,.srf,,.srw,,.wb2,.wpd,.wps,,xlk, .xlsm, .xlsxFunFact will also encrypt files on any connected drives such as USB drives or network shares.

What does FunFact Ransomware's ransom note look like?

FunFact Ransomware's ransom note is displayed as a pop-up window and contains the following text:Your personal files are encrypted!All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us the e-mail funfact2017@protonmail.comWrite this ID in the title of your message –In case of no answer within 24 hours write to funfact2017@elude.inYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.After payment, we will send you the decryption tool that will decrypt all your files.Free decryption as a guarantee.Before paying you can send us 1 file for free decryption. The total size of files must be less than 1Mb (nonarchived), and files should not contain valuable information. (databases, backups, large excel sheets, etc.).

How much is the ransom?

The ransom starts at 0.5 Bitcoin and goes up to 2 Bitcoins.

How to buy Bitcoins?

The easiest way to buy bitcoins is LocalBitcoins site. You can find there offers from many people who are willing to sell you bitcoins for cash.Also, you can find there other places to buy Bitcoins and a beginner’s guide.If you have really valuable files, we advise you not to waste time and contact your data recovery specialist. FunFact Ransomware uses the RSA-2048 encryption algorithm, which is known to be very difficult to crack. We do not recommend attempting to decrypt your files without paying the ransom, as it could result in permanent data loss.

Protection

There are several things you can do to protect yourself from FunFact and other types of ransomware.First, you should always have a backup of your important files. That way, if you get infected with FunFact or any other type of ransomware, you can simply restore your files from the backup.Second, you should install an anti-malware program like Malwarebytes Anti-Malware and scan your computer regularly. This will help to remove any malicious software that may be installed on your computer.Third, you should be very careful about the emails and attachments you open. If you receive an email from someone you don't know, or if the email looks suspicious, do not open the attachment.Fourth, you should keep your operating system and software up to date. Malware can often exploit outdated software like FunFact.Finally, you should always think twice before paying a ransom. While there are some cases where paying the ransom may be the only option, in most cases, it is not worth it. Not only will you be giving the attackers your money, but you will also be encouraging them to continue their malicious activities.

How to remove FunFact?

First, you need to boot into Safe Mode with Networking. To do this, restart your computer and press F8 repeatedly before Windows starts.Once you are in Safe Mode with Networking, you need to download an anti-malware program like Malwarebytes Anti-Malware and run a scan. This will remove FunFact ransomware from your computer.You should then restart your computer in Normal Mode and scan your computer again with Malwarebytes to remove any remaining files.Finally, you should change all your passwords and create new backups of your important files.

Is there a public decryption tool?

No, there is no public decryption tool for FunFact ransomware.

What should I do?

If attackers infected you with FunFact ransomware, try to restore your files from a backup.If you do not have a backup, you can try using a data recovery program. These programs can often recover deleted or lost files.We built SalvageData data recovery software to help you.

Contact a data recovery service

If you cannot restore your files, or if you do not want to pay the ransom, you can try contacting a data recovery service.SalvageData Recovery Services has been working with FunFact ransomware victims and can help you recover your files. Contact SalvageData experts right now to get help.