ERIS - Ransomware

The ransomware appends ".eris" to infected files and uses both Salsa20 and RSA-1024 encryption. Variants of the malware are known to be distributed in drive-by-downloads via exploit kits. Payment instructions are sent to the victim after emailing the threat actor with one encrypted file.