06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe

General
Target

06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851.exe

Filesize

N/A

Completed

16-12-2019 10:57

Score
10 /10
MD5

N/A

SHA1

N/A

SHA256

06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851

Malware Config

Extracted

Path C:\05vb6je9-readme.txt
Family sodinokibi
Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 05vb6je9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/566484711914F5F1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/566484711914F5F1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: rxaK53ALfFGy4622EI7nauMFpFvcU1PxDem3WfU4QyAJmXwkVspAsecIliVlENVp ifrBlPOSfnI1YRS3ax8jcweiLJrpA4g5HCKC+hyd2P485bMkPzI0O+AcQl8lbJda NNO8Xdh5XCZ/Dd/w6r7CHOgs13AD2YmxTn/dCR5huuXX7msfVT9nHqZg0HH4faS7 XSyPg+IQXQsci5jfAOLTvx4OZ3rdQWYC/sEvJM2dxW7Y1eQozPQfU22fw2CrBf+i K20DunLT+L8SH82Wa4r/SMb7R/b10ha/zoEIu3I0jn9oEc9Jp+VrXn4B7rpuGkOU 8QzXUMZhrhgydgkxGFSNGCTcGmgKYio+2Qhc5zEpfzD3X3aMR0wKIlxwVpHjhMCQ kkEcQM2Etri2wz03mKU0gI+TGpo12E0Rvv4xT/VjK6nBMgNfD+GM6zTYfjMqTSxy cJfu7aW1ctfR2e5VFDppYqHKc98K/LHHIi834pSjEBpAT63HiWLBw3Yc/AtPm2Pb FYPrOIKxvEauTwVfnIFo/hXB/Hmm9Wh8tK/trgQ9entkLyA4a5+T5Wn8n3zWndQI mUTD2pXx4VOG7WfKDZhmEBhuQRnc+Ekh6xTYkCekYn2HGCN/Dvf2uiRdXfX/m2Er jzjcwj9ZRYFBeWDXc3R2b+8P0bqRpjuB2jsgbkC6WfrRVwLlJ7sUtUnuqnpbghl4 Zn6Cv6T0y55vm1HDhBKOcISF8H4oA9XYnFYH8ZxOqt9rKy4q+8Rq5a+Lubbq1aJ8 F6NEjxl2yoL5cp1vXT3+5NEQOoydzweabnZ65PwNFHXw7jRw6jCByoMkh2wgavAN uff56lUgaCvLoR6bzKcLRLcQMs3TfPTZxkY6SXSRL7G9Xtt2gmInVoAiD3XOVIkY +CXOdZQbDlCvmpEu7gqRHX4gpUQrEVMJzGChTXxxz7HAAKK1R7Ol5ajUiaUMUIL6 WIbmmIYP6uwM2Eb1JX18y7mgdJwoCWT0I5Loq6XzgF8PBNpjS76dpZI20CBOXLVg dv15ir6+UvG/39aItCb0BEDQ+UpaTIboQqecYe9oo6OYoTbezd5/gtEMLWHsf/xG Fw6x63qzop68tsJrPO7xgeZL2I89XvAK+FuRkBo9QlXpDniEvcPceVh8qw6BSg+Y zsscBy8PDwWG+NAm Extension name: 05vb6je9 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/566484711914F5F1

http://decryptor.top/566484711914F5F1

Signatures

Filter: None

    Processes
    Network
    Replay Monitor
    00:00 00:00
    Downloads
    • memory/1440-0-0x000000000090B000-0x000000000092D000-memory.dmp