All of your files are encrypted!
Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===---
We strongly encourage You to pay your attention to this message and read it to the end.
All Your files are encrypted, and currently unavailable, now all files on your system has extension {EXT}
Before that, all of your most important personal and business
files were backed up to our secure offline storage.
We took them for temporary storage - but we don't need your
files and we are not personally interested in your business.
Our encryption algorithm is the most technically difficult and max resistant to burglary.
Only OUR specialists can decrypted your files without loss(!)
Any attempts to decrypt files on your own lead to damage them beyond repair(!)
Best way to you will be consent to negotiations and mutual agreement between us.
To connect us you need to download TOR browser and follow the link to begin
negotiations.(You can find full instructions below.)
We are waiting You and ready to listen all
your offers and discuss them.
If You will ignore this letter - we will have to sell
closed auction all yours private files, photoes, business correspondence,
documents and business files + with our analysis of your work
activity (weakness of your business, financial violations and the opportunity
to profit from this information). It will offset our financial losses.
Or we'll just put all your files in the public domain, where everyone can download
and use them as they wish.
* For TOR Browser
http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/
We are known as "Sodinokibi (REvil) Ransomware". For example, this article:
https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread
You have a guarantee that your files will be returned 100 %.
And remember, this is only business, nothing personal..
We have a concept of business honor, and we can promise something if we come to a mutual agreement:
1. We guarantee to decrypt all your files in the shortest possible time
2. We will delete all your files and forget about your company.
3. We will show your weaknesses in your networks.
.-= INSTRUCTIONS TO CONNECT =-.
How to get access on website?
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/{UID}
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
{KEY}
----------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself,
DONT use any third party software for restoring your data or antivirus solutions -
its may entail damge of the private key and, as result, The Loss all your data!
sub
7960
svc
mepocs
memtas
veeam
sophos
sql
backup
vss
svc$
Extracted
Path
C:\5kr68he-readme.txt
Ransom Note
---=== Welcome. Again. ===---
We strongly encourage You to pay your attention to this message and read it to the end.
All Your files are encrypted, and currently unavailable, now all files on your system has extension 5kr68he
Before that, all of your most important personal and business
files were backed up to our secure offline storage.
We took them for temporary storage - but we don't need your
files and we are not personally interested in your business.
Our encryption algorithm is the most technically difficult and max resistant to burglary.
Only OUR specialists can decrypted your files without loss(!)
Any attempts to decrypt files on your own lead to damage them beyond repair(!)
Best way to you will be consent to negotiations and mutual agreement between us.
To connect us you need to download TOR browser and follow the link to begin
negotiations.(You can find full instructions below.)
We are waiting You and ready to listen all
your offers and discuss them.
If You will ignore this letter - we will have to sell
closed auction all yours private files, photoes, business correspondence,
documents and business files + with our analysis of your work
activity (weakness of your business, financial violations and the opportunity
to profit from this information). It will offset our financial losses.
Or we'll just put all your files in the public domain, where everyone can download
and use them as they wish.
* For TOR Browser
http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/
We are known as "Sodinokibi (REvil) Ransomware". For example, this article:
https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread
You have a guarantee that your files will be returned 100 %.
And remember, this is only business, nothing personal..
We have a concept of business honor, and we can promise something if we come to a mutual agreement:
1. We guarantee to decrypt all your files in the shortest possible time
2. We will delete all your files and forget about your company.
3. We will show your weaknesses in your networks.
.-= INSTRUCTIONS TO CONNECT =-.
How to get access on website?
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1C7D05152BD92BC9
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/1C7D05152BD92BC9
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
hbytM4StDOgwRwKlwZTS61gJtDk+RZxO/cqD8MFkECcd0m3T1z3W0qzCFy5ay4N0
mYmI7tblFr4YpzYCIqmXCnOqn16CmFobIF0MZuATW6oYJ3sHMLJC2iQeDSQgbVh1
yLV1CoMDN0yJ21t5Xai1itBc1Tf10aJKztwwzBIA7s45iKDbM1mpKNEgh8gT/cU+
/0XqYP8HAU9ERRYIPXSgbfmDLsQxl+ofh3rHPyIzUBNULgfji976Y6/fk2I8Zjcl
CZota2b8DUlYxa1OQ3foGD+/2Q5K6/qAhLMtCTcBRrq8XZq3ObOXjwqyOoAZn3l9
N4YOzi1iga3J0W3l18ZtyVEUc9T9uDYdXlp+rw5xzm3NYNVwu3Fo3wmprXzU6TEI
1kh9L2FK370U6lpY6LO3xBoEUgEM1HEsAnIe4Mj9huC321tHrI+ytq838LjuJtph
IU/QLUMp8URd814K0iUoO1fHEKwxlG5mIqkQzZO2y9UaLJJOwVPDxA5NOwN711Wy
HQpwjgQ3C7VEShgX/pFCzR4hGHfPFsv5r1nrlY0dahfy6O/qPP4YkDOWVZOhJoza
U813XAma4Uc+VsoRaRDJky/czHJZrZhx1cNcYoaxmc3OGofC//C4faGElss64GGn
3kutq6QlxkQFtrjosvv4+m4lYBWf7tmzRpA/CbriLmmVE3eVwx491TY5J1NdIGCH
kpNrf5QvAYwaX/RpKSCFFFHzrDxiyx51W+RI9/w9JC6ngxZzXjHT7nPTybUai5hC
UFdG3Q1ga+BCYckc9cbY36dd3inlCFyz9PVSCNnAh3XU7FuIUMK6eh722VT/LkMP
8prYfI5wWLZhVYRVhVhKLU8BNVYgSfUtifKGJed89iatIizWN00ss0e+fGnhTQQu
McKUPguiuP7pSVmh6qdp+qF0qtSF3TSxqxIfHZr7jTmeghMn6IT17cZZIOwX3/vZ
cWGgwOmTeeB7FQMUAV8yp4PFOkpi4JBvPnpTz3U6nroi7cdNRFPVW0NdXSuNaxpV
dd772CPdE85yn335Pzexkk9HaPiaKkZSafgXXzGfSx4YWmD3y8zjWm3PZv6Milx6
b0XDCRk+Li6h1bsOiMHn3bMkVMw/e6bdM8k0TJx72EDapAyMz32F3WR8tLzfJxSn
NBDiKKRtRtuyRzBVfGY1fONRZvhf1LKCXgYmIEhXGiSnAwc4qYPDGL1IQbOQX5I/
heeAiyI+1SNirc9bruf077ICfNVTuYkG2QbXX7pqt4uRVGZdKq5pbW+7oMPZZewn
6GOghA+GQno=
----------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself,
DONT use any third party software for restoring your data or antivirus solutions -
its may entail damge of the private key and, as result, The Loss all your data!
