Description
Ransomware distributed via existing botnets, often Trickbot or Emotet.
f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703.bin.sample
170KB
211020-kyf3vahgdj
1bd7d1b87c5091a9653fe8005892b784
3dcf19b833266a3591fd97c93e5b9bca4ac2c21c
f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703
4c13373a150b1e3bd12fdd9ad5c379a43e41c59ba5b6dd6982c79599839128bcbde30d7083a810d66604382f4d5aff24c22b504fdaab03f6743a7dc263d85651
Path | C:\RyukReadMe.txt |
Family | ryuk |
Ransom Note |
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation
No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
To get info (decrypt your files) contact us at
WayneEvenson@protonmail.com
or
WayneEvenson@tutanota.com
BTC wallet:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Ryuk
No system is safe
|
Emails |
WayneEvenson@protonmail.com WayneEvenson@tutanota.com |
Wallets |
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk |
f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703.bin.sample
1bd7d1b87c5091a9653fe8005892b784
170KB
3dcf19b833266a3591fd97c93e5b9bca4ac2c21c
f130530949c0e3adca48ba558980b634c0a78c8faa5572718b665cc7abfd7703
4c13373a150b1e3bd12fdd9ad5c379a43e41c59ba5b6dd6982c79599839128bcbde30d7083a810d66604382f4d5aff24c22b504fdaab03f6743a7dc263d85651
Ransomware distributed via existing botnets, often Trickbot or Emotet.
Ransomware often targets backup files to inhibit system recovery.
Infostealers often target stored browser data, which can include saved credentials etc.
Attempts to read the root path of hard drives other than the default C: drive.