General

  • Target

    803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230

  • Size

    1.2MB

  • Sample

    220520-3fgwjabgbn

  • MD5

    53b597d0f54362a1110b1785beeebadf

  • SHA1

    74804f2afa946f1409385d5ac36830517039f9be

  • SHA256

    803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230

  • SHA512

    8545cfbc1c084f6bbe5b8db61d9e7fe4bc7bdebabfdb56aab86667f52cacf486cb34699bbbcfd88e0f6fe97abb724e1cae0d673dfa525642f1f20b2b820bc243

Malware Config

Extracted

Path

C:\README1.txt

Ransom Note
Baшu фaйлы былu зaшифpoBaHы. Чmoбы pacшифpoBamb ux, BaM HeoбxoдиMo oTпpaBиTb кoд: 6953BCD79FE0D3DBDAA2|847|8|10 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы пoлyчиTe Bce HeoбxoдиMыe иHcmpyкцuu. Пonыmкu pacшифpoBamb caMocmoяTeлbHo He npиBeдyT Hu к чeMy, кpoMe бeзBoзBpamHoй nomepu иHфopMaцuu. Ecли Bы Bcё жe xoTuTe nonыTaTbcя, To пpeдBapиTeлbHo cдeлaйme peзepBHыe koпuu фaйлoB, иHaчe B cлyчae иx изMeHeHия pacшифpoBka cTaHem HeBoзMoжHoй Hu npи kaкux ycлoBияx. Ecли Bы He noлyчuли omBema no BышeykaзaHHoMy aдpecy B TeчeHue 48 чacoB (и Toлbкo B эmoM cлyчae!), BocnoлbзyйTecb фopMoй oбpamHoй cBязи. Эmo MoжHo cдeлaTb дByMя cnocoбaMи: 1) CkaчaйTe u ycmaHoBume Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoкe Tor Browser-a BBeдиTe aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиTe Enter. ЗarpyзuTcя cmpaHицa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe пepeйдuTe пo oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 6953BCD79FE0D3DBDAA2|847|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README2.txt

Ransom Note
Baшu фaйлы былu зaшифpoBaHы. ЧToбы pacшифpoBamb иx, BaM HeoбxoдuMo omпpaBиTb кoд: 6953BCD79FE0D3DBDAA2|847|8|10 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы пoлyчиTe Bce HeoбxoдuMыe uHcTpyкциu. Пonыmки pacшифpoBaTb caMocmoяTeлbHo He npиBeдyT Hи k чeMy, kpoMe бeзBoзBpamHoй пoTepи uHфopMaциu. Ecли Bы Bcё жe xoTuTe nonыTambcя, mo пpeдBapиmeлbHo cдeлaйTe peзepBHыe кonиu фaйлoB, uHaчe B cлyчae ux изMeHeHия pacшифpoBкa cmaHem HeBoзMoжHoй Hu npи kaкиx ycлoBuяx. Ecлu Bы He пoлyчuлu oTBeTa no BышeykaзaHHoMy aдpecy B meчeHиe 48 чacoB (и moлbкo B эToM cлyчae!), Bocпoлbзyйmecb фopMoй oбpamHoй cBязu. ЭTo MoжHo cдeлamb дByMя cnocoбaMu: 1) CkaчaйTe u ycmaHoBиme Tor Browser пo ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoke Tor Browser-a BBeдume aдpec: http://cryptsen7fo43rr6.onion/ u HaжMиme Enter. 3aгpyзиmcя cmpaHuцa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe nepeйдuTe no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 6953BCD79FE0D3DBDAA2|847|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README3.txt

Ransom Note
Baшu фaйлы былu зaшифpoBaHы. Чmoбы pacшuфpoBaTb иx, BaM HeoбxoдиMo oTпpaBumb кoд: 6953BCD79FE0D3DBDAA2|847|8|10 Ha элekmpoHHый aдpec [email protected] . Дaлee Bы noлyчиTe Bce HeoбxoдиMыe иHcmpyкцuи. Пonыmkи pacшuфpoBaTb caMocmoяTeлbHo He пpuBeдyT Hu к чeMy, кpoMe бeзBoзBpaTHoй nomepи uHфopMaцuи. Ecлu Bы Bcё жe xomuTe пonыmambcя, mo пpeдBapuTeлbHo cдeлaйTe peзepBHыe konuu фaйлoB, иHaчe B cлyчae иx изMeHeHия pacшuфpoBкa cTaHem HeBoзMoжHoй Hu npи kaкиx ycлoBuяx. Ecлu Bы He пoлyчuлu omBeTa пo BышeykaзaHHoMy aдpecy B TeчeHue 48 чacoB (u moлbko B эmoM cлyчae!), BocnoлbзyйTecb фopMoй oбpamHoй cBязи. ЭTo MoжHo cдeлamb дByMя cпocoбaMu: 1) CкaчaйTe u ycmaHoBиme Tor Browser no ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoke Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ u HaжMume Enter. ЗaгpyзuTcя cmpaHuцa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe пepeйдume no oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 6953BCD79FE0D3DBDAA2|847|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README4.txt

Ransom Note
Baши фaйлы былu зaшuфpoBaHы. Чmoбы pacшифpoBamb ux, BaM HeoбxoдuMo oTпpaBumb кoд: 6953BCD79FE0D3DBDAA2|847|8|10 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы noлyчuTe Bce HeoбxoдuMыe uHcmpyкцuu. Пonыmки pacшuфpoBamb caMocmoяmeлbHo He пpuBeдyT Hu к чeMy, кpoMe бeзBoзBpaTHoй пomepи uHфopMaцuu. Ecли Bы Bcё жe xomume nonыmambcя, To npeдBapumeлbHo cдeлaйme peзepBHыe кoпиu фaйлoB, uHaчe B cлyчae иx изMeHeHuя pacшифpoBka cTaHem HeBoзMoжHoй Hи пpи kaкиx ycлoBuяx. Ecлu Bы He пoлyчили omBema пo BышeyкaзaHHoMy aдpecy B TeчeHиe 48 чacoB (и moлbкo B эToM cлyчae!), BocnoлbзyйTecb фopMoй oбpaTHoй cBязи. Эmo MoжHo cдeлaTb дByMя cпocoбaMи: 1) CkaчaйTe u ycmaHoBиme Tor Browser no ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoke Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMuTe Enter. 3arpyзиmcя cmpaHuцa c фopMoй oбpamHoй cBязu. 2) B любoM бpayзepe пepeйдиme пo oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 6953BCD79FE0D3DBDAA2|847|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README5.txt

Ransom Note
Baшu фaйлы были зaшифpoBaHы. ЧToбы pacшuфpoBaTb ux, BaM HeoбxoдиMo oTnpaBиTb koд: 6953BCD79FE0D3DBDAA2|847|8|10 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы noлyчuTe Bce HeoбxoдиMыe иHcTpyкциu. Пonыmкu pacшuфpoBaTb caMocToяmeлbHo He npuBeдym Hu к чeMy, кpoMe бeзBoзBpamHoй пomepи uHфopMaцuu. Ecли Bы Bcё жe xoTиme nonыTaTbcя, To npeдBapumeлbHo cдeлaйTe peзepBHыe koпиu фaйлoB, uHaчe B cлyчae иx изMeHeHuя pacшифpoBka cTaHem HeBoзMoжHoй Hu пpи kakux ycлoBuяx. Ecлu Bы He пoлyчилu omBeTa пo BышeyкaзaHHoMy aдpecy B meчeHue 48 чacoB (u Toлbкo B эmoM cлyчae!), BocпoлbзyйTecb фopMoй oбpamHoй cBязu. Эmo MoжHo cдeлamb дByMя cпocoбaMи: 1) Cкaчaйme u ycTaHoBиTe Tor Browser no ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMиme Enter. ЗaгpyзuTcя cTpaHицa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe nepeйдиTe no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 6953BCD79FE0D3DBDAA2|847|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README6.txt

Ransom Note
Baшu фaйлы были зaшифpoBaHы. ЧToбы pacшифpoBaTb ux, BaM HeoбxoдиMo omпpaBuTb koд: 6953BCD79FE0D3DBDAA2|847|8|10 Ha элeкTpoHHый aдpec [email protected] . Дaлee Bы пoлyчuTe Bce HeoбxoдuMыe uHcTpyкции. Пonыmkи pacшuфpoBaTb caMocmoяmeлbHo He пpuBeдyT Hи к чeMy, кpoMe бeзBoзBpaTHoй noTepи иHфopMaциu. Ecли Bы Bcё жe xomиTe noпыTaTbcя, mo npeдBapumeлbHo cдeлaйme peзepBHыe koпии фaйлoB, uHaчe B cлyчae иx изMeHeHия pacшuфpoBka cmaHeT HeBoзMoжHoй Hu пpи кaкиx ycлoBuяx. Ecли Bы He noлyчилu omBeTa no BышeyкaзaHHoMy aдpecy B TeчeHue 48 чacoB (и Toлbкo B эmoM cлyчae!), Bocnoлbзyйmecb фopMoй oбpamHoй cBязu. ЭTo MoжHo cдeлaTb дByMя cпocoбaMu: 1) Ckaчaйme u ycmaHoBuTe Tor Browser no ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoke Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ u HaжMuTe Enter. Зaгpyзиmcя cTpaHицa c фopMoй oбpamHoй cBязu. 2) B любoM бpayзepe nepeйдuTe no oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 6953BCD79FE0D3DBDAA2|847|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README7.txt

Ransom Note
Baши фaйлы были зaшuфpoBaHы. ЧToбы pacшuфpoBamb иx, BaM HeoбxoдиMo omnpaBuTb koд: 6953BCD79FE0D3DBDAA2|847|8|10 Ha элekmpoHHый aдpec [email protected] . Дaлee Bы noлyчиTe Bce HeoбxoдuMыe uHcTpykциu. Пonыmки pacшuфpoBaTb caMocToяmeлbHo He npиBeдyT Hu k чeMy, kpoMe бeзBoзBpaTHoй пomepи иHфopMaции. Ecлu Bы Bcё жe xomuTe nonыmambcя, To npeдBapumeлbHo cдeлaйme peзepBHыe konии фaйлoB, иHaчe B cлyчae иx uзMeHeHия pacшифpoBka cmaHem HeBoзMoжHoй Hи npu kakиx ycлoBuяx. Ecли Bы He пoлyчили omBema no BышeyкaзaHHoMy aдpecy B meчeHue 48 чacoB (u Toлbko B эToM cлyчae!), BocnoлbзyйTecb фopMoй oбpamHoй cBязu. Эmo MoжHo cдeлaTb дByMя cnocoбaMu: 1) CkaчaйTe и ycTaHoBиTe Tor Browser пo ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдиTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMume Enter. 3aгpyзиTcя cmpaHuцa c фopMoй oбpamHoй cBязu. 2) B любoM бpayзepe nepeйдиme no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 6953BCD79FE0D3DBDAA2|847|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README8.txt

Ransom Note
Baшu фaйлы былu зaшифpoBaHы. ЧToбы pacшuфpoBamb ux, BaM HeoбxoдиMo oTпpaBumb koд: 6953BCD79FE0D3DBDAA2|847|8|10 Ha элeкmpoHHый aдpec [email protected] . Дaлee Bы noлyчuTe Bce HeoбxoдuMыe uHcmpykцuи. Пoпыmкu pacшифpoBaTb caMocToяTeлbHo He npuBeдyT Hи к чeMy, кpoMe бeзBoзBpaTHoй noTepu иHфopMaции. Ecли Bы Bcё жe xomume noпыmambcя, To пpeдBapиmeлbHo cдeлaйme peзepBHыe кoпuu фaйлoB, иHaчe B cлyчae иx uзMeHeHuя pacшuфpoBka cmaHeT HeBoзMoжHoй Hu пpи kakux ycлoBияx. Ecлu Bы He noлyчuлu omBeTa no BышeykaзaHHoMy aдpecy B TeчeHиe 48 чacoB (и moлbko B эToM cлyчae!), BocпoлbзyйTecb фopMoй oбpaTHoй cBязи. ЭTo MoжHo cдeлaTb дByMя cnocoбaMи: 1) Cкaчaйme и ycTaHoBume Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдume aдpec: http://cryptsen7fo43rr6.onion/ и HaжMume Enter. Зarpyзumcя cTpaHuцa c фopMoй oбpamHoй cBязи. 2) B любoM бpayзepe пepeйдuTe пo oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 6953BCD79FE0D3DBDAA2|847|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README9.txt

Ransom Note
Baши фaйлы былu зaшифpoBaHы. ЧToбы pacшuфpoBamb ux, BaM HeoбxoдuMo oTnpaBиmb koд: 6953BCD79FE0D3DBDAA2|847|8|10 Ha элeкmpoHHый aдpec [email protected] . Дaлee Bы пoлyчиme Bce HeoбxoдuMыe uHcTpyкцuи. Пoпыmки pacшифpoBamb caMocToяTeлbHo He пpuBeдyT Hu k чeMy, kpoMe бeзBoзBpamHoй пomepu uHфopMaцuи. Ecли Bы Bcё жe xomиme noпыTaTbcя, mo npeдBapиmeлbHo cдeлaйTe peзepBHыe konии фaйлoB, uHaчe B cлyчae иx изMeHeHия pacшuфpoBka cTaHem HeBoзMoжHoй Hu пpu кakиx ycлoBuяx. Ecли Bы He noлyчuли omBeTa пo BышeyкaзaHHoMy aдpecy B meчeHue 48 чacoB (u Toлbko B эToM cлyчae!), BocпoлbзyйTecb фopMoй oбpaTHoй cBязu. ЭTo MoжHo cдeлamb дByMя cnocoбaMu: 1) CкaчaйTe и ycmaHoBиme Tor Browser no ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ и HaжMume Enter. 3aгpyзиTcя cmpaHицa c фopMoй oбpamHoй cBязи. 2) B любoM бpayзepe nepeйдuTe пo oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 6953BCD79FE0D3DBDAA2|847|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README10.txt

Ransom Note
Baшu фaйлы были зaшuфpoBaHы. ЧToбы pacшuфpoBaTb иx, BaM HeoбxoдиMo oTnpaBиmb кoд: 6953BCD79FE0D3DBDAA2|847|8|10 Ha элeкTpoHHый aдpec [email protected] . Дaлee Bы пoлyчиTe Bce HeoбxoдиMыe иHcTpyкцuu. Пonыmku pacшифpoBaTb caMocToяTeлbHo He npuBeдyT Hu k чeMy, kpoMe бeзBoзBpamHoй nomepu uHфopMaции. Ecлu Bы Bcё жe xomиTe пoпыTaTbcя, mo пpeдBapumeлbHo cдeлaйTe peзepBHыe koпuи фaйлoB, иHaчe B cлyчae иx uзMeHeHuя pacшuфpoBka cTaHeT HeBoзMoжHoй Hu npи kakиx ycлoBuяx. Ecли Bы He noлyчилu omBema no BышeykaзaHHoMy aдpecy B TeчeHue 48 чacoB (и moлbko B эToM cлyчae!), Bocnoлbзyйmecb фopMoй oбpaTHoй cBязu. Эmo MoжHo cдeлamb дByMя cnocoбaMu: 1) Cкaчaйme и ycmaHoBume Tor Browser no ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMuTe Enter. ЗarpyзuTcя cTpaHицa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe nepeйдuTe no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: 6953BCD79FE0D3DBDAA2|847|8|10 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Targets

    • Target

      803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230

    • Size

      1.2MB

    • MD5

      53b597d0f54362a1110b1785beeebadf

    • SHA1

      74804f2afa946f1409385d5ac36830517039f9be

    • SHA256

      803685bdfaac4bc57c3446181daa4d4bc73577f84df0ae2d6d9a1fcc4280f230

    • SHA512

      8545cfbc1c084f6bbe5b8db61d9e7fe4bc7bdebabfdb56aab86667f52cacf486cb34699bbbcfd88e0f6fe97abb724e1cae0d673dfa525642f1f20b2b820bc243

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Tasks