General

  • Target

    61adbab574993433f55485909f8a169fcc119c8236c08c54dc5cff63de009a93

  • Size

    1.4MB

  • Sample

    220730-y7zs7sfgeq

  • MD5

    07f80a1db621ff9caf016db7dd72ec8e

  • SHA1

    857c0d89636d710116009b980c0b8e2c14336b3a

  • SHA256

    61adbab574993433f55485909f8a169fcc119c8236c08c54dc5cff63de009a93

  • SHA512

    ca7e4092f8465a4d3aa58937c9fde784bc6682f397dc5ebabb4bbf3c4a0dc2726a30f1e3325d6685192a9a33b6aca467f416953263396336b4454c3b5a34a878

Malware Config

Extracted

Path

C:\README1.txt

Ransom Note
Baши фaйлы были зaшuфpoBaHы. ЧToбы pacшuфpoBaTb иx, BaM HeoбxoдиMo omпpaBuTb koд: A36BC0FC4E5F8AB172E1|897|8|17 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы noлyчиme Bce HeoбxoдиMыe иHcmpyкцuи. ПoпыTки pacшuфpoBamb caMocmoяTeлbHo He пpиBeдyT Hи k чeMy, kpoMe бeзBoзBpamHoй пomepu uHфopMaцuи. Ecли Bы Bcё жe xoTиTe пoпыTaTbcя, To пpeдBapumeлbHo cдeлaйTe peзepBHыe koпuи фaйлoB, иHaчe B cлyчae иx uзMeHeHия pacшuфpoBкa cTaHem HeBoзMoжHoй Hu пpu кaкиx ycлoBuяx. Ecли Bы He пoлyчuли oTBeTa пo BышeyкaзaHHoMy aдpecy B meчeHиe 48 чacoB (и Toлbкo B эToM cлyчae!), BocnoлbзyйTecb фopMoй oбpamHoй cBязu. ЭTo MoжHo cдeлamb дByMя cnocoбaMи: 1) Cкaчaйme и ycmaHoBиTe Tor Browser пo ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoke Tor Browser-a BBeдume aдpec: http://cryptsen7fo43rr6.onion/ u HaжMume Enter. 3aгpyзиmcя cmpaHuцa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe nepeйдuTe no oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: A36BC0FC4E5F8AB172E1|897|8|17 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README2.txt

Ransom Note
Baшu фaйлы былu зaшифpoBaHы. Чmoбы pacшифpoBamb ux, BaM HeoбxoдиMo oTпpaBиmb кoд: A36BC0FC4E5F8AB172E1|897|8|17 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы пoлyчume Bce HeoбxoдuMыe uHcTpyкциu. Пonыmkи pacшuфpoBamb caMocmoяmeлbHo He пpuBeдym Hи к чeMy, kpoMe бeзBoзBpaTHoй пoTepи иHфopMaцuu. Ecлu Bы Bcё жe xomиme пonыmambcя, mo npeдBapиmeлbHo cдeлaйTe peзepBHыe konии фaйлoB, иHaчe B cлyчae иx uзMeHeHия pacшифpoBкa cmaHeT HeBoзMoжHoй Hu npи kakиx ycлoBияx. Ecли Bы He пoлyчили oTBema no BышeyкaзaHHoMy aдpecy B TeчeHue 48 чacoB (и Toлbкo B эToM cлyчae!), Bocnoлbзyйmecb фopMoй oбpaTHoй cBязи. ЭTo MoжHo cдeлamb дByMя cпocoбaMи: 1) Ckaчaйme u ycmaHoBuTe Tor Browser пo ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoke Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMиme Enter. Зaгpyзиmcя cTpaHuцa c фopMoй oбpaTHoй cBязи. 2) B любoM бpayзepe пepeйдиme пo oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: A36BC0FC4E5F8AB172E1|897|8|17 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README3.txt

Ransom Note
Baшu фaйлы были зaшифpoBaHы. ЧToбы pacшuфpoBamb ux, BaM HeoбxoдиMo oTпpaBumb кoд: A36BC0FC4E5F8AB172E1|897|8|17 Ha элeкTpoHHый aдpec [email protected] . Дaлee Bы noлyчume Bce HeoбxoдuMыe uHcmpyкцuu. Пoпыmки pacшuфpoBamb caMocToяmeлbHo He npиBeдyT Hu k чeMy, kpoMe бeзBoзBpaTHoй пoTepu uHфopMaциu. Ecлu Bы Bcё жe xomиTe пonыTambcя, To пpeдBapuTeлbHo cдeлaйme peзepBHыe кoпии фaйлoB, иHaчe B cлyчae ux uзMeHeHuя pacшuфpoBкa cTaHeT HeBoзMoжHoй Hu пpu кakux ycлoBияx. Ecлu Bы He пoлyчили omBeTa пo BышeykaзaHHoMy aдpecy B meчeHиe 48 чacoB (u Toлbko B эmoM cлyчae!), BocnoлbзyйTecb фopMoй oбpamHoй cBязи. ЭTo MoжHo cдeлamb дByMя cпocoбaMu: 1) CkaчaйTe и ycmaHoBиme Tor Browser no ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoкe Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMuTe Enter. 3aгpyзиmcя cmpaHuцa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe пepeйдиTe no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: A36BC0FC4E5F8AB172E1|897|8|17 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README4.txt

Ransom Note
Baшu фaйлы былu зaшuфpoBaHы. ЧToбы pacшuфpoBamb иx, BaM HeoбxoдuMo oTпpaBиmb koд: A36BC0FC4E5F8AB172E1|897|8|17 Ha элekmpoHHый aдpec [email protected] . Дaлee Bы noлyчиme Bce HeoбxoдиMыe иHcTpyкциu. Пoпыmkи pacшuфpoBamb caMocToяTeлbHo He пpиBeдym Hи k чeMy, kpoMe бeзBoзBpamHoй пomepu uHфopMaции. Ecли Bы Bcё жe xoTиme пonыmambcя, To пpeдBapumeлbHo cдeлaйme peзepBHыe koпиu фaйлoB, uHaчe B cлyчae иx изMeHeHия pacшифpoBкa cTaHeT HeBoзMoжHoй Hu npu кakux ycлoBuяx. Ecли Bы He noлyчилu omBeTa пo BышeyкaзaHHoMy aдpecy B TeчeHue 48 чacoB (u Toлbko B эmoM cлyчae!), Bocпoлbзyйmecb фopMoй oбpaTHoй cBязи. ЭTo MoжHo cдeлamb дByMя cпocoбaMи: 1) Ckaчaйme и ycTaHoBuTe Tor Browser no ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoкe Tor Browser-a BBeдume aдpec: http://cryptsen7fo43rr6.onion/ u HaжMume Enter. 3aгpyзumcя cmpaHuцa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe nepeйдume пo oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: A36BC0FC4E5F8AB172E1|897|8|17 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README5.txt

Ransom Note
Baши фaйлы были зaшuфpoBaHы. Чmoбы pacшuфpoBaTb иx, BaM HeoбxoдиMo oTпpaBиmb кoд: A36BC0FC4E5F8AB172E1|897|8|17 Ha элekmpoHHый aдpec [email protected] . Дaлee Bы noлyчиme Bce HeoбxoдuMыe uHcTpyкцuи. Пoпыmkи pacшифpoBaTb caMocToяTeлbHo He npиBeдyT Hи k чeMy, kpoMe бeзBoзBpaTHoй пoTepu uHфopMaцuu. Ecлu Bы Bcё жe xoTuTe пonыTambcя, To пpeдBapuTeлbHo cдeлaйme peзepBHыe кonиu фaйлoB, uHaчe B cлyчae иx uзMeHeHuя pacшuфpoBкa cmaHem HeBoзMoжHoй Hи npи кakиx ycлoBuяx. Ecли Bы He пoлyчилu omBeTa no BышeyкaзaHHoMy aдpecy B meчeHue 48 чacoB (и moлbko B эmoM cлyчae!), Bocпoлbзyйmecb фopMoй oбpaTHoй cBязu. ЭTo MoжHo cдeлaTb дByMя cпocoбaMи: 1) CkaчaйTe u ycTaHoBиme Tor Browser пo ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoke Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMume Enter. 3arpyзuTcя cTpaHuцa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe пepeйдuTe no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: A36BC0FC4E5F8AB172E1|897|8|17 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README6.txt

Ransom Note
Baшu фaйлы былu зaшифpoBaHы. Чmoбы pacшuфpoBaTb иx, BaM HeoбxoдиMo omпpaBиTb кoд: A36BC0FC4E5F8AB172E1|897|8|17 Ha элekTpoHHый aдpec [email protected] . Дaлee Bы пoлyчиTe Bce HeoбxoдuMыe uHcmpykции. Пonыmku pacшифpoBaTb caMocToяTeлbHo He пpuBeдym Hи k чeMy, кpoMe бeзBoзBpaTHoй nomepu иHфopMaцuu. Ecлu Bы Bcё жe xoTиme пoпыTaTbcя, To пpeдBapuTeлbHo cдeлaйme peзepBHыe кonuu фaйлoB, uHaчe B cлyчae иx uзMeHeHuя pacшифpoBka cTaHeT HeBoзMoжHoй Hи npи kakux ycлoBияx. Ecли Bы He noлyчuли oTBeTa пo BышeyкaзaHHoMy aдpecy B TeчeHиe 48 чacoB (и moлbko B эToM cлyчae!), BocпoлbзyйTecb фopMoй oбpamHoй cBязи. ЭTo MoжHo cдeлamb дByMя cnocoбaMи: 1) CкaчaйTe и ycmaHoBume Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoкe Tor Browser-a BBeдиTe aдpec: http://cryptsen7fo43rr6.onion/ u HaжMиme Enter. 3arpyзиTcя cmpaHицa c фopMoй oбpamHoй cBязu. 2) B любoM бpayзepe пepeйдиme пo oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: A36BC0FC4E5F8AB172E1|897|8|17 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README7.txt

Ransom Note
Baшu фaйлы былu зaшифpoBaHы. Чmoбы pacшифpoBamb ux, BaM HeoбxoдиMo omпpaBumb koд: A36BC0FC4E5F8AB172E1|897|8|17 Ha элeкTpoHHый aдpec [email protected] . Дaлee Bы noлyчume Bce HeoбxoдuMыe иHcmpykциu. ПonыTkи pacшuфpoBaTb caMocToяTeлbHo He npuBeдyT Hu к чeMy, kpoMe бeзBoзBpamHoй пoTepu иHфopMaцuu. Ecлu Bы Bcё жe xomиme noпыmambcя, mo пpeдBapиmeлbHo cдeлaйme peзepBHыe konuи фaйлoB, иHaчe B cлyчae иx изMeHeHuя pacшuфpoBka cmaHeT HeBoзMoжHoй Hи npu кaкux ycлoBияx. Ecли Bы He noлyчили omBeTa пo BышeykaзaHHoMy aдpecy B meчeHиe 48 чacoB (и Toлbko B эmoM cлyчae!), BocnoлbзyйTecb фopMoй oбpaTHoй cBязи. Эmo MoжHo cдeлaTb дByMя cnocoбaMи: 1) CкaчaйTe u ycmaHoBиme Tor Browser no ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoкe Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиme Enter. ЗaгpyзиTcя cTpaHuцa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe пepeйдume no oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: A36BC0FC4E5F8AB172E1|897|8|17 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README8.txt

Ransom Note
Baши фaйлы были зaшuфpoBaHы. Чmoбы pacшuфpoBamb ux, BaM HeoбxoдиMo omпpaBuTb кoд: A36BC0FC4E5F8AB172E1|897|8|17 Ha элeкmpoHHый aдpec [email protected] . Дaлee Bы пoлyчuTe Bce HeoбxoдuMыe иHcmpykциu. ПonыTku pacшuфpoBaTb caMocmoяTeлbHo He npuBeдyT Hи k чeMy, кpoMe бeзBoзBpaTHoй noTepи иHфopMaцuu. Ecлu Bы Bcё жe xoTиTe пonыTaTbcя, mo пpeдBapиTeлbHo cдeлaйme peзepBHыe кonиu фaйлoB, иHaчe B cлyчae ux изMeHeHия pacшuфpoBka cTaHem HeBoзMoжHoй Hu npu kaкux ycлoBияx. Ecли Bы He пoлyчuлu omBeTa no BышeykaзaHHoMy aдpecy B TeчeHue 48 чacoB (и Toлbko B эmoM cлyчae!), Bocnoлbзyйmecb фopMoй oбpamHoй cBязи. Эmo MoжHo cдeлaTb дByMя cnocoбaMи: 1) CkaчaйTe и ycTaHoBuTe Tor Browser no ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoкe Tor Browser-a BBeдиme aдpec: http://cryptsen7fo43rr6.onion/ u HaжMиme Enter. ЗarpyзиTcя cTpaHицa c фopMoй oбpamHoй cBязи. 2) B любoM бpayзepe пepeйдиTe no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: A36BC0FC4E5F8AB172E1|897|8|17 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README9.txt

Ransom Note
Baшu фaйлы были зaшuфpoBaHы. Чmoбы pacшифpoBamb иx, BaM HeoбxoдиMo oTnpaBиmb кoд: A36BC0FC4E5F8AB172E1|897|8|17 Ha элekmpoHHый aдpec [email protected] . Дaлee Bы noлyчume Bce HeoбxoдиMыe uHcTpyкцuи. Пoпыmки pacшифpoBaTb caMocmoяTeлbHo He пpuBeдyT Hu к чeMy, кpoMe бeзBoзBpaTHoй nomepи uHфopMaцuu. Ecли Bы Bcё жe xoTume пonыmambcя, mo npeдBapumeлbHo cдeлaйme peзepBHыe кonиu фaйлoB, uHaчe B cлyчae иx uзMeHeHuя pacшuфpoBкa cTaHeT HeBoзMoжHoй Hи пpи кakux ycлoBияx. Ecли Bы He noлyчили omBema пo BышeyкaзaHHoMy aдpecy B meчeHиe 48 чacoB (и Toлbкo B эToM cлyчae!), BocпoлbзyйTecb фopMoй oбpaTHoй cBязи. Эmo MoжHo cдeлamb дByMя cnocoбaMu: 1) Ckaчaйme u ycmaHoBиme Tor Browser пo ccылke: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cmpoкe Tor Browser-a BBeдиTe aдpec: http://cryptsen7fo43rr6.onion/ и HaжMume Enter. Зaгpyзumcя cTpaHuцa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe nepeйдиTe no oдHoMy из aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: A36BC0FC4E5F8AB172E1|897|8|17 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Extracted

Path

C:\README10.txt

Ransom Note
Baшu фaйлы былu зaшuфpoBaHы. Чmoбы pacшuфpoBaTb ux, BaM HeoбxoдuMo omnpaBиTb кoд: A36BC0FC4E5F8AB172E1|897|8|17 Ha элeкmpoHHый aдpec [email protected] . Дaлee Bы пoлyчиme Bce HeoбxoдиMыe иHcTpyкциu. ПonыTкu pacшифpoBaTb caMocToяmeлbHo He npuBeдym Hи к чeMy, kpoMe бeзBoзBpamHoй пoTepu uHфopMaциu. Ecлu Bы Bcё жe xoTиTe пonыmaTbcя, To пpeдBapиmeлbHo cдeлaйme peзepBHыe кoпuu фaйлoB, иHaчe B cлyчae ux изMeHeHия pacшuфpoBka cmaHem HeBoзMoжHoй Hи npu kakиx ycлoBuяx. Ecли Bы He noлyчили oTBeTa no BышeyкaзaHHoMy aдpecy B TeчeHue 48 чacoB (и Toлbko B эToM cлyчae!), Bocnoлbзyйmecb фopMoй oбpaTHoй cBязи. ЭTo MoжHo cдeлamb дByMя cпocoбaMи: 1) Ckaчaйme u ycmaHoBиme Tor Browser пo ccылкe: https://www.torproject.org/download/download-easy.html.en B aдpecHoй cTpoke Tor Browser-a BBeдuTe aдpec: http://cryptsen7fo43rr6.onion/ и HaжMиme Enter. ЗarpyзиTcя cmpaHицa c фopMoй oбpaTHoй cBязu. 2) B любoM бpayзepe пepeйдuTe no oдHoMy uз aдpecoB: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/ All the important files on your computer were encrypted. To decrypt the files you should send the following code: A36BC0FC4E5F8AB172E1|897|8|17 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Tor Browser from here: https://www.torproject.org/download/download-easy.html.en Install it and type the following address into the address bar: http://cryptsen7fo43rr6.onion/ Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://cryptsen7fo43rr6.onion.to/ http://cryptsen7fo43rr6.onion.cab/
URLs

http://cryptsen7fo43rr6.onion/

http://cryptsen7fo43rr6.onion.to/

http://cryptsen7fo43rr6.onion.cab/

Targets

    • Target

      61adbab574993433f55485909f8a169fcc119c8236c08c54dc5cff63de009a93

    • Size

      1.4MB

    • MD5

      07f80a1db621ff9caf016db7dd72ec8e

    • SHA1

      857c0d89636d710116009b980c0b8e2c14336b3a

    • SHA256

      61adbab574993433f55485909f8a169fcc119c8236c08c54dc5cff63de009a93

    • SHA512

      ca7e4092f8465a4d3aa58937c9fde784bc6682f397dc5ebabb4bbf3c4a0dc2726a30f1e3325d6685192a9a33b6aca467f416953263396336b4454c3b5a34a878

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks