Overview

overview

10

Static

static

10

HELP_DECRYPT.html

windows7-x64

1

HELP_DECRYPT.html

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    HELP_DECRYPT.HTML

  • Size

    8KB

  • MD5

    e3c712d002a9d1683273ac63d11e28c1

  • SHA1

    a5d1c7ea301825070c7f3d8d214f5e92847837ca

  • SHA256

    eb9981b26950553c20a4ac327109012dcf66c2873d17331b698e447db9e82a81

  • SHA512

    d1244852addb5e8a841cd32192a4ab8fb978e3c32195a7c9f238e3dea40d38f9486bccc8459c680c23c9c749dd336674d12e2b86cedf9c9309709f6e233d2fb3

  • SSDEEP

    96:npya0MpaQ9Y2aqajsyOQiOaqacEvhcSr4aqawbK7t6cVaqaeKVCJbfbGfaPZcHNl:n8n4LcUrXuKJiegSN63kWw2E0lrB3k0D

Score
10/10
ransomware

Malware Config

Extracted

Ransom Note
<html> <title>CryptoWall 3.0</title> <style> a { color:green; } .tb { background:white; border-style:solid; border-width:1px; padding:3px; border-color:lime; } .ttl { font-size:13px; color:880000; } </style> <body style="width:100%; background:#33CCFF;"> <center> <div style="text-align:left; font-family:Arial; font-size:13px; line-height:20px; margin-top:10px; width:800px; background:#F4F4F4; padding:20px; border-style:solid; border-width:5px; border-color:#BABABA;"> <b><font class="ttl">What happened to your files?</b></font> <br> <font style="font-size:13px;">All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 3.0. <br> More information about the encryption keys using RSA-2048 can be found here: <a href="http://en.wikipedia.org/wiki/RSA_(cryptosystem)" target="_blank">http://en.wikipedia.org/wiki/RSA_(cryptosystem)</a><br></font> <br> <b><font class="ttl">What does this mean?</b></font> <br> <font style="font-size:13px;"> This means that the structure and data within your files have been irrevocably changed, you will not be able to work<br> with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. </font> <br><br> <b><font class="ttl">How did this happen?</b></font> <br> <font style="font-size:13px;"> Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. <br> All your files were encrypted with the public key, which has been transferred to your computer via the Internet. <br> Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. </font> <br><br> <b><font class="ttl">What do I do?</b></font> <br> <font style="font-size:13px;"> Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. <br> If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist. </font> <br><br> <div class="tb" style="color:#880000; font-size:13px; border-width:3px;"> For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: <hr> <b>1.<a href="http://6i3cb6owitcouepv.payoptvars.com/1e2m5mp" target="_blank">http://6i3cb6owitcouepv.payoptvars.com/1e2m5mp</a></b> <br> <b>2.<a href="http://6i3cb6owitcouepv.payforusa.com/1e2m5mp" target="_blank">http://6i3cb6owitcouepv.payforusa.com/1e2m5mp</a></b> <br> <b>3.<a href="http://6i3cb6owitcouepv.paywelcomefor.com/1e2m5mp" target="_blank">http://6i3cb6owitcouepv.paywelcomefor.com/1e2m5mp</a></b> <br> <b>4.<a href="http://6i3cb6owitcouepv.payemarateslines.com/1e2m5mp" target="_blank">http://6i3cb6owitcouepv.payemarateslines.com/1e2m5mp</a></b> </div> <br> <div class="tb" style="font-size:13px; border-color:#880000;"> If for some reasons the addresses are not available, follow these steps: <hr> 1. Download and install tor-browser: <a href="http://www.torproject.org/projects/torbrowser.html.en" target="_blank">http://www.torproject.org/projects/torbrowser.html.en</a><br> 2. After a successful installation, run the browser and wait for initialization.<br> 3. Type in the address bar: <font style="font-weight:bold; color:#009977;">6i3cb6owitcouepv.onion/1e2m5mp</font><br> 4. Follow the instructions on the site. </div> <br> <br> <b>IMPORTANT INFORMATION:</b><br> <div class="tb" style="width:790px;"> Your Personal PAGE: <b><a href="http://6i3cb6owitcouepv.payoptvars.com/1e2m5mp" target="_blank">http://6i3cb6owitcouepv.payoptvars.com/1e2m5mp</a></b><br> Your Personal PAGE(using TOR): <font style="font-weight:bold; color:#009977;">6i3cb6owitcouepv.onion/1e2m5mp</font><br> Your personal code (if you open the site (or TOR 's) directly): <font style="font-weight:bold; color:#770000;">1e2m5mp</font><br> </div> </div> </center> </body> </html>

Signatures

Files

  • HELP_DECRYPT.HTML