Static task
static1
Behavioral task
behavioral1
Sample
993ixjlb-readme.txt
Resource
win7-20240221-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
993ixjlb-readme.txt
Resource
ubuntu1804-amd64-20240226-en
0 signatures
150 seconds
General
-
Target
993ixjlb-readme.txt
-
Size
6KB
-
MD5
4c1653c532b94cfd5fefcb99db7ffb1c
-
SHA1
745f7808aeb64de46a5819b7873d69b143774b8e
-
SHA256
c35c30cd5cd005f05226bc652e05157f33722af994e4121a2bf1936f7a727ea8
-
SHA512
3e16b64e424dc51824cacf201b2f71b2573d2249b669304274b3e27b72914a00b81c13302939b994c01c1ab685be216a8a4addcb1829d3dd7e1fb0592e4365a3
-
SSDEEP
96:oziNsQVxU3TP3Ma0ZLgZoRz7ttZRUfH4c5jUwZUfWhEFHv6FIGWdA75u:ozz3jcj7tTff4OvJGI
Score
10/10
Malware Config
Extracted
Ransom Note
---=== Welcome. Again. ===---
[-] Whats HapPen? [-]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 993ixjlb.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4FE49B3286F992CB
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decoder.re/4FE49B3286F992CB
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
cmWRTrhGaxBPY61xDVvWNmN3BNqoc69oKOOyT9szKN0MkbLuWDglAjdvXpRtM04o
U6CwlksW972OjnRNPyLxsrdgQ6vKLBgNVU9EeBdNKIe0xx00W+f52FjzBHSU6Uqj
jA9+x4nQlb1UnBfh03fudODALR0OwOEPLJRA6UwVgBU5sTIxSS2XeDW54xQiIaQ2
2LwacPyp6uB9KG9HzuOrYaoGF2dkck5vztvYs7x5/PdniIsVeKWJT18lxS+pvr5H
iOnmvbb15EzVHWXoX3QLOrzlXwVyN3SObOi6wxgbavBvmL5nkhum7omuV2pijbDB
Zql60QG+f/0AvJ9c+Mv6FqfBP7bAaPAJbMyM/Azl800yhIlTVKptuHj6yLTaSf08
k9N21UjIgvVFPaXnkiuK+1tV9lPNhc86JzqXyPvaW91Qs+brytctNuxNX9u5aDCP
Hl9hq0352ViUNQel60jHZjZxMPmiqcvMKh7f5xpVQWANm7CNqL8/orfZdSSwUfmG
3Vybt4yx7/J9tG74ljaZZFZjEW6vX6ZhGR93zjH8f4ocJe3rhfxCsMPW/ClxQbU4
sTekXfCxRLye8ryr1D7aPI5tSnadE5IhVQHNyub2NdlDypjwV5RIsds2b1PGCN/R
s/T9s5A18bkKhhItchGS37N1VcK4tJY9HMNwYMtOu7yevZjvS9NYAQT/p7eceSvp
4e2gej7F6wx8BDsORCapTTeKfy/wqr9PE0PtwVc0bICU8404QnEMPR4ENMfTFVD1
C859u1JvmxXdCvutFSomZaEvVZGuT7ZELqllCbPbHaBFslOxylmOrb4yKHkANN0i
tHrccO/ntE/db6l0zmh/wbBdUusMn/+MeljdDAdzJUon4VHBme9ew52E8EwwjDxr
gMDwV0VaBarxY+cOlvzhi/y6hAhrUHc0pN/qQmJdIk+vVLyAvnAq4kvS+TCr9J/9
Cf6HJ0anEFnArXyEch/Yj++o4Zur+sJBiNOZzCUZuHtMZSor2eIU2w0uYfYb8Yt7
E10KLssTcTJuXs52JYEMU+TFpjJkMl0GHjpfmSoz68hQhKlHQyzLbiT9KwRi86Iz
sRA9qkotYREsA5xMDgK6OE3K97n7/+MUOlpZcP49Q7mrN9oQnnSnRAcstk3mWy4I
Stjb1E0uYGTHiBxp9KR6hCMwnAlrnWZjSDV+iyvfxvq7+Ao6SiCHRBA5JTrAco2G
aqntlqVZ0MuqLTsl8LkH8ND7lHz7xkOsv1q9phL+tfNvUikXyBpJwxTbm6QWKDNM
va/odyk4MHOqz3SvCd+pxMsUdJyoxtAvC08inXiFUL8SQyVkUfSXdhRm0Jy/hZxj
LAKStSCWL/8=
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
URLs
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4FE49B3286F992CB
http://decoder.re/4FE49B3286F992CB
Signatures
Files
-
993ixjlb-readme.txt