General

  • Target

    993ixjlb-readme.txt

  • Size

    6KB

  • MD5

    4c1653c532b94cfd5fefcb99db7ffb1c

  • SHA1

    745f7808aeb64de46a5819b7873d69b143774b8e

  • SHA256

    c35c30cd5cd005f05226bc652e05157f33722af994e4121a2bf1936f7a727ea8

  • SHA512

    3e16b64e424dc51824cacf201b2f71b2573d2249b669304274b3e27b72914a00b81c13302939b994c01c1ab685be216a8a4addcb1829d3dd7e1fb0592e4365a3

  • SSDEEP

    96:oziNsQVxU3TP3Ma0ZLgZoRz7ttZRUfH4c5jUwZUfWhEFHv6FIGWdA75u:ozz3jcj7tTff4OvJGI

Score
10/10

Malware Config

Extracted

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 993ixjlb. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4FE49B3286F992CB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/4FE49B3286F992CB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: cmWRTrhGaxBPY61xDVvWNmN3BNqoc69oKOOyT9szKN0MkbLuWDglAjdvXpRtM04o U6CwlksW972OjnRNPyLxsrdgQ6vKLBgNVU9EeBdNKIe0xx00W+f52FjzBHSU6Uqj jA9+x4nQlb1UnBfh03fudODALR0OwOEPLJRA6UwVgBU5sTIxSS2XeDW54xQiIaQ2 2LwacPyp6uB9KG9HzuOrYaoGF2dkck5vztvYs7x5/PdniIsVeKWJT18lxS+pvr5H iOnmvbb15EzVHWXoX3QLOrzlXwVyN3SObOi6wxgbavBvmL5nkhum7omuV2pijbDB Zql60QG+f/0AvJ9c+Mv6FqfBP7bAaPAJbMyM/Azl800yhIlTVKptuHj6yLTaSf08 k9N21UjIgvVFPaXnkiuK+1tV9lPNhc86JzqXyPvaW91Qs+brytctNuxNX9u5aDCP Hl9hq0352ViUNQel60jHZjZxMPmiqcvMKh7f5xpVQWANm7CNqL8/orfZdSSwUfmG 3Vybt4yx7/J9tG74ljaZZFZjEW6vX6ZhGR93zjH8f4ocJe3rhfxCsMPW/ClxQbU4 sTekXfCxRLye8ryr1D7aPI5tSnadE5IhVQHNyub2NdlDypjwV5RIsds2b1PGCN/R s/T9s5A18bkKhhItchGS37N1VcK4tJY9HMNwYMtOu7yevZjvS9NYAQT/p7eceSvp 4e2gej7F6wx8BDsORCapTTeKfy/wqr9PE0PtwVc0bICU8404QnEMPR4ENMfTFVD1 C859u1JvmxXdCvutFSomZaEvVZGuT7ZELqllCbPbHaBFslOxylmOrb4yKHkANN0i tHrccO/ntE/db6l0zmh/wbBdUusMn/+MeljdDAdzJUon4VHBme9ew52E8EwwjDxr gMDwV0VaBarxY+cOlvzhi/y6hAhrUHc0pN/qQmJdIk+vVLyAvnAq4kvS+TCr9J/9 Cf6HJ0anEFnArXyEch/Yj++o4Zur+sJBiNOZzCUZuHtMZSor2eIU2w0uYfYb8Yt7 E10KLssTcTJuXs52JYEMU+TFpjJkMl0GHjpfmSoz68hQhKlHQyzLbiT9KwRi86Iz sRA9qkotYREsA5xMDgK6OE3K97n7/+MUOlpZcP49Q7mrN9oQnnSnRAcstk3mWy4I Stjb1E0uYGTHiBxp9KR6hCMwnAlrnWZjSDV+iyvfxvq7+Ao6SiCHRBA5JTrAco2G aqntlqVZ0MuqLTsl8LkH8ND7lHz7xkOsv1q9phL+tfNvUikXyBpJwxTbm6QWKDNM va/odyk4MHOqz3SvCd+pxMsUdJyoxtAvC08inXiFUL8SQyVkUfSXdhRm0Jy/hZxj LAKStSCWL/8= ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4FE49B3286F992CB

http://decoder.re/4FE49B3286F992CB

Signatures

Files

  • 993ixjlb-readme.txt