General

  • Target

    How_to_backup_files.html

  • Size

    5KB

  • MD5

    ca755d1b017d2fffd8cb74e1387d335d

  • SHA1

    e99032275bc818746d50d9a2e86bdee6376c2fe4

  • SHA256

    70f1eef3c26aa97cf7a4213e1167c706bcc99a0c8253e60afecbd6e6cb6e7081

  • SHA512

    fa0cd1268931c45edcfd4defde50a45f743bd3d9c18f2416f53a6967c55ac1166f1e0899ba025dbfa6074ecd73e18325233f2453cd550dd83eace337b2aa9209

  • SSDEEP

    96:8y+cAl5azrn+DtZogiON7FmugXXwNCY9ceZiKFe8LeRjdO:8OAl0zaDjvFPP9ce0KYQKO

Malware Config

Extracted

Family

medusalocker

Ransom Note
Your personal ID: ZNKT+NF5S86wTgqY+Xlmds9qOrbTIHQCLBXRGc5b0TExOG6YGU9dh2gIA6RaU uP1bJWroVm0qd1k4LyhQVGDctpi2LFlh3uaGAyKBb10Up92m/xrZApp2fFOVD2A1fgNkc4yyt4iWMrjcpgukRhgQ32UqXxtGuf43X2/bmdM/vNsvbl6C+mcquJSxeStg MzgJhOdxpBLn781B3XB7crhNw0spuc69FAeowvNVSy+ZqUJY0es6GeRulmhlEJqGhhYvUurcXhOzHaEMFoAUWcd33t78Ev06prZ+rVyCNVMqOJ66ItLS65UJgWX0MOIn 36A5LRsOBqBAHVPveLKSXp+HMQn1CJmq/4ncs37Kp9YLAefHSORRqWoRC9n4q9zU3XHkOT0v5UiVT9qPo/aEkoL3Vzw6SQg/av0NfwbronQPJi49PQKVIb1ond+O9R7T cbXvdFLmXKgaLxRog1exSfV9YuE4isLJmbURqzNPuHd2fos1X98OgweZ9xUFEMS5x31E+DTVc+WyAFa8FaqNFgk2qzEbMac+aGu1H9Hw3KE3qtHyeX7fHDFDmPbdzTtV cKTDlgiQMQyYZk48tp61lttDzflogjjrU2/hA5OAqMUo+ABhlP40zwDMMpijvpAxqDAqipRARuAhdfRAZO89GY9HaoKm0AhUXaSlBvF9hq/6j/x91KwUmgJ6ymfgp5A7 rXmJiT37WRKitQ+hIVfA6OSkFFgeJ8bA68+zRYXYHaxaJE6NmWKlGM28+ePDsD2CRBJ9IFOjUABXug5CRSvhrdakkaBlVcTDMo88O+zGA6LixSQJtGPV5L+Pc3zKrYYl vv+YMSkcddl4AZwSx7duRhCfuspvx6AM1YgDct46Dk7/3ZyfNnG87suFDYBm2OxRYKPfgL55jyNW3gsZvklnlWQuQuydn0bsmPA7v5g8x2zxyRhBYwCkOX6vbMuUIOi5 WjbndV3N7yMroFBrYlKNINJIDQu/tc4cMW90Auf0jBHAkjsvCvQBefHMouuKl8qxEFYam7vi8levRjQyeC7oQmFuLX/YTj+sHAhgpYuqX1Oos0J4kgHtHdMTcrd0PdF9 0jrPNj4uTeyCVWoI13PHhT/JPod03FoBVVKx3HIxhpn39Aa75bJh1ZW4OkykvPo3q+cEV6ZlYpqvIiXRXD3F+Gfe+9SwMCvd+EbZ52AVaQAVAdmdu+BKtRZNL16cUmRM wv0cz73KEf3/yOjibAb7DspTWyJbp+FMKM69gPA00qLkLTpShMB5hXahrXY049K8mxlaCgGKaAMpb6Narm48FFAuWSs36V2QmoYlA53T5br7GWRHQwzfXva92lwx29Mi P0HSGHaU4xzPlvfMM8PdLGGXWnR5WjhAbJ2KJPPLKMvxoE/Cuj8PpgBrD3ke9QFlKLqoh9h45b/GcmEDReCW9cPGoROEsex0499/JlJ+DGPAePOjccqioXUisKFIx7PR jCwCzdQLZZrwKcOFKM2IlpcXemoNns+WbGUuZgI22vzQWx24trmijUavCpRFSMoWowwHVQ43g9voL8R/c4DX6j+daZqFeM0PIQ1Zl+gZFCIfX5hPzlYdjhaf9+j/+Gxr rk9K8GHiJiKSwQrOEY3E/FjXYc8Tg34aQmzprgaL0W+vge5kH8HesnkxPFyt0P7pWiErNIYWEZr5KkhEIxcNCQm28clWdLa0Mp+ua97GE4CVjs= /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. email: [email protected] [email protected] * To contact us, create a new free email account on the site: protonmail.com IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. * Tor-chat to always be in touch: qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion

Signatures

Files

  • How_to_backup_files.html
    .html