General

  • Target

    HELP_RESTORE_FILES.txt

  • Size

    2KB

  • MD5

    28dbd1a2a76250994368880b93db20c8

  • SHA1

    21265879947dfa6d4e6e46a5aecd6891d7b26075

  • SHA256

    865fceb12d68fd83feb11202436775143e81227766e821dca26270af04bd34b3

  • SHA512

    7471ed58b1a5d682a322a91cf6c9313e1b27541f551a146e06daf5e67622a28d78e4755ad88b3924dbaaf336ed82036e3dba519e0d3208014bb5ae93142e1ada

Score
10/10

Malware Config

Extracted

Ransom Note
All your documents, photos, databases and other important files have been encrypted with strongest encryption RSA-2048 key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main encryptor red window, examine it and follow the instructions. Otherwise, it seems that you or your antivirus deleted the encryptor program. Now you have the last chance to decrypt your files. Open http://qcuikaiye577q3p2.aenf387awmx28.com or http://qcuikaiye577q3p2.od9wjn4iene29.com , https://qcuikaiye577q3p2.s5.tor-gateways.de/ in your browser. They are public gates to the secret server. Copy and paste the following Bitcoin address in the input form on server. Avoid missprints. 14HVBL4YJBuGaqxtfgJ6h1RrXrvb84zKSc Follow the instructions on the server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://qcuikaiye577q3p2.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following Bitcoin address in the input form on server. Avoid missprints. 14HVBL4YJBuGaqxtfgJ6h1RrXrvb84zKSc Follow the instructions on the server.
Wallets

14HVBL4YJBuGaqxtfgJ6h1RrXrvb84zKSc

URLs

http://qcuikaiye577q3p2.aenf387awmx28.com

http://qcuikaiye577q3p2.od9wjn4iene29.com

https://qcuikaiye577q3p2.s5.tor-gateways.de/

http://qcuikaiye577q3p2.onion/

Signatures

Files

  • HELP_RESTORE_FILES.txt