General
- Target Antefrigus.exe
- Size 298KB
- Sample241120-xtpkmswmdm
- SHA256 3cb061bd1c9326ec12d3b5f540d425730245472b72e5295f52b53b82ea03cb68
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\ystwha-readme.txt
-
antefrigus
Ransom Note
- $$$$ $$ $$ $$$$$$ $$$$$ $$$$$$ $$$$$ $$$$$$ $$$$ $$ $$ $$$$ $$ $$ $$$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$$$$$ $$ $$$ $$ $$$$ $$$$ $$$$$ $$ $$ $$$ $$ $$ $$$$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$ $$$$$ $$ $$ $$ $$$$$$ $$$$ $$$$ $$$$ [+] Whats Happen ? [+] Your files are encrypted, and currently unavailable.You can check it : all files on you computer has expansion ystwha. By the way, everything is possible to recover(restore), but you need to follow our instructions.Otherwise, you cant return your data(NEVER). [+] What guarantees ? [+] Its just a business.We absolutely do not care about youand your deals, except getting benefits.If we do not do our workand liabilities - nobody will not cooperate with us.Its not in our interests. To check the ability of returning files, You should go to our website.There you can decrypt one file for free.That is our guarantee. If you will not cooperate with our service - for us, its does not matter.But you will lose your timeand data, cause just we have the private key.In practise - time is much more valuable than money. [+] How to get access on website ? [+] You have two ways : 1)[Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website : http://yboa7nidpv5jdtumgfm4fmmvju3ccxlleut2xvzgn5uqlbjd5n7p3kid.onion/?ystwha (If you can�t follow the link or other difficulty write to the technical support email : [email protected]) 2) If TOR blocked in your country, try to use VPN! For this: a) Open any browser (Chrome, Firefox, Opera, IE, Edge) and download and install free VPN programm and download TOR browser from this site https://torproject.org/ b) If you are having difficulty purchase bitcoins, or you doubt in buying decryptor, contact to any data recovery company in your country, they will give you more guarantees and take purchase and decryption procedure on themselves. Almost all such companies heared about us and know that our decryption program work, so they can help you. When you open our website, put the following data in the input form: Key: Pjw/Nzg6Ozs7ODg3PD85OyhIa3RwdSiAent+b2goSkEnOTo8Njk3J05pQzZpeUUnTUEnOEA2OEAnTmlDNml5RSc= Extension name : ystwha ---------------------------------------------------------------------------------------- - !!!DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private keyand, as result, The Loss all data. !!!!!!!!! ONE MORE TIME : Its in your interests to get your files back.From our side, we(the best specialists) make everything for restoring, but please should not interfere. !!!!!!!!!
Emails
URLs
-
http://yboa7nidpv5jdtumgfm4fmmvju3ccxlleut2xvzgn5uqlbjd5n7p3kid.onion/?ystwha
Targets
-
- Target Antefrigus.exe
- Size 298KB
- SHA256 3cb061bd1c9326ec12d3b5f540d425730245472b72e5295f52b53b82ea03cb68
Score10/10-
AnteFrigus
Ransomware family which only encrypts files on drives other than C:.
-
Antefrigus family
-
Legitimate hosting services abused for malware hosting/C2
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.