General
-
Target
EGdu_HOW_TO_DECRYPT.txt
-
Size
1KB
-
Sample
241130-xf9cwsvrhk
-
MD5
4e68cfad3f3cbef5406c90fd9e9d7931
-
SHA1
504d53957bbed8e1a612c791eec7abdd17bd15bc
-
SHA256
51dc299391f9b3eca411936a0d01781ad68799d282655e0d20c8c8521aa8e014
-
SHA512
78c89847c3a7c128e5d54c3fff0e41c89a61722730b9d02d9c7e0b6985ce8188c3c37b6357a71c30f7e34c8b78f94599a186be6c189e56f6ccb832033e77172a
Score
10/10
Malware Config
Extracted
Family
hive
Ransom Note
Your network has been breached and all data were encrypted.
Personal data, financial reports and important documents are ready to disclose.
To decrypt all the data or to prevent exfiltrated files to be disclosed at
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
you will need to purchase our decryption software.
Please contact our sales department at:
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
Login: jxkdVr8zZs5J
Password: GHTM6Qgqyhqs4nMH53ZD
To get access to .onion websites download and install Tor Browser at:
https://www.torproject.org/ (Tor Browser is not related to us)
Follow the guidelines below to avoid losing your data:
- Do not shutdown or reboot your computers, unmount external storages.
- Do not try to decrypt data using third party software. It may cause
irreversible damage.
- Do not fool yourself. Encryption has perfect secrecy and it's impossible
to decrypt without knowing the key.
- Do not modify, rename or delete *.key.uj1ps files. Your
data will be undecryptable.
- Do not modify or rename encrypted files. You will lose them.
- Do not report to authorities. The negotiation process will be terminated
immediately and the key will be erased.
- Do not reject to purchase. Your sensitive data will be publicly disclosed.
URLs
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/