Resubmissions
25/03/2025, 15:11
250325-skmbpsxzaw1025/03/2025, 15:06
250325-sg1d6a1px21025/03/2025, 15:01
250325-sd5jpsxyct1025/03/2025, 14:56
250325-sbdcfaxxgs1025/03/2025, 14:50
250325-r7ve6a1nv31025/03/2025, 14:46
250325-r5ab7sxwhx1025/03/2025, 14:40
250325-r2c9paxwe11005/02/2025, 10:25
250205-mgcefaslhw1005/02/2025, 10:17
250205-mbs51atmbk1005/02/2025, 09:15
250205-k785zs1pfn10General
- Target RS.7z
- Size 20.5MB
- Sample250325-sd5jpsxyct
- SHA256 c5741701b3866459dd1ffa2477cfd8776713612912693a5897f78aac795d23e9
Malware Config
Extracted
-
blackmatter
-
1.2
-
512478c08dada2af19e49808fbda5b0b
-
Username
-
Password
120Heisler
-
Username
-
Password
Tesla2019
-
Username
-
Password
iteam8**
-
https://paymenthacks.com
-
http://paymenthacks.com
-
https://mojobiden.com
-
http://mojobiden.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
-
mespinoza
-
ransomnote
Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] [email protected] [email protected] Also, be aware that we downloaded files from your servers and in case of non-payment we will be forced to upload them on our website, and if necessary, we will sell them on the darknet. Check out our website, we just posted there new updates for our partners: http://wqmfzni2nvbbpk25.onion/ -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What to tell my boss? A: Protect Your System Amigo.
Extracted
-
sodinokibi
-
$2a$10$kmb3nsvQXC.93GYNCGKy/uq9hYHivf0e3HcajFIifr8Hf3fmnofgm
-
7258
-
gasbarre.com
-
all-turtles.com
-
rksbusiness.com
-
christ-michael.net
-
mardenherefordshire-pc.gov.uk
-
erstatningsadvokaterne.dk
-
marchand-sloboda.com
-
unim.su
-
bauertree.com
-
faronics.com
-
moveonnews.com
-
autopfand24.de
-
mountsoul.de
-
beaconhealthsystem.org
-
cerebralforce.net
-
aprepol.com
-
kaotikkustomz.com
-
dubnew.com
-
simulatebrain.com
-
alvinschwartz.wordpress.com
-
net
true
-
pid
$2a$10$kmb3nsvQXC.93GYNCGKy/uq9hYHivf0e3HcajFIifr8Hf3fmnofgm
-
prc
outlook
agntsvc
infopath
sqbcoreservice
steam
firefox
ocomm
ocssd
mydesktopqos
oracle
powerpnt
wordpad
synctime
sql
thebat
onenote
excel
visio
encsvc
winword
mydesktopservice
dbsnmp
isqlplussvc
tbirdconfig
mspub
msaccess
thunderbird
ocautoupds
xfssvccon
dbeng50
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 70 GB archived data from your file server and SQL server Example of data: - Accounting - Finance - Personal Data - Banking data - Confidential files And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7258
-
svc
svc$
vss
sophos
mepocs
backup
sql
memtas
veeam
Extracted
-
sodinokibi
-
$2a$10$dfjpLrXuDytfF.kmYtQ1ROgsXjTJEe8EmQT65ftxlTpJtXPZrhsAq
-
7178
-
kamahouse.net
-
bridgeloanslenders.com
-
abitur-undwieweiter.de
-
live-your-life.jp
-
xn--rumung-bua.online
-
anteniti.com
-
marcuswhitten.site
-
ostheimer.at
-
joseconstela.com
-
deepsouthclothingcompany.com
-
dr-seleznev.com
-
ecpmedia.vn
-
aunexis.ch
-
anthonystreetrimming.com
-
pocket-opera.de
-
mooreslawngarden.com
-
osterberg.fi
-
extraordinaryoutdoors.com
-
kamienny-dywan24.pl
-
fitovitaforum.com
-
net
false
-
pid
$2a$10$dfjpLrXuDytfF.kmYtQ1ROgsXjTJEe8EmQT65ftxlTpJtXPZrhsAq
-
prc
avgadmsv
BackupUpdater
ocautoupds
synctime
thebat
excel
isqlplussvc
ccSetMgr
SPBBCSvc
Sage.NA.AT_AU.SysTray
lmibackupvssservice
CarboniteUI
powerpnt
BackupMaint
onenote
klnagent
sql
Rtvscan
xfssvccon
Smc
mspub
encsvc
LogmeInBackupService
kavfsscs
ccSvcHst
BackupExtender
NSCTOP
outlook
dbsnmp
mydesktopservice
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7178
-
svc
ssistelemetry
adsync
svc$
msseces
mbamservice
ssastelemetry
altaro
sbamsvc
ds_notifier
ntrtscan
ofcservice
code42service
macmnsvc
memtas
auservice
telemetryserver
tmccsf
psqlwge
sppsvc
viprepplsvc
azurea
ds_monitor
swi_filter
protectedstorage
mfemms
mfevtp
kaseyaagentendpoint
ltservice
dssvc
altiback
Extracted
-
C:\Users\Admin\readme.txt
- ---=== Ranzy Locker 1.1 ===--- Attention! Your network has been locked. Your computers and server are locked now. All encrypted files have extension: .ranzy ---- How to restore my files? ---- All files on each host in your network encrypted with strongest encryption algorithms Backups are deleted or formatted, do not worry, we can help you restore your files Files can be decrypted only with private key - this key stored on our servers You have only one way for return your files back - contact us and receive universal decryption program Do not worry about guarantees - you can decrypt any 3 files FOR FREE as guarantee ---- Contact us ---- You have two way to contact us: 1. Open our recovery-website (can be open in any browser): https://ranzylock.hk/N6CFBPYX 2. In case of link doesnt work open our mirror recovery-website via TOR Browser: Download TOR Browser here: https://www.torproject.org/download/ Open TOR mirror website: http://a6a5b4ppnkrio3nikyutfexbc6y5dc6kfhj3jr32kdwbryr2lempkuyd.onion/N6CFBPYX ---- Data Leak Attention ---- !!! All your sensitive data was downloaded to our servers !!! We are ready to publish this data in our blog with your Company Name, if you will not contact with us by email !!! Only we can delete your files from our servers !!! Only we can restore all your files without any LOSS ---- Recovery information ---- key: eyJleHQiOiIucmFuenkiLCJuZXR3b3JrIjoidHJ1ZSIsInN1YmlkIjoiMTQzNzUiLCJsYW5nIjoiZW4tVVMAIn0= personal id: 10EKVPIH
-
https://ranzylock.hk/N6CFBPYX
-
http://a6a5b4ppnkrio3nikyutfexbc6y5dc6kfhj3jr32kdwbryr2lempkuyd.onion/N6CFBPYX
Extracted
-
sodinokibi
-
5
-
367
-
craftingalegacy.com
-
g2mediainc.com
-
brinkdoepke.eu
-
vipcarrental.ae
-
autoteamlast.de
-
hostastay.com
-
gavelmasters.com
-
ronaldhendriks.nl
-
successcolony.com.ng
-
medicalsupportco.com
-
kompresory-opravy.com
-
sveneulberg.de
-
oththukaruva.com
-
voetbalhoogeveen.nl
-
selected-minds.de
-
log-barn.co.uk
-
fsbforsale.com
-
jobkiwi.com.ng
-
ivancacu.com
-
11.in.ua
-
net
true
-
pid
5
-
prc
wordpad.exe
outlook.exe
tbirdconfig.exe
agntsvc.exe
thebat.exe
mydesktopservice.exe
sqbcoreservice.exe
thunderbird.exe
ocomm.exe
excel.exe
thebat64.exe
steam.exe
xfssvccon.exe
firefoxconfig.exe
sqlagent.exe
ocssd.exe
mydesktopqos.exe
msaccess.exe
isqlplussvc.exe
mspub.exe
winword.exe
sqlbrowser.exe
dbeng50.exe
sqlservr.exe
oracle.exe
encsvc.exe
powerpnt.exe
dbsnmp.exe
infopath.exe
ocautoupds.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
367
Extracted
-
C:\Program Files (x86)\sr08lbl-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion sr08lbl. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C9BC31D195EDEEED 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/C9BC31D195EDEEED Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JyJaRlY+PCFZO5BcBkivn12YUJVShYVBb0xFYWkRiBr9uf1GJG0QTJ7RrxrlgPqM hr8kp/0yyPxKq8srZw/aUSFkfwdrQzbk+r4UnLgW6t8sd9oW6lt9TFI824NoFDRq hW+hy/h25LkLrcxnqeU0srk6vMQlbsxnm5zOG+p7k37AGGSECn91nmyvvSEzkkNp NyR+Ufc5QRc9xxb806nvdTWMHTcoJg9aSb5oVnZvnf7+/WP76xKN1GN25XzY9iL5 D8eSr5CPJ3Uf4VaJuqhbOlLQNoxWfS2wtp9mfKs/0PIYMXP1VBACLhiQynJRkR3G mSe69nL6q20LP2enMKvMFzzJJSd2VG4t5H4yk1O+ckWby0XV2r/fJWnStNYpEqIe rpOVm/dYDKi3EQVaZabUBsqD5gs6FijXBhpWQxxFhfTfl2TWQOGWEBnNQVIv6iE2 TvNd1vBqX0D5A/UINQ5B3s9YBxYpMQL52o55tj13YJKg5Vh5osTmrZX0WYnSPWth Yvjv3wKrntSrTwrtjMOZiOqULWV4DuFpqneXx6CVrp/rXICLdwtNal/yM/De6SqL RnNP4PsI457JkS+4AWN1WqYSCnDP3n7Hb5wkYV+rb7bFbk8XB5LC1eXXpPdrqyor /vtnwV222d8iv2jvjiBSQHszvEhat5C8hDHBPcDfzza7vEnMeSYKcodfN/blXovI 3LSmMnpiKt8saYTuFa5H0aHSOQIrPedD5o6r0tHnk4BTpSDPm8BRYlelrj3Z6tV2 VG2qe/5tBBTmg7winWVC4eWRmpvfC5D9KsicNG3VaodICqr6IzLz8H9qA2PL5agW yQuZEqHFXxsuRnywWl4TC+4rthdKwMnC40MoGSIwGxnii41x8/snWenQnZQDHOsM Ai8EAPmqhrbB0hFOgrm3DibQ3OToCFKDAQdgt1Qw5NIAQcGxPEnchhbQQS9XBbEV vCQI5KLbC7ExbuI7WIsTdG3lHshjjylZSBVYpSZ1zo54EjUH1eZS8yF7Dmlla+d/ mk+kGc72gejFRlmewtgL0DUpUWbg65KhRwXsk5qvb4mXOu+sOqI2hL5AYNHbtED4 CHIa32wfbyV6CfuzmK2lwPItd3AuaM0Bet6BVpRvF1KJEz7AtqVetlkEL+10QdlN bAKIPgPxLV5ezupS77wIcoZoMnotSMr3B46BBjlaAVLrv9dDm3ZGKbdf0mxpapoc Rv5+UX1mGq2R9F3AZSgylw== Extension name: sr08lbl ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C9BC31D195EDEEED
-
http://decryptor.top/C9BC31D195EDEEED
Extracted
-
C:\Users\k30zg2xv-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion k30zg2xv. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1253381EA533C8F3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/1253381EA533C8F3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: RTM6vCJhfwvNUpBHHLiMCA5BsKYnKwcZgNg349zGbGHWB8oet6ZcolATm9HStIgQ 7IoyZ+VMuQEMEsQG4Dy2s7puI9WB9QNVs0z1Kd9Y9vNvqEJX6nUMJ8ZM+w+p6fzz DqeA3HQ9tWK0vEOrIMlS+cQKtmkcCAdGreEPpVTisdIB7fj9/wKNTfx54ZzDaaT+ rGvLK0H/z4SCP4D4CcXHiqVwydGNEZzkT5DjgwLgXMmKjPX/eFE1rv/XoIMm7exV VJxLNQpGweFDKDGM/RJP+lY580I+3Fbt9abiIKFcGN5ubsnGfIYfvmdyKRrBgBlQ wyEoIBzAUOScIihbOc4dF2qcIOALUiH938C6a4tQg2lg/jizC9Xprub2aepXJOFc 7P41hOUy5rKaQQJh8ItaEg5THIr57joDdH2d1vG0R8AZetoXjNhpXsMJAoOGjPcp X6tFcqh89RoEeSbYnOjUGjiSE3GTYrR8O5v3ViwNFWWSabudtyMeADckHjDoQk8A DI/cDDSLkeQOpi6YcKwXoLTc9akX3b5Y3QKsZ5qbcDgc+nmla4xUCQ+yqV9U4ak3 lKHcEc3SYxx3XtTocmLAhT4LqI5SRpmXhBerRW6B3SfyVbanoBz9L0dRFmUvv0vO /oBLTlHa6fEz7YjBPXhTNchiiNBUglyQQArTRAz0CLraZmfVD540nWW97wPMGu1r /oAIMgTRd3SRo3KZ0mDEtvPQY0Lvn1jWxcu2nxo3rz5GFezPkgUlsdGoKcGtFQwA /hEvxDDHEF/D8c4axBOYEr6F9fbOPtzFgaWDQ6t0qDrW62x7B/I7mUd/B9jXPp85 XXA/F98D+6TkfPvE5KPrnubDRq9laSHDuD/LP52uFFkqvRpoo0zsf4YwN8je2f1G FgsPK77P4kJke8Fy2OW/V6WGT8IJ48xAapxkdXONN7QrhKhdJdajBe9lhG8+mBaE P6czjbrNvs4SW4iUdNzDyP7srLbQ1D+wgVNRNOqIVAxNI4S+wR+2ldT+yyVRbw7r btxY8XDRpagCJ4aBycst9xns0x+2AmtkA6qwtNZQX9aG2J9giwgOR3rs4aJHSHHq a3VhPW8BekcnZ+tOzq1fSQb81nVe95JIc6a9iA1vxmEE6yNWC7cm7dqEF6Cypb+n JJJL81FwXmFP3iKENKD4ORijil4t6C3mkP/Grtl7xhuoLtsqiatuHErjM9Uygs7O /yFBrvdLTL2u5e+T Extension name: k30zg2xv ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1253381EA533C8F3
-
http://decryptor.top/1253381EA533C8F3
Extracted
-
C:\Program Files (x86)\62x9w-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 62x9w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B4CC399F2542F9CA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/B4CC399F2542F9CA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: DKeU51ZNdU8telmNVgIYQ1rX0w1AYEk6ytwCVwE+1zf2+bi3gF2tUdPDuuMiyQhz H7q9UVdFnHd0dM/GAWBe3ndhCOniHBb6Fa+ygc3W2OLTaDsmG/BVi0sY+RtVOaqu 02vxk7DKlXyszosJ+lc9ggUkPS2Kgw6kGTvh36m4ynk7hUp+5uv6EAL0P9vap0u8 wGaG5RZUUJP4QDOQdHku8rvzo5SFamfmb/pTzZXOSFfuPGFyPHNisLOs2oGOM24f YNsFGxgDv7VlBzMeXktlZLky+CJASojSxVtHY1I6ZQ7j1qhU2nDfAHVd8cMB+ux0 XFp1FFZADLNbeU4QqOHh/O7Q0ll29xHdYQw+2inris6XiQNcFT1up112iBoTPiLO q7cCmJWc0X/BBptq7rUKaYgGB3H0WIifVzRwdZI1EyT1t+jRVKnzjR8r+IxrosvK v8ooqoUGihURObpPJbMkh6JWukZNP1Hth3GRTS1BE0hRQvX3iCBxqlUfOfsm9OiY uVfaVKtwlAb935qEs09582NavMpkblsssDPQdiA+HrJ8FvVwEDfbmGSkuPb0RY7n Sk3EwKIccW+puGooTN9FnhkvTc43e8yRRCd0dnSK54JxoaTMAO9wn8X4gMbwMyXo qfNivmxW4XnSPNw+vyFgGEojRaFtnT45XJ+T17+l59rPof6ngUb0ZbtgI83IF+ra cglwGV+aXBIpdBtN4NlFU58ww7VaiS9K1u3/s8CiweV+hgW6lW4LrU2+yICZQ8sM 9dM40gweMl3OZcO5X5CxnokPK8WQj68yAFDfBocBIkxvwq4Yk/QWUmOnEfx9mIYU nIXXKtL+bCEQgdljnWI0rYJc+gWdBKorncCHYx4CtYZ0S6ygFlsJ4WYpd2VZiBNM S/fp8+fxVfyVg7z3CMh0Fp1ArUOMUHfrGfBC+e7umiG2t6MFYFHc6RFvViDrpp01 KCWx1d2bzkTdf/v03DqHO2DmTYWtbgF0iOtVd24UVxOXHJ0XdsG1ur/G7lKfPz02 D5i9znQ78gn6g2eqcKorvSHPeYkuDbPgVc/pfkR1ySAhTj89/6tXj6XF3MJxVHHd PStJZJeC/eDSEcN0Y5tQHv0tHXIEpbSTUFjWHKbkgtemxJDvjvVsYUHNCz5vyQrH 36T3t5BX9EmzLSygHdkOQPoZVp9w8fA/iEegdVkazgHT0NWGw5F3Lw4pjUWaXzmB T7PIAIsfcm1lx3hO Extension name: 62x9w ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B4CC399F2542F9CA
-
http://decryptor.top/B4CC399F2542F9CA
Targets
-
- Target RansomwareSamples/RansomEXX_14_12_2020_156KB.exe
- Size 156KB
- SHA256 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458
Score10/10-
Deletes NTFS Change Journal
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
-
RansomEXX Ransomware
Targeted ransomware with variants which affect Windows and Linux systems.
-
Ransomexx_win family
-
Clears Windows event logs
-
Modifies boot configuration data using bcdedit
-
Renames multiple (161) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Disables use of System Restore points
-
Overwrites deleted data with Cipher tool
Cipher is a Windows tool which be used to securely wipe deallocated HDD space, preventing recovery of deleted data.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target RansomwareSamples/Ranzy_20_11_2020_138KB.exe
- Size 138KB
- SHA256 c4f72b292750e9332b1f1b9761d5aefc07301bc15edf31adeaf2e608000ec1c9
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target RansomwareSamples/Ryuk_21_03_2021_274KB.exe
- Size 273KB
- SHA256 7faeb64c50cd15d036ca259a047d6c62ed491fff3729433fefba0b02c059d5ed
Score10/10-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Ryuk family
-
Renames multiple (7346) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Modifies file permissions
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
- Target RansomwareSamples/Sekhmet_30_03_2020_364KB.msi
- Size 364KB
- SHA256 b2945f293ee3f68a97cc493774ff1e8818f104fb92ef9dbeead05a32fc7006ff
Score1/10 -
- Target RansomwareSamples/Sodinokibi_04_07_2019_253KB.exe
- Size 252KB
- SHA256 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target RansomwareSamples/SunCrypt_26_01_2021_1422KB.ps1
- Size 1.4MB
- SHA256 3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80
Score1/10
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Indicator Removal
4Clear Windows Event Logs
1File Deletion
3Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1