General
- Target 2020-02-28.zip
- Size 7.0MB
- Sample260710-ag1qtact5y
- SHA256 0a1eaaf52d137f5c7abda05d91f51cc35c4881ee2d091b8a36ddd8f38040357b
Malware Config
Extracted
-
revengerat
-
Guest
-
127.0.0.1:2302
-
rdp2.dgsn.fr:213
-
192.168.197.128:1337
-
192.168.1.2:333
-
174.127.99.217:1016
-
127.0.0.1:90
-
RV_MUTEX
Extracted
-
njrat
-
0.7d
-
HacKed
-
192.168.89.1:1177
-
127.0.0.1:2020
-
127.0.0.1:5552
-
127.0.0.1:9999
-
nj1337..ddns.net:1605
-
dalpzy.ddns.net:1085
-
harris974.ddns.net:4444
-
127.0.0.1:4789
-
11138902a3bfab3b4911d46038bfb44e
-
reg_key
11138902a3bfab3b4911d46038bfb44e
-
splitter
|'|'|
Extracted
-
nanocore
-
1.2.2.0
-
uniformmm.ddns.net:1543
-
127.0.0.1:1543
-
spowpow12.hopto.org:5678
-
127.0.0.1:5678
-
192.168.1.16:54984
-
127.0.0.1:54984
-
ghfsquad.duckdns.org:8192
-
ludwigh.duckdns.org:8192
-
jemoederspow.ddns.net:5678
-
192.168.0.129:54984
-
8c89a093-5ac7-424e-8c76-2e80c157bade
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2019-10-14T14:42:04.641145036Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1543
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
8c89a093-5ac7-424e-8c76-2e80c157bade
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
uniformmm.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
-
asyncrat
-
0.5.6A
-
null
-
bomi.duckdns.org:8080
-
sam144169-56334.portmap.io:56334
-
sam144169-56334.portmap.io:5552
-
sam144169-56334.portmap.io:5050
-
webforma.chickenkiller.com:56334
-
webforma.chickenkiller.com:5552
-
webforma.chickenkiller.com:5050
-
webdata.ddns.net:56334
-
webdata.ddns.net:5552
-
webdata.ddns.net:5050
-
noregisterdomain.zapto.org:9040
-
number2.duckdns.org:6606
-
number2.duckdns.org:7707
-
number2.duckdns.org:8808
-
13.235.23.234:1337
-
unregisteredhost.dynu.net:9040
-
hutqlynrbwzq
-
delay
5
-
install
true
-
install_file
Boomi.exe
-
install_folder
%AppData%
Extracted
-
revengerat
-
R A D
-
KevinDavis-58161.portmap.host:58161
-
192.168.1.112:4444
-
kevindavis-58161.portmap.host:58161
-
RV_MUTEX
Extracted
-
sodinokibi
-
23
-
2415
-
motocrossplace.co.uk
-
nbva.co.uk
-
hospitalitytrainingsolutions.co.uk
-
licensed-public-adjuster.com
-
wallflowersandrakes.com
-
clemenfoto.dk
-
trainiumacademy.com
-
wrinstitute.org
-
glas-kuck.de
-
speiserei-hannover.de
-
yournextshoes.com
-
beauty-traveller.com
-
yvesdoin-aquarelles.fr
-
innervisions-id.com
-
renehartman.nl
-
masecologicos.com
-
birthplacemag.com
-
precisetemp.com
-
advancedeyecare.com
-
almamidwifery.com
-
net
true
-
pid
23
-
prc
bedbh
encsvc
excel
agntsvc
firefox
winword
mydesktopservice
tbirdconfig
steam
EnterpriseClient
bengien
isqlplussvc
ocssd
CagService
thunderbird
thebat
VeeamTransportSvc
mydesktopqos
dbeng50
xfssvccon
synctime
VeeamDeploymentSvc
sqbcoreservice
powerpnt
ocautoupds
onenote
oracle
benetns
msaccess
visio
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2415
-
svc
stc_raw_agent
memtas
MSExchange
VeeamTransportSvc
sql
VeeamDeploymentService
CASAD2DWebSvc
BackupExecManagementService
BackupExecDiveciMediaService
sophos
AcrSch2Svc
VSNAPVSS
CAARCUpdateSvc
WSBExchange
MSSQL$
ARSM
BackupExecAgentAccelerator
MVArmor
veeam
MSSQL
BackupExecAgentBrowser
MVarmor64
BackupExecRPCService
mepocs
vss
bedbg
svc$
AcronisAgent
BackupExecJobEngine
VeeamNFSSvc
Extracted
-
njrat
-
Visual Studio
-
d72f69dfb2e45fb7b2acbc62f8219a16
-
reg_key
d72f69dfb2e45fb7b2acbc62f8219a16
Extracted
-
njrat
-
0.6.4
-
HacKed
-
192.168.1.2:1177
-
43.229.151.191:1177
-
ghassan2019.ddns.net:1177
-
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Extracted
-
sodinokibi
-
$2a$10$KPK1U.aPbMDK0U7fk0AA0eb1FulrL6RUFdtf1KFpcemFduydxXFUC
-
3341
-
synlab.lt
-
sarbatkhalsafoundation.org
-
slupetzky.at
-
deschl.net
-
architekturbuero-wagner.net
-
wraithco.com
-
qualitaetstag.de
-
resortmtn.com
-
phantastyk.com
-
all-turtles.com
-
antenanavi.com
-
faronics.com
-
ncid.bc.ca
-
lecantou-coworking.com
-
hoteledenpadova.it
-
creative-waves.co.uk
-
innote.fi
-
triggi.de
-
precisionbevel.com
-
oemands.dk
-
net
true
-
pid
$2a$10$KPK1U.aPbMDK0U7fk0AA0eb1FulrL6RUFdtf1KFpcemFduydxXFUC
-
prc
oracle
dbsnmp
synctime
powerpnt
dbeng50
firefox
tbirdconfig
thebat
ocautoupds
wordpad
encsvc
steam
ocssd
onenote
winword
msaccess
sql
xfssvccon
excel
thunderbird
infopath
sqbcoreservice
mspub
mydesktopqos
isqlplussvc
visio
outlook
mydesktopservice
ocomm
agntsvc
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome, Radici Products. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3341
-
svc
vss
mepocs
veeam
sophos
sql
svc$
backup
memtas
Extracted
-
njrat
-
0.7d
-
MyBot
-
127.0.0.1:8080
-
9e549438c56317b24cd87c987b694da8
-
reg_key
9e549438c56317b24cd87c987b694da8
-
splitter
Y262SUCZ4UJJ
Extracted
-
warzonerat
-
tresor2020.ddns.net:2020
Extracted
-
njrat
-
0.7NC
-
NYAN CAT
-
127.0.0.1:9045
-
159.65.15.187:5552
-
127.0.0.1:5552
-
unregisteredhost.dynu.net:9045
-
whoisdomain.zapto.org:9045
-
13f63b20924948f
-
reg_key
13f63b20924948f
-
splitter
@!#&^%$
Extracted
-
sodinokibi
-
16
-
2633
-
kdbrh.com
-
condormobile.fr
-
alene.co
-
hom-frisor.dk
-
rizplakatjaya.com
-
computer-place.de
-
o90.dk
-
sellthewrightway.com
-
enactusnhlstenden.com
-
piestar.com
-
comoserescritor.com
-
bg.szczecin.pl
-
projektparkiet.pl
-
proffteplo.com
-
biblica.com
-
motocrosshideout.com
-
mollymccarthydesign.com
-
karmeliterviertel.com
-
spacebel.be
-
bluelakevision.com
-
net
true
-
pid
16
-
prc
agntsvc
wordpad
oracle
powerpnt
sql
mydesktopqos
msaccess
ocssd
sqbcoreservice
thebat
steam
xfssvccon
isqlplussvc
ocautoupds
encsvc
tbirdconfig
visio
infopath
mydesktopservice
dbsnmp
winword
firefox
thunderbird
synctime
onenote
excel
ocomm
outlook
dbeng50
mspub
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2633
-
svc
backup
mepocs
veeam
svc$
sql
vss
memtas
sophos
Extracted
-
revengerat
-
NyanCatRevenge
-
NOREGISTERDOMAIN.ZAPTO.ORG:9045
-
r3dc0d3r.duckdns.org:12301
-
192.168.1.2:2222
-
alien007.my-firewall.org:8080
-
54d472eda7ea
Extracted
-
sodinokibi
-
$2a$10$ng1ayVWEBuIbegblmZ4XYO6olyzUDDpSXTeKaogNyZv9nMOrleGWC
-
3292
-
wari.com.pe
-
d2marketing.co.uk
-
effortlesspromo.com
-
vietlawconsultancy.com
-
hugoversichert.de
-
ausair.com.au
-
campus2day.de
-
cheminpsy.fr
-
oemands.dk
-
epwritescom.wordpress.com
-
monark.com
-
theshungiteexperience.com.au
-
leda-ukraine.com.ua
-
sahalstore.com
-
girlillamarketing.com
-
iviaggisonciliegie.it
-
bradynursery.com
-
katketytaanet.fi
-
pelorus.group
-
abogadosadomicilio.es
-
net
true
-
pid
$2a$10$ng1ayVWEBuIbegblmZ4XYO6olyzUDDpSXTeKaogNyZv9nMOrleGWC
-
prc
excel
isqlplussvc
ocssd
onenote
thunderbird
sqbcoreservice
xfssvccon
powerpnt
agntsvc
mspub
winword
steam
ocomm
firefox
mydesktopqos
dbeng50
infopath
dbsnmp
msaccess
wordpad
tbirdconfig
sql
synctime
visio
encsvc
mydesktopservice
oracle
ocautoupds
outlook
thebat
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3292
-
svc
sql
mepocs
backup
svc$
memtas
veeam
vss
sophos
Extracted
-
revengerat
-
YT
-
yukselofficial.duckdns.org:5552
-
RV_MUTEX-WlgZblRvZwfRtNH
Extracted
-
cybergate
-
v1.07.5
-
remote
-
127.0.0.1:999
-
127.0.0.1:81
-
0Y7117LDCV0730
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
Extracted
-
njrat
-
im523
-
HacKed
-
127.0.0.1:5552
-
yano.ddns.net:1605
-
84.217.125.142:80
-
127.0.0.1:35855
-
hostnj.ddns.net:1177
-
7d6d30a897de0ce8a1f25f71e40d0c4d
-
reg_key
7d6d30a897de0ce8a1f25f71e40d0c4d
-
splitter
|'|'|
Extracted
-
sodinokibi
-
23
-
2418
-
nalliasmali.net
-
funworx.de
-
lapponiasafaris.com
-
frameshift.it
-
olry-cloisons.fr
-
marcandy.com
-
startuplive.org
-
annenymus.com
-
circuit-diagramz.com
-
mursall.de
-
boloria.de
-
metallbau-hartmann.eu
-
test-teleachat.fr
-
adaduga.info
-
iexpert99.com
-
ced-elec.com
-
goddardleadership.org
-
advanced-removals.co.uk
-
jaaphoekzema.nl
-
fann.ru
-
net
true
-
pid
23
-
prc
sqbcoreservice
mspub
synctime
vsnapvss
agntsvc
ocssd
DellSystemDetect
dbsnmp
outlook
isqlplussvc
msaccess
steam
mydesktopservice
benetns
tbirdconfig
vxmon
sql
visio
VeeamNFSSvc
VeeamTransportSvc
beserver
encsvc
thebat
EnterpriseClient
bedbh
dbeng50
firefox
mydesktopqos
infopath
onenote
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2418
-
svc
VSNAPVSS
MVArmor
BackupExecAgentBrowser
backup
MSSQL
VeeamTransportSvc
BackupExecManagementService
BackupExecJobEngine
BackupExecVSSProvider
MSExchange$
MSExchange
vss
svc$
BackupExecDiveciMediaService
ARSM
sql
bedbg
MVarmor64
AcrSch2Svc
AcronisAgent
CAARCUpdateSvc
BackupExecAgentAccelerator
BackupExecRPCService
stc_raw_agent
PDVFSService
veeam
CASAD2DWebSvc
WSBExchange
sophos
mepocs
Extracted
-
njrat
-
0.7d
-
client
-
akamaru.ddns.net:1605
-
netcatclink.ddns.net:4444
-
aa15bd929c7132fe8f63fd4d0ae48d6c
-
reg_key
aa15bd929c7132fe8f63fd4d0ae48d6c
-
splitter
|'|'|
Extracted
-
njrat
-
im523
-
bustabit
-
wogusnn.ddns.net:5553
-
d963ad78fcad26750b040b7fff9e4835
-
reg_key
d963ad78fcad26750b040b7fff9e4835
-
splitter
|'|'|
Extracted
-
quasar
-
1.3.0.0
-
Force One
-
umcarasozinho.giize.com:5552
-
QSR_MUTEX_rXuzhrms6m5Gx0d0lk
-
encryption_key
2yzv2TDIqCeGLodEWuqz
-
install_name
systemhelper.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
systemhelper
-
subdirectory
SubDir
Extracted
-
sodinokibi
-
23
-
2416
-
alpesiberie.com
-
cp-bap.de
-
craftstone.co.nz
-
humanviruses.org
-
smartmind.net
-
cac2040.com
-
solidhosting.nl
-
whoopingcrane.com
-
fixx-repair.com
-
the3-week-diet.net
-
gosouldeep.com
-
envomask.com
-
advance-refle.com
-
scietech.academy
-
centuryvisionglobal.com
-
mindfuelers.com
-
iexpert99.com
-
n-newmedia.de
-
ilveshistoria.com
-
achetrabalhos.com
-
net
true
-
pid
23
-
prc
EnterpriseClient
xfssvccon
tbirdconfig
thunderbird
synctime
ocautoupds
sqbcoreservice
isqlplussvc
vxmon
VeeamDeploymentSvc
steam
VeeamNFSSvc
excel
firefox
bedbh
beserver
benetns
dbeng50
agntsvc
CagService
infopath
encsvc
ocomm
outlook
mspub
VeeamTransportSvc
winword
DellSystemDetect
wordpad
mydesktopqos
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2416
-
svc
ARSM
BackupExecRPCService
stc_raw_agent
BackupExecManagementService
WSBExchange
BackupExecDiveciMediaService
VeeamNFSSvc
AcrSch2Svc
MSSQL$
svc$
MVArmor
sql
backup
memtas
sophos
VeeamTransportSvc
MSExchange$
VeeamDeploymentService
MVarmor64
CAARCUpdateSvc
BackupExecAgentAccelerator
BackupExecVSSProvider
VSNAPVSS
BackupExecAgentBrowser
BackupExecJobEngine
CASAD2DWebSvc
vss
MSExchange
PDVFSService
AcronisAgent
Extracted
-
quasar
-
1.3.0.0
-
CoDer
-
skypeprocesshost.ddns.com.br:4782
-
workwinrarhost.ddns.com.br:4782
-
office.minhaempresa.tv:4782
-
authy.winconnection.net:4782
-
QSR_MUTEX_waaDBjBTwvE4jQF1CY
-
encryption_key
syxdBvDrFCjAln3AxGRZ
-
install_name
0ffice.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
msg
-
subdirectory
Office
Extracted
-
sodinokibi
-
39
-
2427
-
oro.ae
-
hutchstyle.co.uk
-
fysiotherapierijnmond.nl
-
texanscan.org
-
stitch-n-bitch.com
-
piestar.com
-
arearugcleaningnyc.com
-
sveneulberg.de
-
bonitabeachassociation.com
-
hospitalitytrainingsolutions.co.uk
-
kellengatton.com
-
jayfurnitureco.com
-
tieronechic.com
-
unboxtherapy.site
-
sppdstats.com
-
thiagoperez.com
-
santastoy.store
-
harleystreetspineclinic.com
-
maxcube24.com.ua
-
cesep2019.com
-
net
true
-
pid
39
-
prc
thunderbird
ocssd
encsvc
ocautoupds
firefox
agntsvc
tbirdconfig
xfssvccon
winword
mydesktopservice
wordpad
excel
sqbcoreservice
mydesktopqos
synctime
onenote
msaccess
outlook
infopath
dbeng50
mspub
isqlplussvc
thebat
visio
ocomm
oracle
powerpnt
steam
sql
dbsnmp
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2427
-
svc
sql
vss
sophos
backup
mepocs
svc$
memtas
veeam
Extracted
-
njrat
-
0.7d
-
HHHXXX
-
black101.ddns.net:1177
-
c7c947d665980e197b736d98adf01cc0
-
reg_key
c7c947d665980e197b736d98adf01cc0
-
splitter
|'|'|
Extracted
-
quasar
-
1.3.0.0
-
Office04
-
149.28.201.253:4782
-
192.168.2.9:1783
-
86.93.121.149:1783
-
QSR_MUTEX_nOPsSE5lfB8jmCaLPh
-
encryption_key
wmLOOvBXfplnDwfTczPR
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
-
sodinokibi
-
$2a$10$Z8y9lcfcC.RoptrktBINeOzByjdaakniUFR0uPRtoWTiVuxPU0lri
-
3347
-
epwritescom.wordpress.com
-
vibethink.net
-
cursoporcelanatoliquido.online
-
troegs.com
-
ora-it.de
-
dsl-ip.de
-
destinationclients.fr
-
spargel-kochen.de
-
innote.fi
-
kevinjodea.com
-
mdacares.com
-
simulatebrain.com
-
myhealth.net.au
-
chandlerpd.com
-
edgewoodestates.org
-
renergysolution.com
-
celularity.com
-
smokeysstoves.com
-
huehnerauge-entfernen.de
-
pasivect.co.uk
-
net
true
-
pid
$2a$10$Z8y9lcfcC.RoptrktBINeOzByjdaakniUFR0uPRtoWTiVuxPU0lri
-
prc
onenote
dbeng50
mydesktopservice
isqlplussvc
encsvc
visio
winword
infopath
oracle
xfssvccon
mspub
mydesktopqos
thebat
steam
firefox
msaccess
sqbcoreservice
outlook
synctime
ocssd
wordpad
ocomm
thunderbird
excel
tbirdconfig
powerpnt
agntsvc
dbsnmp
ocautoupds
sql
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3347
-
svc
backup
memtas
veeam
mepocs
sophos
sql
svc$
vss
Extracted
-
njrat
-
Hacked By HiDDen PerSOn
-
763c207f69277be20347407bec74dc26
-
reg_key
763c207f69277be20347407bec74dc26
Extracted
-
sodinokibi
-
23
-
2417
-
newonestop.com
-
alaskaremote.com
-
zaczytana.com
-
opticahubertruiz.com
-
fanuli.com.au
-
die-immo-agentur.de
-
maryairbnb.wordpress.com
-
vedsegaard.dk
-
dantreranch.com
-
zuerich-umzug.ch
-
schulz-moelln.de
-
werkzeugtrolley.net
-
arabianmice.com
-
catalyseurdetransformation.com
-
ziliak.com
-
p-ride.live
-
adaduga.info
-
specialtyhomeservicesllc.com
-
alnectus.com
-
buerocenter-butzbach-werbemittel.de
-
net
true
-
pid
23
-
prc
agntsvc
EnterpriseClient
synctime
VeeamNFSSvc
dbeng50
ocomm
ocautoupds
isqlplussvc
vsnapvss
CagService
pvlsvr
benetns
winword
bengien
xfssvccon
encsvc
mspub
excel
DellSystemDetect
wordpad
msaccess
firefox
VeeamTransportSvc
mydesktopservice
sqbcoreservice
thebat
steam
visio
bedbh
raw_agent_svc
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2417
-
svc
WSBExchange
MSExchange
MSExchange$
vss
AcrSch2Svc
mepocs
sql
MVarmor64
BackupExecRPCService
CAARCUpdateSvc
MSSQL$
BackupExecAgentBrowser
AcronisAgent
BackupExecManagementService
BackupExecAgentAccelerator
MSSQL
svc$
BackupExecJobEngine
VeeamDeploymentService
BackupExecDiveciMediaService
sophos
ARSM
BackupExecVSSProvider
bedbg
stc_raw_agent
veeam
memtas
PDVFSService
MVArmor
VSNAPVSS
Extracted
-
njrat
-
0.7d
-
Pubg Mobile
-
Owais5050-61656.portmap.io:56607
-
6cd2713f4eecf0bba2b136a5ea65aac1
-
reg_key
6cd2713f4eecf0bba2b136a5ea65aac1
-
splitter
|'|'|
Extracted
-
njrat
-
0.7d
-
B HAT
-
6defdb46d0dc4d3a9c4b23f911560ebf
-
reg_key
6defdb46d0dc4d3a9c4b23f911560ebf
-
splitter
|'|'|
Extracted
-
njrat
-
0.7d
-
pinatanai
-
159.65.15.187:5555
-
ca60c420c99495343bf4e523a6b382cc
-
reg_key
ca60c420c99495343bf4e523a6b382cc
-
splitter
|'|'|
Extracted
-
sodinokibi
-
25
-
2452
-
salonlamar.nl
-
so-sage.fr
-
expohomes.com
-
humanviruses.org
-
b3b.ch
-
baikalflot.ru
-
stage-infirmier.fr
-
globalskills.pt
-
gurutechnologies.net
-
colored-shelves.com
-
campusescalade.com
-
cormanmarketing.com
-
paardcentraal.nl
-
yvesdoin-aquarelles.fr
-
kickittickets.com
-
hiddensee-buhne11.de
-
leansupremegarcinia.net
-
parentsandkids.com
-
kompresory-opravy.com
-
angelika-schwarz.com
-
net
true
-
pid
25
-
prc
tbirdconfig
sqbcoreservice
winword
encsvc
thebat
ocssd
wordpad
msaccess
ocomm
dbsnmp
mydesktopqos
sql
agntsvc
thunderbird
oracle
powerpnt
xfssvccon
excel
steam
dbeng50
onenote
outlook
firefox
mspub
synctime
isqlplussvc
ocautoupds
visio
mydesktopservice
infopath
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2452
-
svc
sophos
mepocs
sql
backup
veeam
memtas
svc$
vss
Extracted
-
darkcomet
-
Mikel_04
-
ventoclima.hopto.org:8678
-
DC_MUTEX-J9C4X34
-
InstallPath
Temp\Taskmgrk.exe
-
gencode
mn82vWE9luVq
-
install
true
-
offline_keylogger
true
-
password
Mikel2019
-
persistence
true
-
reg_key
taskmgrk
Extracted
-
quasar
-
1.4.0.0
-
Infected
-
noinmy.ddns.net:9999
-
BW7JOTpOU1me7DhAhz
-
encryption_key
cuGnTFdzZchzOboCjJyu
-
install_name
dashost.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WinServe
-
subdirectory
DAF
Extracted
-
sodinokibi
-
28
-
2483
-
miscbo.it
-
encounter-p.net
-
mayprogulka.ru
-
craftingalegacy.com
-
universelle.fr
-
scotlandsroute66.co.uk
-
putzen-reinigen.com
-
energosbit-rp.ru
-
kroophold-sjaelland.dk
-
richardmaybury.co.uk
-
geitoniatonaggelon.gr
-
mundo-pieces-auto.fr
-
towelroot.co
-
mike.matthies.de
-
domilivefurniture.com
-
biblica.com
-
mahikuchen.com
-
ravage-webzine.nl
-
qandmmusiccenter.com
-
satoblog.org
-
net
true
-
pid
28
-
prc
mspub
xfssvccon
dbeng50
thebat
infopath
mydesktopqos
agntsvc
encsvc
winword
synctime
ocssd
onenote
firefox
outlook
powerpnt
thunderbird
msaccess
isqlplussvc
ocomm
mydesktopservice
sql$
steam
tbirdconfig
sqbcoreservice
ocautoupds
veeam
oracle
visio
wordpa
excel
-
ransom_oneliner
Sir, its just a business. Just read and follow all instructions and you get your data back. Find {EXT}-readme.txt and follow instructions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2483
-
svc
svc$
sql
vss
memtas
veeam
mepocs
sophos
backup
altaro
Extracted
-
njrat
-
0.7d
-
victime
-
tutoratderz.ddns.net:1605
-
tutoratderz.ddns.net:5552
-
8c0730e926b0eae012fcb08f50e9bbfe
-
reg_key
8c0730e926b0eae012fcb08f50e9bbfe
-
splitter
|'|'|
Extracted
-
njrat
-
0.6.4
-
Person
-
127.0.0.1:456
-
dae31c02cb06222e776b9ccb9207edb1
-
reg_key
dae31c02cb06222e776b9ccb9207edb1
-
splitter
|'|'|
Extracted
-
sodinokibi
-
39
-
2463
-
signamedia.de
-
lidkopingsnytt.nu
-
hospitalitytrainingsolutions.co.uk
-
airserviceunlimited.com
-
agriturismocastagneto.it
-
malzomattalar.com
-
line-x.co.uk
-
cotton-avenue.co.il
-
goeppinger-teppichreinigung.de
-
luvinsburger.fr
-
cops4causes.org
-
gosouldeep.com
-
colored-shelves.com
-
agora-collectivites.com
-
dmlcpa.com
-
activeterroristwarningcompany.com
-
pourlabretagne.bzh
-
kenmccallum.com
-
weddingceremonieswithtim.com
-
denverwynkoopdentist.com
-
net
true
-
pid
39
-
prc
mydesktopqos
ocautoupds
sql
thebat
steam
tbirdconfig
encsvc
ocomm
thunderbird
dbeng50
powerpnt
oracle
ocssd
onenote
msaccess
mspub
firefox
visio
wordpad
sqbcoreservice
excel
infopath
isqlplussvc
synctime
mydesktopservice
agntsvc
winword
outlook
xfssvccon
dbsnmp
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
2463
-
svc
mepocs
sql
memtas
svc$
veeam
backup
sophos
vss
Extracted
-
sodinokibi
-
$2a$10$h8FAKPY9u6qBEBsl6AJKTusBH31nEUAT0BrIhMBWOh0jYkcvppMLO
-
3341
-
dutchbrewingcoffee.com
-
mountaintoptinyhomes.com
-
leoben.at
-
bastutunnan.se
-
radaradvies.nl
-
chavesdoareeiro.com
-
cursoporcelanatoliquido.online
-
thenewrejuveme.com
-
ralister.co.uk
-
norovirus-ratgeber.de
-
nhadatcanho247.com
-
theduke.de
-
imaginado.de
-
architecturalfiberglass.org
-
fitovitaforum.com
-
roadwarrior.app
-
tennisclubetten.nl
-
thefixhut.com
-
atozdistribution.co.uk
-
stormwall.se
-
net
true
-
pid
$2a$10$h8FAKPY9u6qBEBsl6AJKTusBH31nEUAT0BrIhMBWOh0jYkcvppMLO
-
prc
agntsvc
outlook
ocssd
tbirdconfig
sqbcoreservice
dbsnmp
firefox
ocautoupds
xfssvccon
onenote
oracle
isqlplussvc
sql
winword
visio
powerpnt
msaccess
mspub
excel
mydesktopqos
mydesktopservice
ocomm
synctime
encsvc
thebat
dbeng50
wordpad
thunderbird
infopath
steam
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome, Radici Products. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3341
-
svc
mepocs
veeam
backup
svc$
sql
sophos
vss
memtas
Extracted
-
sodinokibi
-
$2a$10$DHQzYlRAAunwtB62vzeCbulKezX49e1GQgIpyvS.zvw.bJNKvThOe
-
3341
-
aakritpatel.com
-
denovofoodsgroup.com
-
sofavietxinh.com
-
herbstfeststaefa.ch
-
haar-spange.com
-
frontierweldingllc.com
-
jorgobe.at
-
lionware.de
-
ecopro-kanto.com
-
geekwork.pl
-
friendsandbrgrs.com
-
naturavetal.hr
-
bbsmobler.se
-
ledmes.ru
-
ilso.net
-
dramagickcom.wordpress.com
-
micahkoleoso.de
-
plotlinecreative.com
-
pocket-opera.de
-
kingfamily.construction
-
net
true
-
pid
$2a$10$DHQzYlRAAunwtB62vzeCbulKezX49e1GQgIpyvS.zvw.bJNKvThOe
-
prc
tbirdconfig
firefox
mydesktopservice
oracle
ocautoupds
sqbcoreservice
mspub
steam
ocssd
winword
dbsnmp
mydesktopqos
visio
isqlplussvc
agntsvc
wordpad
excel
sql
xfssvccon
onenote
dbeng50
thunderbird
msaccess
ocomm
infopath
thebat
encsvc
outlook
synctime
powerpnt
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome, Radici Products. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3341
-
svc
memtas
sophos
vss
sql
mepocs
backup
veeam
svc$
Extracted
-
njrat
-
Hacked
-
19398dcbfdab92aeb0734478a2451d20
-
reg_key
19398dcbfdab92aeb0734478a2451d20
Extracted
-
njrat
-
0.7d
-
RECUP NOIP
-
9292.ddns.net:10140
-
1f0c56d11a4a44433acf4728c597fd66
-
reg_key
1f0c56d11a4a44433acf4728c597fd66
-
splitter
|'|'|
Extracted
-
darkcomet
-
Mikel50
-
ventoclima.hopto.org:58589
-
DC_MUTEX-1M2MJNL
-
InstallPath
temp\taskmgrk.exe
-
gencode
n7v7WtYPsejG
-
install
true
-
offline_keylogger
true
-
password
Mikel2019
-
persistence
false
-
reg_key
taskmgrk
Extracted
-
njrat
-
0.7d
-
Downloading
-
console-wifi.ddns.net:5552
-
3dfad3bbc7bad1562c683adfee1a8e48
-
reg_key
3dfad3bbc7bad1562c683adfee1a8e48
-
splitter
|'|'|
Targets
-
- Target 03e6043a9dc35b10400bd0e81a62977b05e7ecf941524673bdcdcae9e012cb07.exe
- Size 16KB
- SHA256 03e6043a9dc35b10400bd0e81a62977b05e7ecf941524673bdcdcae9e012cb07
Score1/10 -
- Target 063bbcff3066fd40c909e97833f35e6f4f5a4e0d2a1ec590fd64aea2211196af.exe
- Size 23KB
- SHA256 063bbcff3066fd40c909e97833f35e6f4f5a4e0d2a1ec590fd64aea2211196af
Score10/10Family: njRAT/Bladabindi
Widely used RAT written in .NET.
Modifies Windows Firewall
Adds Run key to start application
-
- Target 0737463d0ed8addd2c9adf17c3289e48ea012750b5f826da5b33da8408341e3c.exe
- Size 203KB
- SHA256 0737463d0ed8addd2c9adf17c3289e48ea012750b5f826da5b33da8408341e3c
Score10/10Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
Executes dropped EXE
Adds Run key to start application
Checks whether UAC is enabled
-
- Target 0a276fdaf3367ca3fd4cf90eb338dd3d0575ba3979f1bd609ce58e13e2aa0a8e.exe
- Size 46KB
- SHA256 0a276fdaf3367ca3fd4cf90eb338dd3d0575ba3979f1bd609ce58e13e2aa0a8e
Score10/10Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
-
- Target 0b3ca8fc417a9e5ac4101babf092999399fe7aadc4d8b68b4707e8297db0a08e.exe
- Size 16KB
- SHA256 0b3ca8fc417a9e5ac4101babf092999399fe7aadc4d8b68b4707e8297db0a08e
Score1/10 -
- Target 0e468c960706b3f4181f54a35650b8edbd0960785dda89a72cdd1e5d600f188b.dll
- Size 164KB
- SHA256 0e468c960706b3f4181f54a35650b8edbd0960785dda89a72cdd1e5d600f188b
Score10/10Family: Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 14ce399fdd253df979fa369daeaeec88b785f661f2b288000345746a3ddb78a1.exe
- Size 32KB
- SHA256 14ce399fdd253df979fa369daeaeec88b785f661f2b288000345746a3ddb78a1
Score10/10Family: njRAT/Bladabindi
Widely used RAT written in .NET.
Modifies Windows Firewall
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Adds Run key to start application
-
- Target 18c601f2c857a8fc639396cc131bde47b16c0bca95ea7f2ca78f7020adc77b8b.exe
- Size 23KB
- SHA256 18c601f2c857a8fc639396cc131bde47b16c0bca95ea7f2ca78f7020adc77b8b
Score10/10Family: njRAT/Bladabindi
Widely used RAT written in .NET.
Modifies Windows Firewall
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Adds Run key to start application
-
- Target 1ab5a32c95f4645f124b455ccbd65a46e56897a9f0f62e3edd8a8c3ea06189ab.exe
- Size 29KB
- SHA256 1ab5a32c95f4645f124b455ccbd65a46e56897a9f0f62e3edd8a8c3ea06189ab
Score8/10Modifies Windows Firewall
Adds Run key to start application
-
- Target 1b9dfd1fe17d3783b2ab4a6d583be6fca9ba164d2a1cd6814c710774ec9bd031.dll
- Size 166KB
- SHA256 1b9dfd1fe17d3783b2ab4a6d583be6fca9ba164d2a1cd6814c710774ec9bd031
Score10/10Family: Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 1db41e3285f0819f9f614052a76500038e9ec2433550c240aeceb2787b235808.exe
- Size 31KB
- SHA256 1db41e3285f0819f9f614052a76500038e9ec2433550c240aeceb2787b235808
Score10/10Family: njRAT/Bladabindi
Widely used RAT written in .NET.
Modifies Windows Firewall
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
-
- Target 1e0cc4051f5ea6cb75b0df551bc5be60abc54ca51cd1611dc760aa245a0055dd.exe
- Size 98KB
- SHA256 1e0cc4051f5ea6cb75b0df551bc5be60abc54ca51cd1611dc760aa245a0055dd
Score10/10Family: WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
- Target 20a0206d431c7d26df2994c1c9d21ec2632e0e4eb358b28a28826af7e51c548f.exe
- Size 32KB
- SHA256 20a0206d431c7d26df2994c1c9d21ec2632e0e4eb358b28a28826af7e51c548f
Score3/10 -
- Target 23096a2bc9feeabd37a9704d0653f4628ef740cdfe24af364ee09d379ec39d95.dll
- Size 164KB
- SHA256 23096a2bc9feeabd37a9704d0653f4628ef740cdfe24af364ee09d379ec39d95
Score10/10Family: Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 23fc02f1e3783ac574850e9f210b8fb54e2a3dd589ed4b0399157e1708457ed1.exe
- Size 14KB
- SHA256 23fc02f1e3783ac574850e9f210b8fb54e2a3dd589ed4b0399157e1708457ed1
Score3/10 -
- Target 2d373452dedac769b8f2ef99985f0c1fd21f4a5d45f45b9e301196da80223ec4.exe
- Size 23KB
- SHA256 2d373452dedac769b8f2ef99985f0c1fd21f4a5d45f45b9e301196da80223ec4
Score10/10Family: njRAT/Bladabindi
Widely used RAT written in .NET.
Modifies Windows Firewall
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1