General
- Target 2026-08-31_1cc8841a07cf22a53627b72f94b1a055_akira_elex
- Size 354KB
- Sample260831-2ftdwszdqf
- SHA256 5454b1a9aa147b4cce277f814d5e5281e122ef14e702ba0f33990789b888fcd6
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\RECOVERY_CHAT.75E20C.html
Ransom Note
- <title>Deadlock - data is safe, sure</title><script src="https://cdn.jsdelivr.net/npm/protobufjs/dist/protobuf.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/js-nacl/1.4.0/nacl_factory.js"></script><link rel="stylesheet" href="https://fonts.bunny.net/css?family=inter:400,500,600,700&display=swap"><link rel="stylesheet" href="https://fonts.bunny.net/css?family=unbounded:400,500,600,700&display=swap"><style>html{overflow-y:auto;font-size:1vw;min-height:100%;background-color:#0b0b0b;background:linear-gradient(213.21deg,#0b0b0b 10.91%,#010e21 92.79%)}*{padding:0;margin:0;outline:none;border:0;border-radius:0;box-sizing:border-box;font-family:Inter,system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,sans-serif}.font{font-family:Unbounded,Inter,system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,sans-serif}body{display:block;min-height:100%;position:relative;color:#fff;background-color:#0b0b0b;-ms-filter:"progid:DXImageTransform.Microsoft.gradient(startColorstr='#0B0B0B',endColorstr='#010E21',GradientType=0)";filter:progid:DXImageTransform.Microsoft.gradient(startColorstr="#0B0B0B",endColorstr="#010E21",GradientType=0);background:-ms-linear-gradient(213.21deg,#0b0b0b 10.91%,#010e21 92.79%);background:linear-gradient(213.21deg,#0b0b0b 10.91%,#010e21 92.79%);zoom:1;border:1px solid #000}b,i,s,u{display:inline-block}.cl1{max-width:88.75rem;width:100%;margin:.729rem auto;padding:0 1.042rem}.cl2{float:left;height:3.333rem;line-height:3.333rem;font-size:0;padding-right:1.25rem;background:#161b22;border-radius:0 .781rem .781rem 0}.cl6,.cl7{display:inline-block;vertical-align:middle}.cl6{width:auto;height:3.333rem;margin:0 .833rem 0 0}.cl7{font-size:1.354rem;font-weight:400;letter-spacing:.12em;color:#fff}.cl3{float:right;font-size:0}.cl4,.cl31{display:inline-block;font-size:1.042rem;font-weight:600;color:#fff;padding:.99rem 1.667rem .99rem 1.25rem;background:#0d3971;border-radius:.625rem;cursor:pointer;text-decoration:none;zoom:1}.cl4{margin-left:.781rem;line-height:1.25rem}.cl4:hover,.cl31:hover{opacity:.85;filter:alpha(opacity=85)}.cl4 svg{vertical-align:top;margin-right:.26rem;width:1.25rem;height:1.25rem}#idt1,.cl4 svg{display:inline-block}#idt1{background:rgba(255,80,92,.1);padding:.99rem 1.042rem;border-radius:.833rem;font-weight:600;font-size:1.042rem;line-height:1.25rem;color:#ff505c}.cl5{opacity:.1;border:1px solid #fff;margin:.729rem 0}.cl5,.cl8{width:100%}.cl8{display:table;table-layout:fixed;padding-top:1.25rem}.cl9{display:table-cell;width:24.792rem;padding-right:4.167rem;vertical-align:top;position:relative}.cl10{display:none}.cl11{background:#161b22;border-radius:.833rem;overflow:hidden}.cl12{display:block;padding:.99rem 1.25rem;color:#fff;font-size:1.042rem;font-weight:700;line-height:1.354rem;background:hsla(0,0%,100%,.05);cursor:pointer;text-decoration:none;zoom:1}.cl12:hover{background:hsla(0,0%,100%,.1)}.cl13{background:#ececec!important;color:#000!important;font-weight:700!important}.cl13 .cl15{color:#000}.cl14,.cl32{display:inline-block;vertical-align:middle;width:1.25rem;height:1.25rem}.cl14{margin-right:1.25rem}.cl14 svg,.cl18 svg{width:100%;height:100%}.cl32{margin-right:.625rem}.cl15{float:right;color:hsla(0,0%,100%,.55);font-size:1.042rem;line-height:1.354rem;width:1.25rem;height:1.25rem;text-align:center}.cl16{display:table-cell;vertical-align:top}.cl17{position:relative;min-height:32vh}.cl18{position:absolute;right:0;top:-1.979rem;width:28rem;height:28rem;opacity:.2;-ms-filter:"progid:DXImageTransform.Microsoft.Alpha(Opacity=20)";filter:alpha(opacity=20)}.cl19,.cl20,.cl29{color:#fff;font-weight:400}.cl19{font-size:1.25rem;opacity:.5;margin-bottom:.833rem}.cl20{font-size:2.5rem;line-height:3.229rem;margin-bottom:1.667rem}.cl21{color:#ff505c;font-weight:600}.cl22,.cl30,.cl34,.cl35{line-height:180%}.cl22{font-size:1.042rem;color:#fff;text-transform:capitalize}.cl23{position:absolute;bottom:1.563rem;left:0;width:20.625rem}.cl76 .cl23{position:static;bottom:auto;left:auto;margin-top:1.563rem}.cl24,.cl30,.cl33,.cl34,.cl35{font-size:.833rem}.cl24{color:#fff;line-height:.99rem;margin-bottom:.625rem}.cl25{font-size:2.5rem;font-weight:800;color:#ff505c;line-height:3.021rem;white-space:nowrap}.cl26{overflow:hidden;margin-top:2.5rem;background:hsla(0,0%,100%,.03);border-radius:1.667rem;padding:3.333rem}.cl27,.cl28{float:left;width:47%;min-height:13.542rem}.cl27{margin-right:6%}.cl28{background:hsla(0,0%,100%,.03);border-radius:.833rem;padding:1.667rem;-webkit-box-shadow:0 1.667rem 1.667rem -1.25rem rgba(0,0,0,.25);box-shadow:0 1.667rem 1.667rem -1.25rem rgba(0,0,0,.25)}.cl29{font-size:1.25rem;margin-bottom:1.667rem;line-height:1.615rem}.cl30,.cl34{color:hsla(0,0%,100%,.5)}.cl30{margin-bottom:1.667rem}.cl33{display:block;color:#4a9eff;text-decoration:underline;margin-top:.417rem}.cl34{margin-top:1.25rem;margin-bottom:.208rem}.cl35{color:#fff;word-break:break-all}.cl28 .cl30{margin-bottom:0}.cl36,.cl37,.cl38{display:none}.cl46{clear:both}.cl77,.cl78{position:fixed;top:0;left:0;right:0;bottom:0}.cl77{background:rgba(0,0,0,.8);z-index:9000;cursor:pointer}.cl78{z-index:9001;background:#090b17;overflow:hidden;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}#idt6,#idt7{display:none}.cl72{margin-bottom:1rem;font-size:0}.cl73{display:inline-block;vertical-align:top;width:3.75rem;height:3.75rem;border-radius:.5rem;margin-right:.417rem;overflow:hidden;background:#0d1b35;cursor:pointer;text-decoration:none}.cl73:hover{opacity:.9;filter:alpha(opacity=90)}.cl73 img{display:block;width:100%;height:100%}.cl74{background:linear-gradient(135deg,#4c1d95,#7c3aed 50%,#2e1065)}.cl75{background:linear-gradient(135deg,#44403c,#78716c 50%,#292524)}.cl47,.cl48{overflow:hidden}.cl48{float:left;width:48%;margin-right:4%;margin-bottom:2rem;background:#161b22;border-radius:1.042rem}.cl62{margin-right:0}.cl49{position:relative;height:11rem;background:linear-gradient(135deg,#08111f,#0f2040 40%,#0a1a30);overflow:hidden}.cl49 svg{right:-1.5rem;bottom:-1.5rem;width:10rem;height:10rem;opacity:.06}.cl49 svg,.cl50{position:absolute}.cl50{display:inline-block;background:rgba(255,80,92,.12);border:1px solid rgba(255,80,92,.3);color:#ff505c;font-size:.729rem;font-weight:600;padding:.35rem .833rem;border-radius:2rem;bottom:.833rem;left:.833rem;white-space:nowrap}.cl71{background:rgba(52,211,153,.12);border-color:rgba(52,211,153,.3);color:#34d399}.cl51{padding:1.25rem}.cl52{font-size:1.1rem;font-weight:700;color:#fff;line-height:1.4}.cl52,.cl53{margin-bottom:.833rem}.cl53{display:table}.cl54,.cl55{display:table-cell;vertical-align:middle}.cl54 span{display:block;width:2rem;height:2rem;border-radius:50%;background:#0d3971;font-size:.583rem;font-weight:700;color:#fff;text-align:center;line-height:2rem}.cl55{padding-left:.625rem}.cl55 b{display:block;font-size:.833rem;color:#fff;font-weight:600}.cl55 s{font-size:.729rem;color:hsla(0,0%,100%,.45);font-weight:400;text-decoration:none}.cl56{font-size:.833rem;color:hsla(0,0%,100%,.5);line-height:1.6}.cl56,.cl57{margin-bottom:1rem}.cl57{font-size:0}.cl58{display:inline-block;padding:.25rem .583rem;border-radius:.375rem;font-size:.625rem;font-weight:700;margin-right:.375rem}.cl63{background:rgba(255,80,92,.15);color:#ff505c}.cl64{background:rgba(52,211,153,.15);color:#34d399}.cl65{background:rgba(96,165,250,.15);color:#60a5fa}.cl66{background:rgba(167,139,250,.15);color:#a78bfa}.cl59{font-size:0}.cl60,.cl61{display:inline-block;font-size:.729rem;font-weight:600;padding:.5rem 1.042rem;border-radius:.5rem;cursor:pointer;text-decoration:none;zoom:1;margin-right:.5rem}.cl60{color:#fff;background:#0d3971}.cl60:hover{opacity:.85;filter:alpha(opacity=85)}.cl61{color:hsla(0,0%,100%,.7);background:hsla(0,0%,100%,.07)}.cl61:hover{background:hsla(0,0%,100%,.12)}.cl67{margin-top:2rem;padding-bottom:1rem;font-size:0}.cl67,.cl68{text-align:center}.cl68{display:inline-block;vertical-align:middle;width:2.083rem;height:2.083rem;line-height:2.083rem;border-radius:.5rem;font-size:.875rem;font-weight:600;color:hsla(0,0%,100%,.5);cursor:pointer;text-decoration:none;margin:0 .15rem;background:hsla(0,0%,100%,.05);zoom:1}.cl68:hover{background:hsla(0,0%,100%,.1);color:#fff}.cl69{background:#0d3971!important;color:#fff!important}.cl70{color:hsla(0,0%,100%,.2);cursor:default}@media screen and (max-width:999px){html{font-size:14px}body{padding-bottom:96px}.cl1{padding:12px 16px;max-width:100%;margin:0;position:relative;z-index:0}.cl1:before{content:"";position:absolute;left:0;right:0;top:0;height:62px;background:#161b22;z-index:-1}.cl2{width:auto;line-height:40px;padding-right:12px;border-radius:0}.cl2,.cl6{height:40px}.cl6{margin:0 8px 0 0}.cl7{font-size:15px;letter-spacing:.1em}.cl4{font-size:14px;line-height:1;padding:12px 18px 12px 16px;margin-left:0;border-radius:14px}.cl4 svg{width:16px;height:16px;margin-right:8px}#idt1,.cl5{display:none}.cl8{display:block;padding-top:24px}.cl9{display:none}.cl16{display:block;width:100%}.cl17{min-height:0}.cl18{display:none}.cl19{font-size:12px;margin-bottom:8px}.cl20{font-size:24px;line-height:1.3;margin-bottom:14px}.cl22{font-size:13px}.cl26{padding:20px;margin-top:16px;border-radius:16px}.cl27,.cl28{float:none;width:100%;min-height:0}.cl27{margin-right:0;margin-bottom:20px}.cl28{padding:16px}.cl29{font-size:18px;line-height:1.4}.cl29,.cl30{margin-bottom:12px}.cl30{font-size:13px}.cl31{display:block;width:100%;text-align:center;font-size:16px;padding:14px 16px;border-radius:10px}.cl32{width:20px;height:20px}.cl33{font-size:13px}.cl34{margin-top:14px}.cl34,.cl35{font-size:12px}.cl28 .cl30{margin-bottom:0}.cl48,.cl62{float:none;width:100%;margin-right:0}.cl49{height:9rem}.cl37{display:block;margin-top:24px;padding-bottom:20px}.cl37 .cl24{font-size:13px;line-height:1.4;margin-bottom:6px;text-align:center;color:hsla(0,0%,100%,.6)}.cl37 .cl25{font-size:36px;line-height:1.2;color:#fff;text-align:center}.cl45{background:rgba(255,80,92,.1);border-radius:12px;padding:14px 20px;font-size:16px;font-weight:700;color:#ff505c;text-align:center;margin-top:16px}.cl38,.cl45{display:block}.cl38{position:fixed;bottom:12px;left:8px;right:8px;background:#1c2333;border-radius:24px;overflow:hidden;z-index:999;zoom:1}.cl39{display:table;width:100%;height:52px;table-layout:fixed}.cl40{display:table-cell;text-align:center;vertical-align:middle;color:hsla(0,0%,100%,.4);cursor:pointer;text-decoration:none;zoom:1}.cl41{display:inline}.cl42{background:#fff;color:#161b22}.cl43{display:inline-block;vertical-align:middle;width:22px;height:22px}.cl44{display:none}}</style><div class="cl1"><div class="cl3"><div id="idt1">75E20C</div><div class="cl4"><svg viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M6 8H15V6C15 5.16667 14.7083 4.45833 14.125 3.875C13.5417 3.29167 12.8333 3 12 3C11.1667 3 10.4583 3.29167 9.875 3.875C9.29167 4.45833 9 5.16667 9 6H7C7 4.61667 7.4875 3.4375 8.4625 2.4625C9.4375 1.4875 10.6167 1 12 1C13.3833 1 14.5625 1.4875 15.5375 2.4625C16.5125 3.4375 17 4.61667 17 6V8H18C18.55 8 19.0208 8.19583 19.4125 8.5875C19.8042 8.97917 20 9.45 20 10V20C20 20.55 19.8042 21.0208 19.4125 21.4125C19.0208 21.8042 18.55 22 18 22H6C5.45 22 4.97917 21.8042 4.5875 21.4125C4.19583 21.0208 4 20.55 4 20V10C4 9.45 4.19583 8.97917 4.5875 8.5875C4.97917 8.19583 5.45 8 6 8ZM13.4125 16.4125C13.8042 16.0208 14 15.55 14 15C14 14.45 13.8042 13.9792 13.4125 13.5875C13.0208 13.1958 12.55 13 12 13C11.45 13 10.9792 13.1958 10.5875 13.5875C10.1958 13.9792 10 14.45 10 15C10 15.55 10.1958 16.0208 10.5875 16.4125C10.9792 16.8042 11.45 17 12 17C12.55 17 13.0208 16.8042 13.4125 16.4125Z" fill="white"/></svg> Decrypt Now</div></div><div class="cl2"><img class="cl6" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAMAAACdt4HsAAAAAXNSR0IArs4c6QAAAAlwSFlzAAAOwgAADsIBFShKgAAAADxQTFRFCzlx////+Pn77e/z4+bs2NzkzNHbvcLNrbPCm6S3iZSsdoWhZneYWGuQRFqEKEh6ADNvACdrABpoAANjIKiOLQAAA75JREFUeNrtl91uIzsIgAHb+B8Dfv93PTvppMmqk26r6tys9rsZRxGfGIxxAv/421G17Xu7qcL3UfclLedc2hDY9j2Hms/KkYgQ6RepdPBvKEw736LGFBmjlYiY2pcV5iNhrHPUnBhmTLnWGBBjs68ozDpTaFIiIWIEITwIqUXkDv4nh09GLFID3mA9BUhlFcJUinxqsBow9JHwhH1FPImjR8TQDV6jK2KclfBO3pDwDlVJSJ8KvGCUlfBJYIzvsELC7PASmxSm2HrElO358UF1zBDEXgsy9hrmXu9B1ff7utiuVDvmlwIblDthFPeCbzTb5zJU252QesHucI3nIBEReZk3ukUNs7dVHNtmPBaTEuiLCoRW8YBBvQdMdfneLjVhmm7nhhbG5p8lcJBdfTbfs+Zc54YmpvfShhHS5flWoVIfxQPbnelYE4+tYI/CFux22QM0E55Q85UJqYqU42Fe8E6al72gkNIkvNN2PjRSyuqEWPdDQDOFpRclxNzwTtJDxpYQ2fnWxfEhLzjtqglqfurAY52FEEmOJT+lkCtdCLxR50eWKxwaCURBjtAIg/CEO42Pgl1wcIiJc6lt6CBEBpBfwOJDabO3kjOnmCe1iwwyzrWW2t5uZp1uZ9nWMrjVs5uZ771Nbxu+P05xRlkiS31v91OgK8alp+CINxCZUw73hwwqDcYQOR/voPMuSPAmmNpqyZwCUZpXAuvUnoqo8RCAMzscgqid8CT1S8H8bRu9HAKFXN4yqPvxZarU/POjgKFKxLwPfO+MCSQ87JeNBMY86amTOoVyEmg8JYCDw9I/HKbQzXt40tkjuyiB/XKgYa2Pwwi2JYebLHc1tfJua1j9+k6I9xetG7wV2NJr7WvPOkCBT/lkFIULvGIr5/xVb4SxTHPXWQLScDvPY+4Yl8KrFG5DVe1MmMZ9vMbpNo/8wkzYDC7xhrUj8vKVP471vvfhqu2Tu8kSzRxlC19cLFTXrphmoGEvBZ2iiI/4tH9PDRBlt5GQDV6hXgPrCM+Xqz8EyOCM2BxeorMhy3OI/XY7L0ZMsF7HS181RKn024V+QkUYCSlPhZestYVjfZ+OCVa8u0YLyKPygNcsWGCaMfSS3tp4rduTuM+MVMBsKbxGQAHUWiTOreVIQSRQ5DpHJuTpCiDwCafcV42Iuc85AeacoyakPMxAVabCn1GHngNRTMwcCTGW6QawZH3j17K0zBExMOe2tgGAjqHwddS2nYPeFPR8x2+iB8dzCfwIlQI/46cZgOq/v4D/H/8BgwM0d+Tht8QAAAAASUVORK5CYII=" alt=""><span class="cl7 font">DEADLOCK</span></div><div class="cl46"></div><div class="cl5"></div><div class="cl8" id="idt2"><div class="cl9"><div class="cl11"><div class="cl12 cl13 font"><span class="cl14"><svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" width="18" height="18"><path d="M10 20v-6h4v6h5v-8h3L12 3 2 12h3v8z" fill="currentColor"/></svg> </span>About<span class="cl15">›</span></div><div class="cl12 font"><span class="cl14"><svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" width="18" height="18"><path d="M20 2H4C2.9 2 2 2.9 2 4v18l4-4h14c1.1 0 2-.9 2-2V4c0-1.1-.9-2-2-2z" fill="currentColor"/></svg> </span>Chat<span class="cl15">›</span></div><div class="cl12 font"><span class="cl14"><svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" width="18" height="18"><path d="M14 2H6a2 2 0 0 0-2 2v16c0 1.1.9 2 2 2h12a2 2 0 0 0 2-2V8l-6-6zm-1 1.5L18.5 9H13V3.5zM8 17h8v2H8v-2zm0-4h8v2H8v-2zm0-4h5v2H8V9z" fill="currentColor"/></svg> </span>Blog<span class="cl15">›</span></div></div><div class="cl10"></div><div class="cl23"><p class="cl24">Time you have to contact us:<div class="cl25" id="idt3">23h 59m 59s</div></div></div><div class="cl16"><div id="idt5"><div class="cl17"><div class="cl18"><svg viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><defs><linearGradient id="idt4" x1="0.717" y1="0.049" x2="0.283" y2="0.951" gradientUnits="objectBoundingBox"><stop offset="0%" stop-color="#FFFFFF" stop-opacity="1"/><stop offset="100%" stop-color="#FFFFFF" stop-opacity="0"/></linearGradient></defs><path d="M6 8H15V6C15 5.16667 14.7083 4.45833 14.125 3.875C13.5417 3.29167 12.8333 3 12 3C11.1667 3 10.4583 3.29167 9.875 3.875C9.29167 4.45833 9 5.16667 9 6H7C7 4.61667 7.4875 3.4375 8.4625 2.4625C9.4375 1.4875 10.6167 1 12 1C13.3833 1 14.5625 1.4875 15.5375 2.4625C16.5125 3.4375 17 4.61667 17 6V8H18C18.55 8 19.0208 8.19583 19.4125 8.5875C19.8042 8.97917 20 9.45 20 10V20C20 20.55 19.8042 21.0208 19.4125 21.4125C19.0208 21.8042 18.55 22 18 22H6C5.45 22 4.97917 21.8042 4.5875 21.4125C4.19583 21.0208 4 20.55 4 20V10C4 9.45 4.19583 8.97917 4.5875 8.5875C4.97917 8.19583 5.45 8 6 8ZM13.4125 16.4125C13.8042 16.0208 14 15.55 14 15C14 14.45 13.8042 13.9792 13.4125 13.5875C13.0208 13.1958 12.55 13 12 13C11.45 13 10.9792 13.1958 10.5875 13.5875C10.1958 13.9792 10 14.45 10 15C10 15.55 10.1958 16.0208 10.5875 16.4125C10.9792 16.8042 11.45 17 12 17C12.55 17 13.0208 16.8042 13.4125 16.4125Z" fill="url(#idt4)"/></svg></div><p class="cl19 font">What Happens?<h1 class="cl20 font">All your important files<br>are <span class="cl21">ENCRYPTED</span> and <span class="cl21">STOLEN!</span></h1><p class="cl22">Your Important Files Have Been Encrypted By DeadLock Using Military-Grade Encryption. This Includes All Documents, Photos, Videos, Databases, And Other Critical Data. You Cannot Access Them Without Our Decryption Key. Only One Way To Get Your Files Back Is Contact With Us</div><div class="cl26"><div class="cl27"><div class="cl29 font">Contact us to get decrypt key<br>and fast decrypt soft</div><p class="cl30">
Extracted
Path
-
C:\HOW_RECOVER.75E20C.txt
Ransom Note
- # Your personal ID: 75E20C # Your company's network is attacked and the entire system is encrypted. # We have downloaded all the company's confidential data. # If you want your data fully decrypted and the files we stole removed from our source, you will have to pay a fee. # We will also be able to provide a security report and explain how we did it to get in. # Our blog: https://dlock.liveblog365.com/ http://deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd.onion/ # There is only one way to get your files back: 1. Contact us, open RECOVERY_CHAT.75E20C.HTML via your browser or download Session messenger https://getsession.org/ 2. Our contacts (Session id: 05b0c8da191a5b3c41105fa034a31784c6d595c49655f232e10e06277ee145c07c) 3. Send us 2-3 any encrypted your files and your personal ID 75E20C 4. We will decrypt few file for test (maximum file size - 5 MB), its guarantee what we can decrypt your files 5. Pay 6. We send for you decryptor software # After payment you will receive. 1. Decryption tool for all devices 2. Complete list of files taken from the network. 3. Proof that all your data has been deleted. 4. Information about how we got into the network. 5. Security recommendations to stop future attacks. 6. Promise that we will not attack you again in the future. 7. Guarantee that we will forget about this incident. # Read about us https://www.binance.com/en/square/post/35127800790697 https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/ https://www.ransomware.live/group/Deadlock https://www.ransomlook.io/group/deadlock # We accept Bitcoin/Monero # Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Contact information: 05b0c8da191a5b3c41105fa034a31784c6d595c49655f232e10e06277ee145c07c
URLs
-
https://dlock.liveblog365.com/
-
http://deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd.onion/
-
https://getsession.org/
-
https://www.binance.com/en/square/post/35127800790697
-
https://www.microsoft.com/en-us/security/blog/2026/08/10/deadlock-ransomware-breaking-down-a-rust-based-encryptor-with-decentralized-recovery-infrastructure/
-
https://www.ransomware.live/group/Deadlock
-
https://www.ransomlook.io/group/deadlock
Targets
-
- Target 2026-08-31_1cc8841a07cf22a53627b72f94b1a055_akira_elex
- Size 354KB
- SHA256 5454b1a9aa147b4cce277f814d5e5281e122ef14e702ba0f33990789b888fcd6
Score10/10-
Renames multiple (5980) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry