Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Ransom Notes:

IOC


	██████╗ ██╗      █████╗  ██████╗██╗  ██╗██████╗ ██╗   ██╗████████╗███████╗    ███╗   ██╗████████╗
	██╔══██╗██║     ██╔══██╗██╔════╝██║ ██╔╝██╔══██╗╚██╗ ██╔╝╚══██╔══╝██╔════╝    ████╗  ██║╚══██╔══╝
	██████╔╝██║     ███████║██║     █████╔╝ ██████╔╝ ╚████╔╝    ██║   █████╗      ██╔██╗ ██║   ██║   
	██╔══██╗██║     ██╔══██║██║     ██╔═██╗ ██╔══██╗  ╚██╔╝     ██║   ██╔══╝      ██║╚██╗██║   ██║   
	██████╔╝███████╗██║  ██║╚██████╗██║  ██╗██████╔╝   ██║      ██║   ███████╗    ██║ ╚████║   ██║   
	╚═════╝ ╚══════╝╚═╝  ╚═╝ ╚═════╝╚═╝  ╚═╝╚═════╝    ╚═╝      ╚═╝   ╚══════╝    ╚═╝  ╚═══╝   ╚═╝   
																									 

 +-----------------------------------------------------------------------------+
 | All your files have been encrypted, your confidential data has been stolen, |
 | in order to decrypt files and avoid leakage, you must follow our steps.     |
 +-----------------------------------------------------------------------------+

 +------------------------------------------------------------------------------------------------------------------------------------+
 | 1) Download and install TOR Browser from this site: https://torproject.org/                                                        |
 |                                                                                                                                    |
 | 2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need.                         |
 |                                                                                                                                    |
 | 3) If you read this message thats means your files already for sell in our Auction.                                                |
 |    Everyday of delaying will cause higer price. after 4 days if you wont connect us,                                               |
 |    We will remove your chat access and you will lose your chance to get decrypted.                                                 |
 |                                                                                                                                    |
 +------------------------------------------------------------------------------------------------------------------------------------+

 +---------------------------------------------------------------------------------------------------+
 | Warning! Communication with us occurs only through this link, or through our mail on our Auction. |
 | We also strongly DO NOT recommend using third-party tools to decrypt files,                       |
 | as this will simply kill them completely without the possibility of recovery.                     |
 | I repeat, in this case, no one can help you!                                                      |
 +---------------------------------------------------------------------------------------------------+


 Your URL: http://a2dbso6dijaqsmut36r6y4nps4cwivmfog5bpzf6uojovce6f3gl36id.onion:81/[snip]

 Your Key to access the chat: [snip]

 Find our Auction here (TOR Browser): http://jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion/

Indicators of Compromise
Type IOC
onion url http://a2dbso6dijaqsmut36r6y4nps4cwivmfog5bpzf6uojovce6f3gl36id.onion
onion url http://jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion/