Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Ransom Notes:

IOC

 Hi, I'am CRBR ENCRYPTOR ;)
 
 -----
 
 ALL YOUR DOCUMENTS, PHOTOS, DATABASES AND OTHER IMP0RTANT FILES HAVE BEEN ENCRYPTED!
 
 -----
 
 The only one way to decrypt your files is to receive the private key and decryption program.
 
 To receive the private key and decryption program go to any decrypted folder, 
 inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions 
 how to decrypt your files.
 
 If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below:
 
 -----
 
 1. Download "Tor Browser" from https://www.torproject.org/ and install it.
 
 2. In the "Tor Browser" open your personal page here:
 
 http://oqwygprskqv65j72.onion/[snip]
 
 Note! This page is available via "Tor Browser" only.
 
 -----
 
 Also you can use temporary addresses on your personal page without using "Tor Browser".
 
 -----
 
 1. http://oqwygprskqv65j72.1hbdbx.top/[snip]
 
 2. http://oqwygprskqv65j72.13gpqd.top/[snip]
 
 3. http://oqwygprskqv65j72.1jitcy.top/[snip]
 
 4. http://oqwygprskqv65j72.1jfniy.top/[snip]
 
 5. http://oqwygprskqv65j72.1ldyev.top/[snip]
 
 -----
 
 Note! These are temporary addresses! They will be available for a limited amount of time!
 
 -----

Indicators of Compromise
Type IOC
onion url http://oqwygprskqv65j72.onion/[snip]