Ransom Note: ReadMe.html
Group: Jaff
<html>
<head>
<meta content="text/html; charset=UTF-8"
http-equiv="content-type">
<title>jaff
decryptor system</title>
</head>
<body
style="background-color: rgb(102, 204, 204); color: rgb(0, 0, 0);"
alink="#ee0000" link="#0000ee" vlink="#551a8b">
<div style="position: absolute; top:0; text-align:center; width:100%" >
<h1 style="font-family: System; color: rgb(102, 102, 102);"><big>jaff
decryptor system</big></h1>
</div>
<style>
.center {
width: 1000px;
padding: 10px;
margin: auto;
background: #fc0;
}
</style>
<div style="position: absolute; top:15%; left: 30%;" >
<p
style="border: 3px solid rgb(255, 255, 10); padding: 10px; background-color: rgb(223, 213, 209); text-align: left;"><big><big>Files
are encrypted!</big></big><br>
<br>
<big><big>To decrypt flies you need to obtain the private
key.<br>
The only copy of the private key, which will allow you to decrypt your
files, is located on a secret server
in the Internet<br>
<br>
</big></big>❶<big><big>
You must install Tor Browser:
https://www.torproject.org/download/download-easy.html.en<br>
<br>
</big></big>❷<big><big>
After instalation, run the Tor Browser and enter address:
http://rktazuzi7hbln7sy.onion/<br>
<br>
Follow the instruction on the web-site.</big></big><br>
</p>
<br>
<br>
<center><h1><big>Your decrypt ID: [snip]</big></h1></center>
</div>
</div>
</body>
</html>
Indicators of Compromise
| Type | IOC |
|---|---|
onion url
|
http://rktazuzi7hbln7sy.onion/<br> |
