Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Ransom Notes:

IOC

Your files was encrypted by "Money message" profitable organization  and can't be accessed anymore.

If you pay ransom, you will get a decryptor to decrypt them. Don't try to decrypt files yourself - in that case they will be damaged and unrecoverable.

For further negotiations open this clientcuworpelkdwecucgvfhp5uz5n7uohsnokndrlhm2zkntyg3had.onion/chat.php?chatId=[snip]
using tor browser https://www.torproject.org/download/

In case you refuse to pay, we will post the files we stole from your internal network, in our blog:

blogvl7tjyjvsfthobttze52w36wwiz34hrfcmorgvdzb6hikucb7aqd.onion

Encrypted files can't be decrypted without our decryption software.

Indicators of Compromise
Type IOC
onion url http://blogvl7tjyjvsfthobttze52w36wwiz34hrfcmorgvdzb6hikucb7aqd.onion
onion url http://clientcuworpelkdwecucgvfhp5uz5n7uohsnokndrlhm2zkntyg3had.onion