Ransom Notes:

---

-- Qilin 



Your network/system was encrypted. 

Encrypted files have new extension. 



-- Compromising and sensitive data 



We have downloaded compromising and sensitive data from you system/network 

If you refuse to communicate with us and we do not come to an agreement, your data will be published. 

Data includes: 

- Employees personal data, CVs, DL , SSN. 

- Complete network map including credentials for local and remote services. 

- Financial information including clients data, bills, budgets, annual reports, bank statements. 

- Complete datagrams/schemas/drawings for manufacturing in solidworks format 

- And more... 



-- Warning 



1) If you modify files - our decrypt software won't able to recover data 

2) If you use third party software - you can damage/modify files (see item 1) 

3) You need cipher key / our decrypt software to restore you files. 

4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. 



-- Recovery 



1) Download tor browser: https://www.torproject.org/download/ 

2) Go to domain 

3) Enter credentials-- Credentials 

Extension: [snip] 
Domain: e3v6tjarcltwc4hdkn6fxnpkzq42ul7swf5cfqw6jzvic4577vxsxhid.onion 
login: [snip] 
password:[snip]

---

Indicators of Compromise

Type	IOC
onion url	http://e3v6tjarcltwc4hdkn6fxnpkzq42ul7swf5cfqw6jzvic4577vxsxhid.onion