Xorist-Frozen Ransomware
(шифровальщик-вымогатель)
Как удалить? Как расшифровать? Как вернуть данные?
По ссылке выберите Управление "К" МВД России и подайте онлайн-заявление.
См. также статьи УК РФ:
ст. 159.6 "Мошенничество в сфере компьютерной информации"
ст. 272 "Неправомерный доступ к компьютерной информации"
ст. 273 "Создание, использование и распространение вредоносных компьютерных программ"
Информация о шифровальщике
Этот крипто-вымогатель шифрует данные серверов с помощью XOR, а затем требует выкуп в 0.5 BTC, чтобы вернуть файлы. Оригинальное название. На файле написано.
© Генеалогия: Xorist >> Xorist-Frozen
Изображение — логотип статьи
Активность этого крипто-вымогателя пришлась на начало февраля 2018 г. Ориентирован на англоязычных пользователей, что не мешает распространять его по всему миру.
Записка с требованием выкупа называется: HOW TO DECRYPT FILES.txt
Содержание записки о выкупе:
All your important files were FROZEN on this computer.
Encrtyption was produced using unique KEY generated for this computer.
To decrypted files, you need to otbtain private key.
The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet;
The server will destroy the key within 36 hours after encryption completed.
REMEMBER YOU HAVE ONLY 24 HOURS TO PAY EVERITHING IS AUTOMATICALLY!
To retrieve the private key, you need to pay 0.5 bitcoins
Bitcoins have to be sent to this address: 3N8FxD8y3AKKPZaUBuypw55YYSswmECPxh
After you've sent the payment send us an email to : frozen_service_security@scryptmail.com with subject : ERROR-ID-63100888(0.5BTC)
If you are not familiar with bitcoin you can buy it from here :
SITE : www.localbitcoin.com
After we confirm the payment , we send the private key so you can decrypt your system.
Перевод записки на русский язык:
Все ваши важные файлы были ЗАМОРОЖЕНЫ на этом компьютере.
Шифрование сделано с уникального КЛЮЧОМ, созданным для этого компьютера.
Для дешифрования файлов вам нужно получить закрытый ключ.
Единственная копия закрытого ключа, позволяющая расшифровать файлы, находится на секретном сервере в Интернете;
Сервер уничтожит ключ через 36 часов после завершения шифрования.
ПОМНИТЕ, ЧТО ЕСТЬ ТОЛЬКО 24 ЧАСА ДЛЯ АВТОМАТИЧЕСКОЙ ОПЛАТЫ!
Для получения закрытого ключа вам надо заплатить 0,5 биткоина
Биткоины надо отправить по этому адресу: 3N8FxD8y3AKKPZaUBuypw55YYSswmECPxh
После отправки платежа пришлите нам письмо по адресу: frozen_service_security@scryptmail.com с темой: ERROR-ID-63100888(0.5BTC)
Если вы не знакомы с биткоинами, вы можете купить его здесь:
САЙТ: www.localbitcoin.com
После подтверждения платежа мы отправим секретный ключ, чтобы вы могли расшифровать свою систему.
Технические детали
Может распространяться путём взлома через незащищенную конфигурацию RDP, с помощью email-спама и вредоносных вложений, обманных загрузок, эксплойтов, веб-инжектов, фальшивых обновлений, перепакованных и заражённых инсталляторов. См. также "Основные способы распространения криптовымогателей" на вводной странице блога.
!!! Если вы пренебрегаете комплексной антивирусной защитой класса Internet Security или Total Security, то хотя бы делайте резервное копирование важных файлов по методу 3-2-1.
Список файловых расширений, подвергающихся шифрованию:
Это документы MS Office, OpenOffice, PDF, текстовые файлы, базы данных, фотографии, музыка, видео, файлы образов, архивы и пр.
Файлы, связанные с этим Ransomware:
HOW TO DECRYPT FILES.txt
<random>.exe
Расположения:
\Desktop\ ->
\User_folders\ ->
Записи реестра, связанные с этим Ransomware:
См. ниже результаты анализов.
Сетевые подключения и связи:
BTC: 3N8FxD8y3AKKPZaUBuypw55YYSswmECPxh
Email: frozen_service_security@scryptmail.com
См. ниже результаты анализов.
Результаты анализов:
Гибридный анализ >>
VirusTotal анализ >>
Другой анализ >>
Степень распространённости: средняя.
Подробные сведения собираются регулярно.
=== ИСТОРИЯ СЕМЕЙСТВА === HISTORY OF FAMILY ===
Xorist Ransomware - март 2016
Xorist-EnCiPhErEd Ransomware - май 2016
Xorist-FakeRSA - февраль 2017
Xorist-Zixer2 Ransomware - апрель 2017
Xorist-RuSVon Ransomware - июль 2017
Xorist-Hello Ransomware - август 2017
Xorist-CerBerSysLock Ransomware - декабрь 2017
Xorist-XWZ Ransomware - март 2018
Xorist-XWZ Ransomware - март 2018
Xorist-Frozen Ransomware - февраль - июль 2018
=== БЛОК ОБНОВЛЕНИЙ === BLOCK OF UPDATES ===
Обновление от 14 марта 2018:
Сумма выкупа: 7 BTC
BTC: 33JCALvTgh7CmEDWQjuvkquH4GVEbA56oG
Email: Payment_Confirmation@scryptmail.com
Содержание записки о выкупе:
All your important files were blocked on this computer.
Encrtyption was produced using unique key generated for this computer.
To decrypted files, you need to otbtain private key.
The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet;
The server will destroy the key within 36 hours after encryption completed.
REMEMBER YOU HAVE ONLY 24 HOURS TO PAY EVERITHING IS AUTOMATICALLY!
To retrieve the private key, you need to pay 7 (BTC)
Bitcoins have to be sent to this address: 33JCALvTgh7CmEDWQjuvkquH4GVEbA56oG
After you've sent the payment send us an email to : Payment_Confirmation@scryptmail.com with subject : ERROR-ID-631009091(7-BTC)
If you are not familiar with bitcoin you can buy it from here :
SITE : www.localbitcoin.com
After we confirm the payment , we send the private key so you can decrypt your system.
Топик на форуме >>
Пост в Твиттере >>
Статья на MTA >>
Расширение: .PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment
Записка: HOW TO DECRYPT FILES.txt
Информатором жертвы также выступает диалоговое окно с тем же текстом.
Email: Email_Decryptor_Payment@scryptmail.com
BTC: 3J1MD7EAzdaYewBDA71t7NShkc64w4a41T
Сумма выкупа: 700 евро или 0.7 BTC в другом варианте
Содержание записки о выкупе:
All your important files were BLOCKED on this computer.
Encrtyption was produced using unique KEY generated for this computer.
To decrypted files, you need to otbtain private key.
The single copy of trie private key, with will allow you to decrypt the files, is locate on a secret server on the internet;
The server will destroy the key within 24 hours after encryption completed.
REMEMBER YOU HAVE ONLY 24 HOURS TO PAY EVERITHING IS AUTOMATICALLY!
To retrieve the private key, you need to pay 700-EURO
PLEASE BE REZONABLE PAYMENT IS LITTLE ONLY 700 EURO
WE ACCEPT ONLY PAYMENT TO BITCOIN!
Bitcoins have to be sent to this address: 3J1MD7EAzdaYeWBDA71t7NShkC64W4a41T
After you've sent the payment send us an email to : Email_Decryptor_Payment@scryptmail.com with subject : ERROR-ID-6212510
If you are not familiar with bitcoin you can buy it from here :
SITE : www.localbitcoin.com
After we confirm the payment , we send the private key so you can decrypt your system.
***
➤ Другой вариант записки:
All your important files were BLOCKED on this computer.
Encrtyption was produced using unique KEY generated for this computer.
To decrypted files, you need to otbtain private key.
The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet;
The server will destroy the key within 24 hours after encryption completed.
REMEMBER YOU HAVE ONLY 24 HOURS TO PAY EVERITHING IS AUTOMATICALLY!
To retrieve the private key, you need to pay 0.7 BTC
Bitcoins have to be sent to this address: 3J1MD7EAzdaYeWBDA71t7NShkC64W4a41T
After you've sent the payment send us an email to : Email_Decryptor_Payment@scryptmail.com with subject : ERROR-ID-63100606(0.7BTC)
If you are not familiar with bitcoin you can buy it from here :
SITE : www.localbitcoin.com
If you try to use third party for help we will delete all your files
After we confirm the payment , we send the private key so you can decrypt your system.
Результаты анализов:
VT + VT + VT
Обновление от 13 июня 2018:
Пост в Твиттере >>
Расширение: ....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_YOU_NEED_TO_PURCHASE_THE_DECRYPTOR_FROM_US_FAST_AND_URGENT
Email: repair_data@scryptmail.com
Сумма выкупа: 0.8 BTC
BTC-wallet: 3KxEZKjS4ifAHhX2o1fq9tERkAshSgA4hg
Файл: worker.exe
Скриншоты записки и изображения с email вымогателей
➤ Содержание записки:
YOUR SYSTEM IS LOCKED AND ALL YOUR IMPORTANT DATA HAS BEEN ENCRYPTED.
DON'T WORRY YOUR FILES ARE SAFE.
TO RETURN ALL TO NORMALLY YOU MUST BUY THE CERBER DECRYPTOR PROGRAM.
PAYMENTS ARE ACCEPTED ONLY THROUGH THE BITCOIN NETWORK.
YOU CAN GET THEM VIA ATM MACHINE OR ONLINE
https://coinatmradar.com/ (find a ATM)
https://www.localbitcoins.com/ (buy instantly online any country)
THE PRICE FOR DECRYPTOR SOFTWARE IS 0.8 BTC
BTC ADRESS : 3KxEZKjS4ifAHhX2o1fq9tERkAshSgA4hg (where you need to make the payment)
VERRY IMPORTANT !
DO NOT TRY TO SCAN WITH ANTIVIRUS YOU RISK LOSING YOUR DATA .
ANTIVIRUSES ONLY DESTROY THE ENCRYPTED DATA , THEY DO NOT KNOW THE ALGORITH WITH WICH THE ENTIRE SYSTEM WAS ENCRYPTED.
THE ONLY WAY TO DECRYPT YOUR SYSTEM AND RETURN TO NORMAL IS TO BUY THE ORIGINAL DECRYPTOR SOFTWARE.
For more information : repair_data@scryptmail.com (24/7)
Subject : SYSTEM-LOCKED-ID: 10191xxx
Результаты анализов: HA + VT + Malshare
Пример топика на форуме >>
Обновление от 25 июня 2018:
Расширение: .PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment
Вторая часть расширения на картинке: id-F25E5DE4.[Worldcry@cock.li] - от шифровальщика Dharma
Записка: HOW TO DECRYPT FILES.txt
➤ Содержание записки:
All your important files were BLOCKED on this computer.
Encrtyption was produced using unique KEY generated for this computer.
To decrypted files, you need to otbtain private key.
The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet;
The server will destroy the key within 24 hours after encryption completed.
REMEMBER YOU HAVE ONLY 24 HOURS TO PAY EVERITHING IS AUTOMATICALLY!
To retrieve the private key, you need to pay 0.7 BTC
Bitcoins have to be sent to this address: 3J1MD7EAzdaYeWBDA71t7NShkC64W4a41T
After you've sent the payment send us an email to : Email_Decryptor_Payment@scryptmail.com with subject : ERROR-ID-63100606(0.7BTC)
If you are not familiar with bitcoin you can buy it from here :
SITE : www.localbitcoin.com
If you try to use third party for help we will delete all your files
After we confirm the payment , we send the private key so you can decrypt your system.
➤ Записи в реестре:
HKEY_CLASSES_ROOT\....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment
HKEY_CLASSES_ROOT\CUJVMVYCURZLZNO
HKEY_CLASSES_ROOT\CUJVMVYCURZLZNO\DefaultIcon
HKEY_CLASSES_ROOT\CUJVMVYCURZLZNO\shell\open\command
Топик на форуме >>
Результаты анализов: VT + HA + VMRay + JSA
Обновление от 26 июня 2018:
Расширение:
....FILES_ARE_SAFE_THE_SIGNLE_AND_UNIQ_WAY_TO_RECOVER_YOUR_FILES_IS_TO_BUY_THE_CERBER_DECRYPTOR_PROGRAM_YOU_NEED_TO_MAKE_THE_PAYMENT_IN_MAXIM_24_HOUR_OR_ALL_YOUR_FILES_WILL_BE_LOST_FORVER_PLEASE_BE_REZONABLE_AND_MAKE_THE_PAYMENT_URGENTLY
Топик на форуме >>
Обновление от 5 июля 2018:
Расширение:
.NEED-TO-MAKE-PAYMENT-OR-ALL-YOUR-FILLES-WILL-BE-DELETED-CRITICAL-SITUATION-URGENT-ATTENTION-24-HOURS-TO-PAY-OR-EVERYTHING-WILL-BE-PERMANENTLY-DELETED-FOREVER
Записка: HOW TO DECRYPT FILES.txt
Email: Payment_Confirmation@scryptmail.com
BTC: 33JCALvTgh7CmEDWQjuvkquH4GVEbA56oG
➤ Содержание записки:
All your important files were FROZEN on this computer.
Encrtyption was produced using unique KEY generated for this computer.
To decrypted files, you need to otbtain private key.
The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet;
The server will destroy the key within 36 hours after encryption completed.
REMEMBER YOU HAVE ONLY 24 HOURS TO PAY EVERITHING IS AUTOMATICALLY!
To retrieve the private key, you need to pay 7 (BTC)
Bitcoins have to be sent to this address: 33JCALvTgh7CmEDWQjuvkquH4GVEbA56oG
After you've sent the payment send us an email to : Payment_Confirmation@scryptmail.com with subject : ERROR-ID-631009091(7-BTC)
If you are not familiar with bitcoin you can buy it from here :
SITE : www.localbitcoin.com
After we confirm the payment , we send the private key so you can decrypt your system.
Красным помечена слова с ошибками.
Результаты анализов: VT + AR
Обновление от 8 июля 2018:
Пост в Твиттере >>
Расширение: ...DATA_IS_SAFE_YOU_NEED_TO_MAKE_THE_PAYMENT_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_LOST_FOREVER_PLEASE_BE_REZONABLE_IS_NOT_A_JOKE_TIME_IS_LIMITED
Email: FSA2018@scryptmail.com
BTC: 3HtA9MAZGh3m6NAtRc6fQRWbfFE2z7MYUW
Записка: HOW TO DECRYPT FILES.txt
➤ Содержание:
YOUR SYSTEM IS LOCKED AND ALL YOUR IMPORTANT DATA HAS BEEN ENCRYPTED.
DON'T WORRY YOUR FILES ARE SAFE.
TO RETURN ALL TO NORMALLY YOU MUST BUY THE CERBER DECRYPTOR PROGRAM.
PAYMENTS ARE ACCEPTED ONLY THROUGH THE BITCOIN NETWORK.
YOU CAN GET THEM VIA ATM MACHINE OR ONLINE
https://coinatmradar.com/ (find a ATM)
https://www.localbitcoins.com/ (buy instantly online any country)
THE PRICE FOR DECRYPTOR SOFTWARE IS 0.08 BTC -> Please be rezonable the Payment is NOT HIGH!
BTC ADRESS : 3HtA9MAZGh3m6NAtRc6fQRWbfFE2z7MYUW (where you need to make the payment)
VERRY IMPORTANT !
DO NOT TRY TO SCAN WITH ANTIVIRUS YOU RISK LOSING YOUR DATA .
ANTIVIRUSES ONLY DESTROY THE ENCRYPTED DATA , THEY DO NOT KNOW THE ALGORITH WITH WICH THE ENTIRE SYSTEM WAS ENCRYPTED.
THE ONLY WAY TO DECRYPT YOUR SYSTEM AND RETURN TO NORMAL IS TO BUY THE ORIGINAL DECRYPTOR SOFTWARE.
For more information : FSA2018@scryptmail.com (24/8)
Subject : SYSTEM-LOCKED-ID: 8866102xxx
Топик на форуме >>
Обновление от 15 октября 2018:
Пост на форуме >>
Расширение: ...DATA_IS_SAFE_YOU_NEED_TO_MAKE_THE_PAYMENT_IN_MAXIM_24_HOURS_OR_ALL_YOUR_IMPORTANT_FILES_WILL_BE_LOST_FOREVER_PLEASE_BE_REZONABLE_IS_NOT_A_JOKE_TIME_IS_LIMITED
Email: restore_service@scryptmail.com
Записка: HOW TO DECRYPT FILES.txt
➤ Содержание:
YOUR SYSTEM IS BLOCKED AND ALL YOUR IMPORTANT DATA HAS BEEN BLOCKED.
DON'T WORRY YOUR FILES ARE SAFE.
TO REPAIR YOUR SYSTEM AND RETURN TO NORMAL YOU MUST BUY THE FIXER TOOL
PAYMENTS ARE ACCEPTED ONLY THROUGH THE BITCOIN NETWORK.
YOU CAN GET THEM VIA ATM MACHINE OR ONLINE
THE PRICE FOR DECRYPTOR SOFTWARE IS 0.5 BTC
BTC ADRESS : < btc address > (where you need to make the payment)
VERRY IMPORTANT !
DO NOT TRY TO SCAN WITH ANTIVIRUS YOU RISK LOSING YOUR DATA .
ANTIVIRUSES ONLY DESTROY THE ENCRYPTED DATA , THEY DO NOT KNOW THE ALGORITH WITH WICH THE ENTIRE SYSTEM WAS ENCRYPTED.
THE ONLY WAY TO DECRYPT YOUR SYSTEM AND RETURN TO NORMAL IS TO BUY THE ORIGINAL DECRYPTOR SOFTWARE.
For more information : restore_service@scryptmail.com (24/7)
Subject : SYSTEM-LOCKED-ID: 1989102018
Обновление от 25 марта 2019:
Пост в Твиттере >>
Расширение: ....VeraCrypt_System_Error2019-You_need_to_make_payment_in_maxmin_24_hours_if_you_dont_the_decryptor_license_will_be_deleted_this_is_not_a_joke
Записка: HOW TO DECRYPT FILES.txt
Email: restore_service99@scryptmail.com
© Amigo-A (Andrew Ivanov): All blog articles.
Информатором жертвы также выступает диалоговое окно с тем же текстом.
Email: Email_Decryptor_Payment@scryptmail.com
BTC: 3J1MD7EAzdaYewBDA71t7NShkc64w4a41T
Сумма выкупа: 700 евро или 0.7 BTC в другом варианте
All your important files were BLOCKED on this computer.
Encrtyption was produced using unique KEY generated for this computer.
To decrypted files, you need to otbtain private key.
The single copy of trie private key, with will allow you to decrypt the files, is locate on a secret server on the internet;
The server will destroy the key within 24 hours after encryption completed.
REMEMBER YOU HAVE ONLY 24 HOURS TO PAY EVERITHING IS AUTOMATICALLY!
To retrieve the private key, you need to pay 700-EURO
PLEASE BE REZONABLE PAYMENT IS LITTLE ONLY 700 EURO
WE ACCEPT ONLY PAYMENT TO BITCOIN!
Bitcoins have to be sent to this address: 3J1MD7EAzdaYeWBDA71t7NShkC64W4a41T
After you've sent the payment send us an email to : Email_Decryptor_Payment@scryptmail.com with subject : ERROR-ID-6212510
If you are not familiar with bitcoin you can buy it from here :
SITE : www.localbitcoin.com
After we confirm the payment , we send the private key so you can decrypt your system.
***
➤ Другой вариант записки:
All your important files were BLOCKED on this computer.
Encrtyption was produced using unique KEY generated for this computer.
To decrypted files, you need to otbtain private key.
The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet;
The server will destroy the key within 24 hours after encryption completed.
REMEMBER YOU HAVE ONLY 24 HOURS TO PAY EVERITHING IS AUTOMATICALLY!
To retrieve the private key, you need to pay 0.7 BTC
Bitcoins have to be sent to this address: 3J1MD7EAzdaYeWBDA71t7NShkC64W4a41T
After you've sent the payment send us an email to : Email_Decryptor_Payment@scryptmail.com with subject : ERROR-ID-63100606(0.7BTC)
If you are not familiar with bitcoin you can buy it from here :
SITE : www.localbitcoin.com
If you try to use third party for help we will delete all your files
After we confirm the payment , we send the private key so you can decrypt your system.
Результаты анализов:
VT + VT + VT
Обновление от 23 мая 2018:
Расширение: .......PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment
Email: Email_Decryptor_Payment@scryptmail.com
BTC: 3J1MD7EAzdaYeWBDA71t7NShkC64W4a41T
Записка: HOW TO DECRYPT FILES.txt
Содержание записки: Как в одном из вариантов от 24 апреля 2018.
Обновление от 13 июня 2018:
Пост в Твиттере >>
Расширение: ....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_YOU_NEED_TO_PURCHASE_THE_DECRYPTOR_FROM_US_FAST_AND_URGENT
Email: repair_data@scryptmail.com
Сумма выкупа: 0.8 BTC
BTC-wallet: 3KxEZKjS4ifAHhX2o1fq9tERkAshSgA4hg
Файл: worker.exe
➤ Содержание записки:
YOUR SYSTEM IS LOCKED AND ALL YOUR IMPORTANT DATA HAS BEEN ENCRYPTED.
DON'T WORRY YOUR FILES ARE SAFE.
TO RETURN ALL TO NORMALLY YOU MUST BUY THE CERBER DECRYPTOR PROGRAM.
PAYMENTS ARE ACCEPTED ONLY THROUGH THE BITCOIN NETWORK.
YOU CAN GET THEM VIA ATM MACHINE OR ONLINE
https://coinatmradar.com/ (find a ATM)
https://www.localbitcoins.com/ (buy instantly online any country)
THE PRICE FOR DECRYPTOR SOFTWARE IS 0.8 BTC
BTC ADRESS : 3KxEZKjS4ifAHhX2o1fq9tERkAshSgA4hg (where you need to make the payment)
VERRY IMPORTANT !
DO NOT TRY TO SCAN WITH ANTIVIRUS YOU RISK LOSING YOUR DATA .
ANTIVIRUSES ONLY DESTROY THE ENCRYPTED DATA , THEY DO NOT KNOW THE ALGORITH WITH WICH THE ENTIRE SYSTEM WAS ENCRYPTED.
THE ONLY WAY TO DECRYPT YOUR SYSTEM AND RETURN TO NORMAL IS TO BUY THE ORIGINAL DECRYPTOR SOFTWARE.
For more information : repair_data@scryptmail.com (24/7)
Subject : SYSTEM-LOCKED-ID: 10191xxx
Результаты анализов: HA + VT + Malshare
Пример топика на форуме >>
Обновление от 25 июня 2018:
Расширение: .PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment
Записка: HOW TO DECRYPT FILES.txt
➤ Содержание записки:
All your important files were BLOCKED on this computer.
Encrtyption was produced using unique KEY generated for this computer.
To decrypted files, you need to otbtain private key.
The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet;
The server will destroy the key within 24 hours after encryption completed.
REMEMBER YOU HAVE ONLY 24 HOURS TO PAY EVERITHING IS AUTOMATICALLY!
To retrieve the private key, you need to pay 0.7 BTC
Bitcoins have to be sent to this address: 3J1MD7EAzdaYeWBDA71t7NShkC64W4a41T
After you've sent the payment send us an email to : Email_Decryptor_Payment@scryptmail.com with subject : ERROR-ID-63100606(0.7BTC)
If you are not familiar with bitcoin you can buy it from here :
SITE : www.localbitcoin.com
If you try to use third party for help we will delete all your files
After we confirm the payment , we send the private key so you can decrypt your system.
HKEY_CLASSES_ROOT\....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_to_make_the_payment
HKEY_CLASSES_ROOT\CUJVMVYCURZLZNO
HKEY_CLASSES_ROOT\CUJVMVYCURZLZNO\DefaultIcon
HKEY_CLASSES_ROOT\CUJVMVYCURZLZNO\shell\open\command
Топик на форуме >>
Результаты анализов: VT + HA + VMRay + JSA
Обновление от 26 июня 2018:
Расширение:
....FILES_ARE_SAFE_THE_SIGNLE_AND_UNIQ_WAY_TO_RECOVER_YOUR_FILES_IS_TO_BUY_THE_CERBER_DECRYPTOR_PROGRAM_YOU_NEED_TO_MAKE_THE_PAYMENT_IN_MAXIM_24_HOUR_OR_ALL_YOUR_FILES_WILL_BE_LOST_FORVER_PLEASE_BE_REZONABLE_AND_MAKE_THE_PAYMENT_URGENTLY
Топик на форуме >>
Обновление от 5 июля 2018:
Расширение:
.NEED-TO-MAKE-PAYMENT-OR-ALL-YOUR-FILLES-WILL-BE-DELETED-CRITICAL-SITUATION-URGENT-ATTENTION-24-HOURS-TO-PAY-OR-EVERYTHING-WILL-BE-PERMANENTLY-DELETED-FOREVER
Email: Payment_Confirmation@scryptmail.com
BTC: 33JCALvTgh7CmEDWQjuvkquH4GVEbA56oG
All your important files were FROZEN on this computer.
Encrtyption was produced using unique KEY generated for this computer.
To decrypted files, you need to otbtain private key.
The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet;
The server will destroy the key within 36 hours after encryption completed.
REMEMBER YOU HAVE ONLY 24 HOURS TO PAY EVERITHING IS AUTOMATICALLY!
To retrieve the private key, you need to pay 7 (BTC)
Bitcoins have to be sent to this address: 33JCALvTgh7CmEDWQjuvkquH4GVEbA56oG
After you've sent the payment send us an email to : Payment_Confirmation@scryptmail.com with subject : ERROR-ID-631009091(7-BTC)
If you are not familiar with bitcoin you can buy it from here :
SITE : www.localbitcoin.com
After we confirm the payment , we send the private key so you can decrypt your system.
Красным помечена слова с ошибками.
Результаты анализов: VT + AR
Обновление от 8 июля 2018:
Пост в Твиттере >>
Расширение: ...DATA_IS_SAFE_YOU_NEED_TO_MAKE_THE_PAYMENT_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_LOST_FOREVER_PLEASE_BE_REZONABLE_IS_NOT_A_JOKE_TIME_IS_LIMITED
Email: FSA2018@scryptmail.com
BTC: 3HtA9MAZGh3m6NAtRc6fQRWbfFE2z7MYUW
Записка: HOW TO DECRYPT FILES.txt
➤ Содержание:
YOUR SYSTEM IS LOCKED AND ALL YOUR IMPORTANT DATA HAS BEEN ENCRYPTED.
DON'T WORRY YOUR FILES ARE SAFE.
TO RETURN ALL TO NORMALLY YOU MUST BUY THE CERBER DECRYPTOR PROGRAM.
PAYMENTS ARE ACCEPTED ONLY THROUGH THE BITCOIN NETWORK.
YOU CAN GET THEM VIA ATM MACHINE OR ONLINE
https://coinatmradar.com/ (find a ATM)
https://www.localbitcoins.com/ (buy instantly online any country)
THE PRICE FOR DECRYPTOR SOFTWARE IS 0.08 BTC -> Please be rezonable the Payment is NOT HIGH!
BTC ADRESS : 3HtA9MAZGh3m6NAtRc6fQRWbfFE2z7MYUW (where you need to make the payment)
VERRY IMPORTANT !
DO NOT TRY TO SCAN WITH ANTIVIRUS YOU RISK LOSING YOUR DATA .
ANTIVIRUSES ONLY DESTROY THE ENCRYPTED DATA , THEY DO NOT KNOW THE ALGORITH WITH WICH THE ENTIRE SYSTEM WAS ENCRYPTED.
THE ONLY WAY TO DECRYPT YOUR SYSTEM AND RETURN TO NORMAL IS TO BUY THE ORIGINAL DECRYPTOR SOFTWARE.
For more information : FSA2018@scryptmail.com (24/8)
Subject : SYSTEM-LOCKED-ID: 8866102xxx
Топик на форуме >>
Обновление от 15 октября 2018:
Пост на форуме >>
Расширение: ...DATA_IS_SAFE_YOU_NEED_TO_MAKE_THE_PAYMENT_IN_MAXIM_24_HOURS_OR_ALL_YOUR_IMPORTANT_FILES_WILL_BE_LOST_FOREVER_PLEASE_BE_REZONABLE_IS_NOT_A_JOKE_TIME_IS_LIMITED
Email: restore_service@scryptmail.com
Записка: HOW TO DECRYPT FILES.txt
➤ Содержание:
YOUR SYSTEM IS BLOCKED AND ALL YOUR IMPORTANT DATA HAS BEEN BLOCKED.
DON'T WORRY YOUR FILES ARE SAFE.
TO REPAIR YOUR SYSTEM AND RETURN TO NORMAL YOU MUST BUY THE FIXER TOOL
PAYMENTS ARE ACCEPTED ONLY THROUGH THE BITCOIN NETWORK.
YOU CAN GET THEM VIA ATM MACHINE OR ONLINE
THE PRICE FOR DECRYPTOR SOFTWARE IS 0.5 BTC
BTC ADRESS : < btc address > (where you need to make the payment)
VERRY IMPORTANT !
DO NOT TRY TO SCAN WITH ANTIVIRUS YOU RISK LOSING YOUR DATA .
ANTIVIRUSES ONLY DESTROY THE ENCRYPTED DATA , THEY DO NOT KNOW THE ALGORITH WITH WICH THE ENTIRE SYSTEM WAS ENCRYPTED.
THE ONLY WAY TO DECRYPT YOUR SYSTEM AND RETURN TO NORMAL IS TO BUY THE ORIGINAL DECRYPTOR SOFTWARE.
For more information : restore_service@scryptmail.com (24/7)
Subject : SYSTEM-LOCKED-ID: 1989102018
Обновление от 25 марта 2019:
Пост в Твиттере >>
Расширение: ....VeraCrypt_System_Error2019-You_need_to_make_payment_in_maxmin_24_hours_if_you_dont_the_decryptor_license_will_be_deleted_this_is_not_a_joke
Записка: HOW TO DECRYPT FILES.txt
Email: restore_service99@scryptmail.com
Обновление от 23 октября 2020:
Расширение: .system_damaged_payment_must_be_done_in_maxim_24_hours_or_your_encryption_key_will_be_deleted_forver
Email: ineedmoney12@tutanota.com
BTC: 18Tymv8EpXorQgEtP5L6x1x93ZT9a8eSPw
Записка: HOW TO DECRYPT FILES.txt
➤ Содержание записки:
YOUR SYSTEM IS LOCKED AND ALL YOUR IMPORTANT DATA HAS BEEN ENCRYPTED.
DON'T WORRY YOUR FILES ARE SAFE.
TO RETURN ALL TO NORMALLY YOU MUST BUY THE CERBER DECRYPTOR PROGRAM.
PAYMENTS ARE ACCEPTED ONLY THROUGH THE BITCOIN NETWORK.
YOU CAN GET THEM VIA ATM MACHINE OR ONLINE
https://coinatmradar.com/ (find a ATM)
https://www.localbitcoins.com/ (buy instantly online any country)
THE PRICE FOR DECRYPTOR SOFTWARE IS 5 BTC
BTC ADRESS : 18Tymv8EpXorQgEtP5L6x1x93ZT9a8eSPw (where you need to make the payment)
VERRY IMPORTANT !
DO NOT TRY TO SCAN WITH ANTIVIRUS YOU RISK LOSING YOUR DATA .
ANTIVIRUSES ONLY DESTROY THE ENCRYPTED DATA , THEY DO NOT KNOW THE ALGORITH WITH WICH THE ENTIRE SYSTEM WAS ENCRYPTED.
THE ONLY WAY TO DECRYPT YOUR SYSTEM AND RETURN TO NORMAL IS TO BUY THE ORIGINAL DECRYPTOR SOFTWARE.
For more information : ineedmoney12@tutanota.com (24/7)
Subject : SYSTEM-LOCKED-ID: 0SW1032770
=== БЛОК ССЫЛОК и СПАСИБОК = BLOCK OF LINKS AND THANKS ===
Внимание! Для зашифрованных файлов есть дешифровщик Скачать XoristDecrypter для дешифровки >> Прочтите подробную инструкцию перед запуском. Альтернативный вариант: Есть еще один дешифровщик, регулярно обновляемый! За помощью обращайтесь по ссылке к thyrex >> Twitter
Read to links: Tweet on Twitter ID Ransomware (ID as Xorist) Write-up, Topic of Support *
Thanks: (victim in the topics of support) BleepingComputer, Michael Gillespie Alex Svirid, Andrew Ivanov *
© Amigo-A (Andrew Ivanov): All blog articles.
