WDM Ransomware
DCRTR-WDM Ransomware
(шифровальщик-вымогатель) (первоисточник)
Translation into English
Этот крипто-вымогатель шифрует данные пользователей с помощью AES, а затем требует выкуп в $1270 в BTC, чтобы вернуть файлы. Оригинальное название: не указано. На файле написано (фальш-имя): Windows Defender Monitor и wdm.exe. Фальш-копирайт: © Microsoft Corporation. All rights reserved. Название проекта: FileCryptor.
Обнаружения:
DrWeb -> Trojan.Encoder.26981, Trojan.Encoder.27259, Trojan.Encoder.26657
BitDefender -> Dropped:Trojan.GenericKD.31713214, Gen:Variant.Ursu.429516
Malwarebytes -> Ransom.DCRTR
Symantec -> Trojan.Gen.MBT
ALYac -> Trojan.Ransom.Dcrtr
© Генеалогия: DCRTR + различные заимствования >> DCRTR-WDM ⇒ переход на другую разработку.
Изображение — логотип статьи
К зашифрованным файлам добавляется расширение: .crypt
Файлы не переименовываются.
Внимание! Новые расширения, email и тексты о выкупе можно найти в конце статьи, в обновлениях. Там могут быть различия с первоначальным вариантом, а также заимствования у других вымогателей (стиль и текст записок, форматы ID и прочие элементы), призванные хотя бы на время запутать определение Ransomware. Активность этого крипто-вымогателя пришлась на начало ноября 2018 г. Ориентирован на англоязычных пользователей, что не мешает распространять его по всему миру.
Записка с требованием выкупа называется: HOW TO DECRYPT FILES.txt
Содержание записки о выкупе:
***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED***********************
*****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS*****
Attention!
All your files, documents, photos, databases and other important files are encrypted and have the extension: .CRYPT
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/
| 1. Install Tor browser
| 2. Open Tor Browser
| 3. Open link in TOR browser: http://crypt443sgtkyz4l.onion/942a6d15e7378b***
| 4. Follow the instructions on this page
---------------------------------------------------------------------------------------- On our page you will see the payment instructions and will be able to decrypt 1 file for free with the extension ".exe".
Attention!
TO PREVENT DATA CORRUPTION:
- do not modify files with extension.crypt
- do not run anti-virus programs, they may remove information to contact us
- do not download third-party file descriptors, only we can decrypt files!
Перевод записки на русский язык:
*********************** НИ ПРИ КАКИХ ОБСТОЯТЕЛЬСТВАХ НЕ УДАЛЯЙТЕ ЭТОТ ФАЙЛ, ПОКА ВСЕ ВАШИ ДАННЫЕ НЕ БУДУТ ВОССТАНОВЛЕНЫ ************ ***********
***** НЕСОБЛЮДЕНИЕ ЭТОГО ТРЕБОВАНИЯ ПРИВЕДЕТ К ПОВРЕЖДЕНИЮ СИСТЕМЫ, ЕСЛИ БУДУТ ОШИБКИ В РАСШИФРОВКЕ *****
Внимание!
Все ваши файлы, документы, фото, базы данных и другие важные файлы зашифрованы и имеют расширение: .CRYPT
Единственный способ восстановления файлов - купить уникальный закрытый ключ. Только мы можем дать вам этот ключ, и только мы можем восстановить ваши файлы.
Сервер с вашим ключом находится в закрытой сети TOR. Вы можете добраться туда следующими способами:
-------------------------------------------------- --------------------------------------
| 0. Загрузите Tor-браузер - https://www.torproject.org/
| 1. Установите Tor-браузер
| 2. Откройте Tor-браузер
| 3. Откройте ссылку в Tor-браузере: http://crypt443sgtkyz4l.onion/942a6d15e7378b4b5368b***
| 4. Следуйте инструкциям на этой странице
-------------------------------------------------- -------------------------------------- На нашей странице вы увидите инструкции по оплате и сможете дешифровать бесплатно 1 файл с расширением ".exe".
Внимание!
ДЛЯ ПРЕДОТВРАЩЕНИЯ ПОВРЕЖДЕНИЯ ДАННЫХ:
- не изменяйте файлы с расширением .crypt
- не запускайте антивирусные программы, они могут удалить информацию для связи с нами
- не загружайте сторонние дескрипторы файлов, только мы можем расшифровать файлы!
Отказавшись от email в записке, вымогатели теперь используют не только текст записки о выкупе, но и сайт оплаты с дизайном, как у вымогателей проекта GandCrab-Ransomware. Скриншоты сайты представлены ниже.
Содержание страниц сайта оплаты (постранично):
We are sorry, but your files have been encrypted!
Don't worry, we can help you to return all of your files!
Files decryptor's price is 1270 USD
Every day the price increases by $ 50 !
What the matter? Buy Decryptor Support Test Decrypt
Buy cryptocurrency Bitcoin. Here you can find services where you can do it.
Send 0.19725398 BTC to the address: 1D41x7GnXpN7jXhdZ7hfZXKsQzyGRNmkfg
Attention!
Please be careful and check the address visually after copy-pasting (because there is a probability of a malware on your PC that monitors and changes the address in your clipboard)
If you don't use TOR Browser:
Send a verification payment for a small amount, and then, make sure that the coins are coming, then send the rest of the amount.
We won't take any responsibility if your funds don't reach us
The transaction will be confirmed after it receives 3 confirmations (usually it takes about 10 minutes)
Transactions list
TX Amount Status
Total 0BTC unpaid
--------------------------------
We are sorry, but your files have been encrypted!
Don't worry, we can help you to return all of your files!
Files decryptor's price is 1270 USD
Every day the price increases by $ 50 !
What the matter? Buy Decryptor Support Test Decrypt
What the matter?
Your computer has been infected with Ransomware. Your files have been encrypted and you can't decrypt it by yourself.
In the network, you can probably find and third-party software, but it won't help you, it only can make your files undecryptable
What can I do to get my files back?
You should buy Decryptor. This software will help you to decrypt all of your encrypted files and remove Ransomware from your PC.
Current price: 1270 USD. As payment, you need cryptocurrency Bitcoin
What is cryptocurrency and how can I purchase Decryptor?
You can read more details about cryptocurrency at Google or here.
As payment, you have to buy Bitcoin using a credit card, and send coins to our address.
How can I pay to you?
You have to buy Bitcoin using a credit card. Links to services where you can do it: Bitcoin exchanges list
After it, go to our payment page Buy Decryptor, choose your payment method and follow the instructions
--------------------------------
We are sorry, but your files have been encrypted!
Don't worry, we can help you to return all of your files!
Files decryptor's price is 1270 USD
Every day the price increases by $ 50 !
What the matter? Buy Decryptor Support Test Decrypt
If you have any problems with the purchase - please contact support.
You Support
{{ message.message }}
{{ message.created_at }}
Send message
--------------------------------
We are sorry, but your files have been encrypted!
Don't worry, we can help you to return all of your files!
Files decryptor's price is 1270 USD
Every day the price increases by $ 50 !
What the matter? Buy Decryptor Support Test Decrypt
Chose file ( .exe )
Decrypt
Технические детали
Распространяется под видом обновления для Windows Defender.
Может распространяться путём взлома через незащищенную конфигурацию RDP, с помощью email-спама и вредоносных вложений, обманных загрузок, ботнетов, эксплойтов, веб-инжектов, фальшивых обновлений, перепакованных и заражённых инсталляторов. См. также "Основные способы распространения криптовымогателей" на вводной странице блога.
Если вы пренебрегаете комплексной антивирусной защитой класса Internet Security или Total Security, то хотя бы делайте резервное копирование важных файлов по методу 3-2-1. ➤ При установке WDM завершает ряд процессов:
IM sql
mystjld.exe
scfwriter.exe
scfserver.exe
sqlservr.exe
SQLyog.exe
httpd.exe
ApacheMonitor.exe
mysqld-nt.exe
sqlceip.exe
sqlbrowser.exe
FileZillaServer.exe
chrome.exe
ie.exe
firefox.exe
opera.exe
safari.exe
taskmgr.exe
1c
excel.exe
mspub.exe
winword.exe
powerpnt.exe
notepad.exe
Microsoft.Exchange.*
MSExchange*
vssadmin.exe delete shadows /all /quiet
wmic shadowcopy delete
➤ После установки WDM и завершения вышеназванных процессов завершает работу системы.
Список файловых расширений, подвергающихся шифрованию:
Это документы MS Office, OpenOffice, PDF, текстовые файлы, базы данных, фотографии, музыка, видео, файлы образов, архивы и пр.
Файлы, связанные с этим Ransomware:
HOW TO DECRYPT FILES.txt
wdm.exe (setup.exe) или другие названия
<random>.exe - случайное название
FileCryptor.pdb - название проекта
install.bat и другие вспомогательные файлы
Расположения:
\Desktop\ ->
\User_folders\ ->
\%TEMP%\ ->
\AppData\Roaming\Windows Defender\wdm.exe
C:\Users\malay\Downloads\Telegram Desktop\FileCryptor (2)\FileCryptor\Release\FileCryptor.pdb
Записи реестра, связанные с этим Ransomware:
См. ниже результаты анализов.
Мьютекс:
WindowsDefenderMonitorMutex
Сетевые подключения и связи:
xxxx://crypt443sgtkyz4l.onion/***
См. ниже в обновлениях другие адреса и контакты.
См. ниже результаты анализов.
Результаты анализов:
Ⓗ Hybrid анализ >>
𝚺 VirusTotal анализ >>
🐞 Intezer анализ >>
🐞 Intezer анализ на файл libcrypto-1_1.dll >>
Ⓥ VirusBay образец >>
ⴵ VMRay анализ >>
ᕒ ANY.RUN анализ >>
👽 AlienVault анализ >>
🔃 CAPE Sandbox анализ >>
⨇ MalShare анализ >>
⟲ JOE Sandbox анализ >>
Степень распространённости: средняя.
Подробные сведения собираются регулярно.
=== ИСТОРИЯ СЕМЕЙСТВА === HISTORY OF FAMILY ===
DCRTR Ransomware - февраль 2018
DCRTR-WDM Ransomware - ноябрь 2018
=== БЛОК ОБНОВЛЕНИЙ === BLOCK OF UPDATES ===
Обновление от 13 ноября 2018:
Пост на форуме >>
Записки: info.hta и HOW TO DECRYPT FILES.TXT
Email: dekode@qq.com
Содержание теперь заимствовано у Rapid Ransomware.
Файл Info.hta заимствован у Dharma Ransomware.
Hello, dear friend!
All your files have been ENCRYPTED
Do you really want to restore your files?
Write to our email - dekode@qq.com
and tell us your unique ID - ID-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX {32}
Обновление от 19 января 2019:
Сообщение >>
Самоназвание: FileCryptor_V1.2
Файл проекта: FileCryptor.pdb
Расширение: .crypt
Email: BTCBREWERY@protonmail.com, btcbrewery@india.com
Мьютекс: WindowsDefenderMonitorMutex
Записки: HOW TO DECRYPT FILES.txt и info.hta
Hello, dear friend!
All your files have been encrypted
do you really want to restore your files?
write to our email - BTCBREWERY@protonmail.com
btcbrewery@india.com
***
Результаты анализов: VT
Обновление от 20 февраля 2019:
Сообщение >>
Расширение: .crypt
Записки: info.hta и HOW TO DECRYPT FILES.txt
Email: decodebuy@qq.com
Мьютекс: oleacc-msaa-loaded
Результаты анализов: VT + VMR
Hello, dear friend!
All your files have been ENCRYPTED
Do you really want to restore your files?
Write to our email - decodebuy@qq.com
and tell us your unique ID - ID-201180745exxxxxxxxxxxfxxxxxxxxxx
---
➤ Содержание записки info.hta
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail decodebuy@qq.com
Write this ID in the title of your message 201180745exxxxxxxxxxxfxxxxxxxxxx
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
•Do not rename encrypted files.
•Do not try to decrypt your data using third party software, it may cause permanent data loss.
•Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Обновление от 18 марта 2019:
Расширение: .SONG
Записки: info.hta и HOW TO DECRYPT FILES.txt
Email: rogons@foxmail.com
Обновление от 10 апреля 2019:
Топик на форуме >>
Расширение .PAFOS
Записки: HOW TO DECRYPT FILES.txt
Email: goodymans@qq.com
Hello, dear friend!
All your files have been ENCRYPTED
Do you really want to restore your files?
Write to our email - goodymans@qq.com
and tell us your unique ID - ID-49be49395d872068abc543xxxxxxxxxxx
Обновление от 22 апреля 2019:
Топик на форуме >>
Расширение: .COLORIT
Email: goodbrov@qq.com
Записки: HOW TO DECRYPT FILES.hta
HOW TO DECRYPT FILES.txt
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail goodbrov@qq.com
Write this ID in the title of your message 6f34b033fce61c65a909e1xxxxxxxxxx
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
•Do not rename encrypted files.
•Do not try to decrypt your data using third party software, it may cause permanent data loss.
•Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
---
Hello, dear friend!
All your files have been ENCRYPTED
Do you really want to restore your files?
Write to our email - goodbrov@qq.com
and tell us your unique ID - ID-6f34b033fce61c65a909e1xxxxxxxxxx {32}
Результаты анализов: VT + IA
Обновление от 30 апреля 2019:
Пост на форуме >>
Расширение: .COLORIT
Email: borov@foxmail.com
Записки: HOW TO DECRYPT FILES.hta
HOW TO DECRYPT FILES.txt
➤ Скриншоты записки HOW TO DECRYPT FILES.hta, открытой в браузерах IE и Chtome как htm-файл.
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail borov@foxmail.com
Write this ID in the title of your message 8fc7b76cc9f504bd9b847aba6d249bef
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Hello, dear friend!
All your files have been ENCRYPTED
Do you really want to restore your files?
Write to our email - borov@foxmail.com
and tell us your unique ID - ID-8fc7b76cc9f504bd9b847aba6d249bef
Обновление от 18 июня 2019:
Сообщение >>
Топик на форуме >>
Статус: Дешифровка пока невозможна.
Расширение: .COPAN
Записки: HOW TO DECRYPT FILES.txt
HOW TO DECRYPT FILES.hta
Email: acva@foxmail.com
Hello, dear friend.
All your files are encrypted with a unique key.
Are you sure you want to recover all your files ?
Write us an email: acva@foxmail.com
Enter your unique ID in the message: 11e015fXXX
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail acva@foxmail.com
Write this ID in the title of your message 19afc8ce83
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Обновление от 24 июня 2019:
Сообщение >>
Статус: Дешифровка пока невозможна.
Расширение: .WALAN
Email: racap@qq.com
Записка: DECRYPT_INFO.txt
➤ Содержание TXT-записки:
Hello, dear friend.
All your files are encrypted with a unique key.
Are you sure you want to recover all your files ?
Write us an email: racap@qq.com
Enter your unique ID in the message: XXXXXXXXXX
Обновление от 30 июня 2019:
Сообщение >>
Топик на форуме >>
Топик на форуме >>
Статус: Дешифровка пока невозможна.
Расширение: .CAGO
Записки: DECRYPT_INFO.txt
DECRYPT_INFO.hta
Email: popstop@foxmail.com
Hello, dear friend.
All your files are encrypted with a unique key.
Are you sure you want to recover all your files ?
Write us an email: popstop@foxmail.com
Enter your unique ID in the message: 93041xxxxx
---
➤ Содержание HTA-записки:
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail popstop@foxmail.com
Write this ID in the title of your message 3e71exxxxx
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
---
Вспомогательный файл: install.bat
Файл EXE: dllhost.exe (wpm.exe)
Результаты анализов: VT + HA + IA + AR
---
➤ Контакт с доменами:
1.240.168.192.in-addr.arpa
10.240.168.192.in-addr.arpa
11.240.168.192.in-addr.arpa
12.240.168.192.in-addr.arpa
13.240.168.192.in-addr.arpa
14.240.168.192.in-addr.arpa
2.240.168.192.in-addr.arpa
210.240.168.192.in-addr.arpa
213.240.168.192.in-addr.arpa
25.240.168.192.in-addr.arpa
3.240.168.192.in-addr.arpa
32.240.168.192.in-addr.arpa
36.240.168.192.in-addr.arpa
39.240.168.192.in-addr.arpa
4.240.168.192.in-addr.arpa
5.240.168.192.in-addr.arpa
6.240.168.192.in-addr.arpa
9.240.168.192.in-addr.arpa
Пост на форуме >>
Пост на форуме >>
Статус: Дешифровка пока невозможна.
Расширение: .STAFS
Записки: HOW TO DECRYPT FILES.hta
HOW TO DECRYPT FILES.txt
Email: porasa@qq.com
Файлы EXE: Defendr.exe, smss.exe
Результаты анализов: VT + HA + AR / VT
Good day.
All your documents, databases, photos, videos and staff were encrypted with a unique key.
If you want to return all your files, so write to us by mail: porasa@qq.com
In the message attach your unique ID: bfa24466b2
Do not waste your time! You risk losing all your files!
---
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail porasa@qq.com
Write this ID in the title of your message bfa24466b2
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
---
➤ Контакт с доменами:
1.240.168.192.in-addr.arpa
10.240.168.192.in-addr.arpa
11.240.168.192.in-addr.arpa
12.240.168.192.in-addr.arpa
13.240.168.192.in-addr.arpa
14.240.168.192.in-addr.arpa
2.240.168.192.in-addr.arpa
206.240.168.192.in-addr.arpa
220.240.168.192.in-addr.arpa
221.240.168.192.in-addr.arpa
232.240.168.192.in-addr.arpa
24.240.168.192.in-addr.arpa
248.240.168.192.in-addr.arpa
3.240.168.192.in-addr.arpa
32.240.168.192.in-addr.arpa
4.240.168.192.in-addr.arpa
5.240.168.192.in-addr.arpa
6.240.168.192.in-addr.arpa
9.240.168.192.in-addr.arpa
Обновление от 1 сентября 2019:
Топик на форуме >>
Статус: Дешифровка пока невозможна.
Расширение: .SOS или .sos
Записки: HOW TO DECRYPT FILES.hta
HOW TO DECRYPT FILES.txt
Email: corova@qq.com
Good day.
All your documents, databases, photos, videos and staff were encrypted with a unique key.
If you want to return all your files, so write to us by mail: corova@qq.com
In the message attach your unique ID: bf672589f8
Do not waste your time! You risk losing all your files!
---
Обновление от 24 сентября 2019:
Топик на форуме >>
Статус: Дешифровка пока невозможна.
Расширение: .GOLD
Email: sospa@foxmail.com
Записки: HOW TO DECRYPT FILES.txt
HOW TO DECRYPT FILES.HTA
➤ Содержание txt-записки:
Good day.
All your documents, databases, photos, videos and staff were encrypted with a unique key.
If you want to return all your files, so write to us by mail: sospa@foxmail.com
In the message attach your unique ID: c0f7262b2a
Do not waste your time! You risk losing all your files!
Обновление от 8 октября 2019:
Топик на форуме >>
Расширение: .LOCK
Записки: HOW TO DECRYPT FILES.hta
HOW TO DECRYPT FILES.txt
Email: raceso@qq.com
Файл EXE: smms.exe
Результаты анализов: VT + AR + IA
Good day.
All your documents, databases, photos, videos and staff were encrypted with a unique key.
If you want to return all your files, so write to us by mail: raceso@qq.com
In the message attach your unique ID: 3e71ec40bc
Do not waste your time! You risk losing all your files!
Обновление от 14 октября 2019:
Сообщение >>
Расширение: .CRYZP
Записки: HOW TO DECRYPT FILES.hta
HOW TO DECRYPT FILES.txt
Email: sosca@foxmail.com
Топик на форуме >>
Расширение: .LOCKEDS
Записки: HOW TO DECRYPT FILES.hta
HOW TO DECRYPT FILES.txt
Email: popca@qq.com
Обновление от 31 января 2020:
Расширение: .ngecqlu
Записки: HOW TO DECRYPT FILES.hta
HOW TO DECRYPT FILES.txt
Email: costama@qq.com
Мое замечание от 20 декабря 2020:
По всей видимости вымогатели перешли в другие проекты и эта программа-вымогатель в прежнем виде не распространяется.
=== БЛОК ССЫЛОК и СПАСИБОК = BLOCK OF LINKS AND THANKS ===
В некоторых случаях файлы можно дешифровать! Составьте запрос в Dr.Web на пробную дешифровку: - на русском языке - на английском языке Если дешифровка возможна, то вам сообщат подробности. ➽ Или напишите Emmanuel_ADC-Soft на форум или в Твиттер.
Read to links: Tweet on Twitter + Tweet ID Ransomware (ID as DCRTR) Write-up, Topic of Support *
Thanks: Emmanuel_ADC-Soft, Michael Gillespie, quietman7 Andrew Ivanov (author) * *
© Amigo-A (Andrew Ivanov): All blog articles.
