Ransomnix Ransomware
Ransomnix-Crypt Ransomware
Ransomnix-Charm Ransomware
(шифровальщик-вымогатель) (первоисточник)
Этот крипто-вымогатель шифрует данные пользователей с помощью AES, а затем требует выкуп в 0.5 -1 BTC, чтобы вернуть файлы. Оригинальное название: Ransomnix.
шифровальщик вирус-шифровальщик троян-шифровальщик крипто-вымогатель удалить восстановить файлы расшифровка расшифровать дешифровать дешифрование дешифровка алгоритм crypto-ransomware virus-encoder key Removal Report Virus Removal Guide Как избавиться от Ransomware ransom decrypt decryption recovery remove restore decode files data public private
© Генеалогия: выясняется.
К зашифрованным файлам добавляется расширение .Crypt
Изображение принадлежит шифровальщику
Активность этого крипто-вымогателя пришлась на июнь-август 2017 г. Ориентирован на англоязычных пользователей, что не мешает распространять его по всему миру.
Записка с требованием выкупа называется: [нет данных]
Запиской с требованием выкупа выступает экран блокировки: [нет данных]
Требования написаны на сайте вымогателей. Скриншот, состоящий из трёх снимков, прилагается.
Содержание записки о выкупе:
Ransomnix
Now Pay 1 BTC
OR
Payment will increase by
0.5 BTC each day after
00:00:00
Your Key Will Be Deleted
Your Bill till now 38.5 BTC
Dear manager, on
Wed Jun 14 2017 05:42:03 GMT+0100 ***))
your database server has been locked, your databases files are encrypted and you have unfortunately "lost" all your data, Encryption was produced using unique public key RSA-2048 generated for this server.
To decrypt files you need to obtain the private key.
All encrypted files ends with .Crypt
Your reference number: 9357
To obtain the program for this server, which will decrypt all files, you need to pay 1 bitcoin on our bitcoin address
1pYUK7efvf3PYALJ1dGFq4FZU6FrdQ5E8 (today 1 bitcoin was 2860 $).
Only we and you know about this bitcoin address.
You can check bitcoin balance here - 1pYUK7efvf3PYALJ1dGFq4FZU6FrdQ5E8
After payment send us your number on our mail add1ct@yahoo.com and we will send you decryption tool (you need only run it and all files will be decrypted during 1...3 $ Before payment you can send us one small file (100..500 kilobytes) and we will decrypt it - it's your guarantee that we have decryption tool. And send us your number w$
We don't know who are you, All what we need is some money.
Don't panic if we don't answer you during 24 hours. It means that we didn't received your letter and write us again.
You can use one of that bitcoin exchangers for transfering bitcoin.
https://localbitcoins.com
https://www.kraken.com
You dont need install bitcoin programs - you need only use one of this exchangers or other exchanger that you can find in www.google.com for your country.
Please use english language in your letters. If you don't speak english then use https://translate.google.com to translate your letter on english language.
You don't have enough time to think each day payment will increase by 0.5 BTC and after one week your privite key will be deleted and your files will be locked for ever.
Ransomnix
Перевод записки на русский язык:
Ransomnix
Сейчас платите 1 BTC
ИЛИ
Оплата будет увеличена на
0,5 BTC каждый день после
00:00:00
Ваш ключ будет удален
Ваш биль до сих пор 38.5 BTC
Уважаемый менеджер,
Ср Июн 14 2017 05:42:03 GMT + 0100 ***))
Вашего сервера базы данных заблокированы, ваши файлы баз данных зашифрованы, и вы, к сожалению, "потеряли" все свои данные, шифрование сделано с использованием уникального открытого ключа RSA-2048, созданного для этого сервера.
Чтобы дешифровать файлы, вам необходимо получить закрытый ключ.
Все зашифрованные файлы заканчиваются на .Crypt
Ваш ссылочный номер: 9357
Чтобы получить программу для этого сервера, которая расшифрует все файлы, вам нужно заплатить 1 биткоин на наш биткоин-адрес
1pYUK7efvf3PYALJ1dGFq4FZU6FrdQ5E8 (сегодня 1 биткоин был 2860 $).
Только мы и вы знаете об этом биткоин-адресе.
Вы можете проверить баланс биткоинов здесь - 1pYUK7efvf3PYALJ1dGFq4FZU6FrdQ5E8
После оплаты отправьте нам свой номер на нашу почту add1ct@yahoo.com, и мы вышлем вам инструмент дешифрования (вам нужно только запустить его, и все файлы будут дешифрованы в течение 1 ... 3 $. Перед оплатой вы можете отправить нам один небольшой файл (100..500 килобайт), и мы расшифруем его - это ваша гарантия, что у нас есть инструмент дешифрования. И отправьте нам свой номер w$
Мы не знаем, кто ты. Все, что нам нужно, это деньги.
Не паникуйте, если мы не ответим вам в течение 24 часов. Это означает, что мы не получили ваше письмо и не напишем нам еще раз.
Вы можете использовать один из этих биткоин-обменников для переноса биткоина.
xxxxs://localbitcoins.com
xxxxs://www.kraken.com
Вам не нужно устанавливать программы биткоинов - вам нужно использовать только один из этих обменников или другой обменник, который вы можете найти на www.google.com для своей страны.
Пожалуйста, используйте английский язык в своих письмах. Если вы не говорите по-английски, воспользуйтесь https://translate.google.com, чтобы перевести свое письмо на английский язык.
У вас недостаточно времени, чтобы думать, т.к. каждый день платеж будет увеличиваться на 0.5 BTC, и через неделю ваш приватный ключ будет удален, и ваши файлы будут заблокированы навсегда.
Ransomnix
Технические детали
Может распространяться путём взлома через незащищенную конфигурацию RDP, с помощью email-спама и вредоносных вложений, обманных загрузок, эксплойтов, веб-инжектов, фальшивых обновлений, перепакованных и заражённых инсталляторов. См. также "Основные способы распространения криптовымогателей" на вводной странице блога.
Список файловых расширений, подвергающихся шифрованию:
Это документы MS Office, PDF, текстовые файлы, базы данных, веб-данные, фотографии и пр.
Файлы, связанные с этим Ransomware:
<random>.exe
Записи реестра, связанные с этим Ransomware:
См. ниже результаты анализов.
Снимок с оригинального сайта из веб-архива
Сетевые подключения и связи:
xxxx://themerchantadventurer.com - взломанный сайт
xxxx://themerchantadventurer.com/model-policy - взломанный сайт
https://web.archive.org/web/20161017012107/http://themerchantadventurer.com/ - оригинальный сайт в веб-архиве
Email: add1ct@yahoo.com
BTC: 1pYUK7efvf3PYALJ1dGFq4FZU6FrdQ5E8
См. ниже результаты анализов.
Результаты анализов:
Гибридный анализ >>
VirusTotal анализ >>
Другой анализ >>
Степень распространённости: низкая.
Подробные сведения собираются регулярно.
=== ИСТОРИЯ СЕМЕЙСТВА === HISTORY OF FAMILY ===
=== БЛОК ОБНОВЛЕНИЙ === BLOCK OF UPDATES ===
Обновление от 6 апреля 2018:
Самоназвание этого варианта: JIGSAW RANSOMNIX 2018
Они добавили громкое название и картинку от JIGSAW, чтобы напугать пострадавших.
Расширение: .Crypt
Email: crypter@cyberservices.com
BTC: 1VirusnmipsYSA5jMv8NKstL8FkVjNB9o
Сумма выкупа: 0.2 BTC + увеличение на 0.1 BTC каждый день
Содержание текста со скриншота:
JIGSAW RANSOMNIX 2018
I WANT TO PLAY A GAME!
Now Pay 0.2 BTC
OR
Payment will increase by
0.1 BTC each day after
00:00:00
Your Key Will Be Deleted
Your Bill till now 2.4000000000000004 BTC
Dear manager, on
Fri Apr 06 2018 02:08:34 GMT+0100 (GMT Summer Time)
your database server has been locked, your databases files are encrypted
and you have unfortunately "lost" all your data, Encryption was produced using
unique public key RSA-2048 generated for this server.
To decrypt files you need to obtain the private key.
All encrypted files ends with .Crypt
Your reference number: 4027
To obtain the program for this server, which will decrypt all files,
you need to pay 0.2 bitcoin on our bitcoin address 1VirusnmipsYSA5jMv8NKstL8FkVjNB9o (today 1 bitcoin was around 15000 $).
After payment send us your number on our mail crypter@cyberservices.com and we will send you decryption tool (you need only run it and all files will be decrypted during a few hours depending on your content size).
Before payment you can send us one small file (100..500 kilobytes) and we will decrypt it!
It's your guarantee that we have decryption tool. (use your reference number as a subject to your message)
We don't know who are you, All what we need is some money.
Don't panic if we don't answer you during 24 hours. It means that we didn't received your letter and write us again.
You can use one of that bitcoin exchangers for transfering bitcoin.
https://localbitcoins.com
https://www.kraken.com
You dont need install bitcoin programs - you need only use one of this exchangers or other exchanger that you can find in www.google.com for your country.
Please use english language in your letters. If you don't speak english then use https://translate.google.com to translate your letter on english language.
You do not have enough time to think each day payment will increase by
0.1 BTC and after one week your privite key will be deleted and your files will be locked for ever.
People use cryptocurrency for bad choices,
but today you will have to use it to pay for your files!
It's your choice!
-
Ошибка в тексте записки - 15000 $ - относится к 2017 году.
Обновление от 17 октября 2018:
Ransomnix-Charm
Пост в Твиттере >>
Расширение: .charm
Записка: HOW_TO_RETURN_FILES.txt
Email: fmhir@protonmail.com
➤ Содержание записки:
Dear manager,
your database server has been locked, your databases files are encrypted and you have unfortunately "lost" all your data, Encryption was produced using unique key AES-256 generated for this server.
To decrypt files you need to obtain the decryption key and tool.
All encrypted files ends with .charm
To obtain the program for this server, which will decrypt all files, you need to write me to email: "fmhir@protonmail.com"
Before payment you can send us one small file (100..500 kilobytes) and we will decrypt it - it's your guarantee that we have decryption tool. And send us your userkey
We don't know who are you, All what we need is some money.
Don't panic if we don't answer you during 24 hours. It means that we didn't received your letter and write us again.
You can use one of that bitcoin exchangers for transfering bitcoin:
https://localbitcoins.com
https://www.kraken.com
You dont need install bitcoin programs - you need only use one of this exchangers or other exchanger that you can find in www.google.com for your country.
Please use english language in your letters. If you don't speak english then use https://translate.google.com to translate your letter on english language.
You don't have enough time to think each day payment will increase and after one week your key will be deleted and your files will be locked forever.
USERKEY:[redacted 0x100 bytes in base64]
Обновление от 20 октября 2018:
Ransomnix-Charm
Расширение: .charm
Записка: HOW_TO_RETURN_FILES.txt
Email: mdk4y@protonmail.com
➤ Содержание записки:
Dear manager,
your database server has been locked, your databases files are encrypted and you have unfortunately "lost" all your data, Encryption was produced using unique key AES-256 generated for this server.
To decrypt files you need to obtain the decryption key and tool.
All encrypted files ends with .charm
To obtain the program for this server, which will decrypt all files, you need to write me to email: "mdk4y@protonmail.com"
Before payment you can send us one small file (100..500 kilobytes) and we will decrypt it - it's your guarantee that we have decryption tool. And send us your userkey
We don't know who are you, All what we need is some money.
Don't panic if we don't answer you during 24 hours. It means that we didn't received your letter and write us again.
You can use one of that bitcoin exchangers for transfering bitcoin:
https://localbitcoins.com
https://www.kraken.com
You dont need install bitcoin programs - you need only use one of this exchangers or other exchanger that you can find in www.google.com for your country.
Please use english language in your letters. If you don't speak english then use https://translate.google.com to translate your letter on english language.
You don't have enough time to think each day payment will increase and after one week your key will be deleted and your files will be locked forever.
USERKEY:[redacted 0x100 bytes in base64]
Результаты анализов: VT + VMRay
Обновление от 23 декабря 2018:
Топик на форуме >>
Расширение: .crypt
Email: add1ct@yahoo.com
BTC: 1VirusnmipsYSA5jMv8NKstL8FkVjNB9o
➤ Содержание записки:
============================================================================
Dear manager, your server database has been locked, your databases and files are encrypted
and you have unfortunately "lost" all your data!
Encryption was produced using unique public key RSA-2048 generated for this server.
To decrypt files you need to obtain the private key.
All encrypted files ends with .Crypt
Your reference number: XXXXXX
To obtain the program for this server, which will decrypt all files, you need to pay 1 bitcoin on our bitcoin address 1VirusnmipsYSA5jMv8NKstL8FkVjNB9o.
Only we and you know about this bitcoin address.
You can check bitcoin balance here - https://www.blockchain.info/address/1VirusnmipsYSA5jMv8NKstL8FkVjNB9o
After payment send us your number on our mail add1ct@yahoo.com and we will send you decryption tool
(you need only run it and all files will be decrypted during 1...3 hours)
Before payment you can send us one small file (100..500 kilobytes) and we will decrypt it,
It is your guarantee that we have decryption tool. And send us your number with attached file.
We dont know who are you, All what we need is some money.
You can use one of that bitcoin exchangers for transfering bitcoin.
https://localbitcoins.com/
https://www.kraken.com/
You dont need install bitcoin programs - you need only use one of this exchangers or other exchanger
that you can find in www.google.com for your country.
Please use english language in your letters. If you dont speak english then use https://translate.google.com
to translate your letter on english language.
Your private key and the decryption tool linked to your reference number XXXXXX.
Note: your bill to decrypt your files will increase dailly by 0.1
================================================================
Обновление от 12 января 2019:
Расширение: .mdk4y
Записка: HOW_TO_RETURN_FILES.txt
Email: mdk4y@protonmail.com
Содержание записки аналогично предыдущей от 20 октября. Даже расширение в тексте не поменяли.
➤ Содержание записки:
Dear manager,
your database server has been locked, your databases files are encrypted and you have unfortunately "lost" all your data, Encryption was produced using unique key AES-256 generated for this server.
To decrypt files you need to obtain the decryption key and tool.
All encrypted files ends with .charm
To obtain the program for this server, which will decrypt all files, you need to write me to email: "mdk4y@protonmail.com"
Before payment you can send us one small file (100..500 kilobytes) and we will decrypt it - it's your guarantee that we have decryption tool. And send us your userkey
We don't know who are you, All what we need is some money.
Don't panic if we don't answer you during 24 hours. It means that we didn't received your letter and write us again.
You can use one of that bitcoin exchangers for transfering bitcoin:
https://localbitcoins.com
https://www.kraken.com
You dont need install bitcoin programs - you need only use one of this exchangers or other exchanger that you can find in www.google.com for your country.
Please use english language in your letters. If you don't speak english then use https://translate.google.com to translate your letter on english language.
You don't have enough time to think each day payment will increase and after one week your key will be deleted and your files will be locked forever.
USERKEY:
D4gn9BBYcRhY*****
Результаты анализов: VT + VMRay
Обновление от 19 июня 2019:
Пост в Твиттере >>
Расширение: .dmo
Записка: HOW_TO_RETURN_FILES.txt
Email: dmo9o4zB@protonmail.com
Результаты анализов: VT + HA + VMR
➤ Содержание записки:
Dear manager,
your database server has been locked, your databases files are encrypted and you have unfortunately "lost" all your data, Encryption was produced using unique key AES-256 generated for this server.
To decrypt files you need to obtain the decryption key and tool.
All encrypted files ends with .dmo
To obtain the program for this server, which will decrypt all files, you need to write me to email: "dmo9o4zB@protonmail.com"
Before payment you can send us one small file (100..500 kilobytes) and we will decrypt it - it's your guarantee that we have decryption tool. And send us your userkey
We don't know who are you, All what we need is some money.
Don't panic if we don't answer you during 24 hours. It means that we didn't received your letter and write us again.
You can use one of that bitcoin exchangers for transfering bitcoin:
https://localbitcoins.com
https://www.kraken.com
You dont need install bitcoin programs - you need only use one of this exchangers or other exchanger that you can find in www.google.com for your country.
Please use english language in your letters. If you don't speak english then use https://translate.google.com to translate your letter on english language.
You don't have enough time to think each day payment will increase and after one week your key will be deleted and your files will be locked forever.
USERKEY:
IIYisvQGH+tB31LA8KkkYYi85hQ85Xylzj9p9SQwMLHn6OfC7GuXoAKBmVzdpQMj/8RMp6f+j/0s***
Вариант от 14 января 2021:
Расширение: .ecnrypted
Записка: HOW_TO_RETURN_FILES.txt
Email: 7vTc3j1W4j@protonmail.com
➤ Содержание записки:
Dear manager,
your database server has been locked, your databases files are encrypted and you have unfortunately "lost" all your data, Encryption was produced using unique key AES-256 generated for this server.
To decrypt files you need to obtain the decryption key and tool.
All encrypted files ends with .charm
To obtain the program for this server, which will decrypt all files, you need to write me to email: "7vTc3j1W4j@protonmail.com"
Before payment you can send us one small file (100..500 kilobytes) and we will decrypt it - it's your guarantee that we have decryption tool. And send us your userkey
We don't know who are you, All what we need is some money.
Don't panic if we don't answer you during 24 hours. It means that we didn't received your letter and write us again.
You can use one of that bitcoin exchangers for transfering bitcoin:
https://localbitcoins.com
https://www.kraken.com
You dont need install bitcoin programs - you need only use one of this exchangers or other exchanger that you can find in www.google.com for your country.
Please use english language in your letters. If you don't speak english then use https://translate.google.com to translate your letter on english language.
You don't have enough time to think each day payment will increase and after one week your key will be deleted and your files will be locked forever.
USERKEY:
CiyNlyHRHeQbnDRroMKY
Вариант от 27 января 2021:
Расширение: .encrypt
Записка: README.txt
Email: 7vTc3j1W4j@protonmail.com
➤ Содержание записки:
Hello.
If you want back your files write to: 7vTc3j1W4j@protonmail.com
Your ID: HDB4gYVr7vGTQ864+BH***
=== БЛОК ССЫЛОК и СПАСИБОК = BLOCK OF LINKS AND THANKS ===
Read to links:
Tweet on Twitter
ID Ransomware
Write-up, Topic of Support
*
Thanks:
Amigo-A (Andrew Ivanov)
Bart, GrujaRS, Michael Gillespie
*
*
© Amigo-A (Andrew Ivanov): All blog articles.
