Les instructions de paiement via le réseau TOR s'affiche par une popup qui reste en avant plan mais aussi à travers un fichier HTML : _DECRYPT_INFO_xxxx.html contenant le message : WARNING ! your personal files are encrypted !
Les fichiers "README_HOW_TO_UNLOCK.TXT" et "README_HOW_TO_UNLOCK.HTML" contiennent aussi les instructions
Code : Tout sélectionner
Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.
Open http://bs7aygotd2rnjl4o.onion.link or
http://bs7aygotd2rnjl4o.torstorm.org or
http://bs7aygotd2rnjl4o.tor2web.org
in your browser. They are public gates to the secret server.
If you have problems with gates, use direct connection:
1) Download TOR Browser from http://torproject.org
2) In the Tor Browser open the http://bs7aygotd2rnjl4o.onion
(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).
Write in the following public key in the input from on server:
MW7SW-HTATJ-E248X-TBBGS-VAR2X-XZTXK-1V2B6-6U4PE-8HMXR-34NSH-MTKX3-YKA8Z-AC0QF-DPQ4E
SYVRW-0068W-S36HS-D2BMG-UCKAT-HGFC8-W3MTW-F2FQD-6M0E1-D05NW-RKTB1-2Z25T-F2R73-5FEEJ
HMV65-XHK1N-HWG8S-5XJ5D-EYUEU-A33SB-WWMBF-3ZMVG-K1XU1-5666D-FXNCQ-7Y62Y-42AUV-B4YB5
GRWWJ-SACDY-A2DC4-MWF33-TXZJK-8ZPH1-STWRS-HDFEV-EPENJ-C3DZM-SRNVM-UDW31-2X3BE-VGHFQ
3MQYF-ZKUNP-UY4BH-6KCEV-HCQ00-XAAYJ-ATX86-VH48S-M3RPG-F7ZR6-RS8MV-12K0Z-6315P-UJTS0
QSPVE-GPGDV-4NJZ2-DFSRW-C3ZK4-X3M6D-TVTHX-R4UPQ-S1ESJ-ZAY8G-TP7N1-CJGEB
Les résultats du scan Virustotal:
SHA256: f5ab764c439a45ed892a3346f228d36f24d7f2377d4cddc5e82a0566f8521082
Nom du fichier : SafariBacktrack
Ratio de détection : 26 / 56
Date d'analyse : 2016-03-21 11:29:37 UTC (il y a 1 heure, 22 minutes)
AVG FileCryptor.ISI 20160321
Ad-Aware Trojan.GenericKD.3108803 20160321
AegisLab Troj.Downloader.W32.Cabby!c 20160321
Arcabit Trojan.Generic.D2F6FC3 20160321
Avast Win32:Malware-gen 20160321
Avira (no cloud) TR/FileCoder.235008 20160321
BitDefender Trojan.GenericKD.3108803 20160321
Bkav HW32.Packed.C971 20160319
ESET-NOD32 Win32/Filecoder.NGB 20160321
Emsisoft Trojan.GenericKD.3108803 (B) 20160321
F-Secure Trojan.GenericKD.3108803 20160321
GData Trojan.GenericKD.3108803 20160321
Ikarus Trojan.Win32.Filecoder 20160321
K7AntiVirus Trojan ( 004e0e031 ) 20160321
K7GW Trojan ( 004e0e031 ) 20160321
Kaspersky Trojan-Downloader.Win32.Cabby.ziprf 20160321
Malwarebytes Ransom.FileLocker 20160321
McAfee Artemis!74ADD6536CDC 20160321
McAfee-GW-Edition BehavesLike.Win32.Expiro.dc 20160321
eScan Trojan.GenericKD.3108803 20160321
Panda Trj/GdSda.A 20160320
Qihoo-360 HEUR/QVM10.1.Malware.Gen 20160321
Rising PE:Malware.RDM.12!5.12 [F] 20160321
Tencent Win32.Trojan-downloader.Cabby.Ahyr 20160321
VIPRE Trojan.Win32.Generic!BT 20160321
nProtect Trojan.GenericKD.3108803 20160321
→ https://blog.malwarebytes.org/threat-an ... dangerous/
Sécuriser son Windows
Afin de sécuriser son Windows et éviter les ransomwares et d'autres menaces connues sur la toile, suivre le tutoriel de sécurisation de son Windows.
=> Sécuriser son Windows.