문ሖ1; 1060;상한 파1068;1060; 1080;Ǻ12; 보니 8/21088; DŽ16;1676;/196; 1200;1109;돼 1080;lj16; KRAB-DECRYPT.txt 1077;니다. 아래 같1008;내용1004;/196;...
윈10, 카스6140;스Ȗ12; 깔/140; 1080;lj16;데, D, E 드라1060;브 root에 아래 같1008; 파1068;1060; 1316;1116;Ȣ16;더군요. 근데, 1200;lj16; 사실 아무 변화? 없1060; .160;달 ᇼ1;안 1096; 사용Ȣ16;고 1080;었습니다.
카스6140;가 ኔ1;1008; ,163;1064;가요? ǹ16;튼 1204;산Ȝ16;에 오늘에야 0156;견Ȣ16;고 신고 했더니... 1092;말 말고 포맷Ȣ16;라고... 1060;0120;1648; 떠 놓1008; ,163;도 1328; 비실비실한 상태였Nj12; ,144;라 1060;참에 포맷Ȣ16;/140;고 Ȣ16;lj12;데, ,160;색해 보니 Fake 랜섬1008; 아니더군요.
ᕬ1;시 1060;런 상황(불행 1473; 다행1077;니다만) 설명해 1452;실 ǥ16; 계신1648;요.
고맙습니다.
-----------------KRAB-DECRYPT.txt 내용 -------------------------------------------------
---= GANDCRAB V4  =--- 
Attention! 
All your files, documents, photos, databases and other important files are encrypted and have the extension: .KRAB 
The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
----------------------------------------------------------------------------------------
| 0. Download Tor browser - https://www.torproject.org/ 
| 1. Install Tor browser 
| 2. Open Tor Browser 
| 3. Open link in TOR browser:   http://gandcrabmfe6mnef.onion/8abc99065aaf7930                        
| 4. Follow the instructions on this page 
----------------------------------------------------------------------------------------                    
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. 
ATTENTION!
IN ORDER TO PREVENT DATA DAMAGE:
* DO NOT MODIFY ENCRYPTED FILES
* DO NOT CHANGE DATA BELOW
---BEGIN GANDCRAB KEY---
lAQAADLI/O+UWzuF/6P61/heX/T892OXUW50vUcITPyjFGx+ucXAK47mEVVWamsuGkcp/YXF55tnPOlF62JNZnKnOqDwgmkqvhMVe1zGMH9Z6xZX1mTyOaX6+FpL4ALsVB26EaZy48ClPh/hh3UvhDE2BwFH8MOhQ9aJGyQlAkloyYb7yexA08/X720mLMr3Jj91rPZGA0zHg58YwvlT8gtTh5S9auYrE+Z+k+siupgUoMqDhJomq+J4eBmOCWlY6/DOdOUj451C/7Nt62kStrVVduBdEIgMskR4nn8BMB/0NsBrpIiGgLyipPlOFByRm6VsuQWJ+Y3bv04vKpXQ/0dIpYYCNCi7WMLaevy8BE1/bpLz6ATR1hWzfuIw4L2qQL+NspM81LqFoizz3Y5ntrQ388tqSe4L8Do+eZ62LdkqjN4yaN17m3Gvj6IYxAgWL6ZSwco0FqNIHj0Kc691anbjfA67vAmMWbZ+C1Xyi+81EPQW+NevKe96CnQkb5U3X3S3LJMzNugva579C3wsegmuekJTYFBH0fvnrKc//SE2xh9mSTELzDiesLVBNNi8dDOQMjsPHw1I/QLKErUTv7l6GtV09nt43+qskkrJg5CN+JU8YuE9Inrg7I0qriUYPDXXKf6+KlxjW1olc6ALlsaSZMh23eAEUQRsG78RV/vSvbiHBZp0rUr4A5v6szLLqpN32tj1xBfSnMHotba/sZ3QGnAYY5GglXPqFbXRFKiClfzhZYuby7jaIJLp4n9RdPExAL6R88NlPiHOdnXpX8YZsMCA+itQZQOlwzT5Fzw26XKzNklvj/j0TV2sl37NnZTt2GGsRI3FQPWO1sDjBZJFAnPH+V5s1wlB7OD4CwAUQJKwjnk6XFuj2691FrsC21y0iZJGg4yWJxM9KxJlb3hhAlGw85yTYGtKwDW/n8VsLIcXeparZj22hCg6nEZtkqGmudK0hmPKbZKAzNG2WCBfm8Al/ZJpqJkc5px6COc2BgKVEfSoG11+iYYlG1SQrCVj7j3jGhYtz7iQaFeW00sKx1bX4JHDwu3ur8WImWjT8ZnAdOpJj2Qo9V+7YKWdhcBxJyOxTQ/EJUi5H+HwbTwpfGIH9GwvML8CD4LgAJ6YgWEa2zdErXHQF5oT5X4rETGrCrZ6x0LA53L0qvErCzfdUDd4wbOMX8q/nsslCks17N6LQ8QpFjyL4526NkXfFCWVFLkreqsKxjSXkm+eRIF4m1rtKX8VPuP1SJDvUplVcLd3DKlrKFWvDgcdKJPYlkOCBcb1ngxPR/sLit2DuZfz6RpRdPryz/3RvmYnTZwnRACJZHBnzoe+O5pQXo8Uwx2Rnf1nhNdc8dBWs9vJPcxllmR9YARIupxxbK6xPmQkj90h9ZPsHDROJDXR4H+Bfog7MxQzf8s/mNzXaWuraLphn6kZ/SJlgwjPjW5tjZMW+gOLm4RCmcsk/JWIy6Sp19Duj4Xo0Y25aqv5yp/zf7AQbuaBw/JIuSq3yDGw34f5OnAn+FEjcPYqmt+YC8rDQvqaAjVufZPDlQ0Z30wCl0mLV9i9EmmbC1V28E3UYXXnTXTZU7OAX6ihZMToUCO5I7x+r1rILRQgC53KoedmBN99w09IIsHVN2fJ5pEoTEXETnaEINezY0dTONnWb+zLNn2mDwovc3G1IOXjpfK2OLAXoeoT6PN2W5s8iaTjbKi48qYetzlLrRipvEx8dEPdC5wxmFtm9NZz8fORUBR/xY3RJUW6FgZSZ/fxqaNORyT2Iza9iRsfHWCgEv6e6nqQq3JxmbOesUur1ASOIic9UzKWblZ496JbcwhPhbZCm+SjlFW8leS3j6BVFuxKkl7zh4kYra0CfzvyXyyR4Pt0DKyNT6IO3GsQ6UIcin877+XRmeY7VXZadIDeCjvJidrEP6ldkyA8ThV5FijsW6ABqLotpAkX5tuhOuIGU5u1E+Vqud/wF2Ope/B+FWOBKRsCH3wXkXsNTNPEYhQw/S51rqdVhSXPHxBcQMUWHZdwXmNikCYi01tMzCDwVLbLkD3PGENsZPdtUrQnV6dDd7NEdHywbrdzdrt12C78JLpUjMw+M935nvI0AyycdXGYzYhq+uf7vWIuqhE1mPdg6vJGkqkn6GqezCpiORdCR1F6Vq+QMNb70edLBX1Yi9oOzoU7YeEwj2QWejd+9+sSq2zwIXayiOUIN5F5uLm9WjRyUksiVqce/bMTa/6VeZAOIacWBrufq+jVXyI=
---END GANDCRAB KEY---
---BEGIN PC DATA---
wfKD6iudumBkmpL8IRr4U+Z2TYDF8D3t3jxjOpv1xlYovOuWNx4WYYldz5ZdTphRsXYR7mdWq7faTHWH5R5YBLDzo9Mu7+n6TUGEDBbiCpJj89LFMP/fmBOoBJAGLoqj/Px82WjxHJK0ip6hCUS4AqkAxrZKOPCX8LmabVUkcnQybcSWqsC4YYlYBKSExt8pE45r28KAR1KIZBdV4APFuUncZiJ92P2MZ0OQMJQPkYpNLF2TNJxXmtEoWXZvP+o/CfqF1shzlzbajcJAFXgll55nRd1rCDYxfQ7cDMQr7n1+SmjFHw+tkbsta9iVqcCnrbr95/tivLExkSfBsuL9/yI2HOtuGt1YaFqVBmXt/BGIEZob/idP4ra4Yqa1Y8ZyYYzy2SmikpQSTWYqblO5JIcJ8pE5wIQoAxPBnKw+Cu5JAOef2WFig6FrWw3jxHhKuQ6fZlrpfREi3vTLM+ar1wIZN3QTRlWKfznV1lPgcH8NmVffniz2QU5nm7Ivlsiw63IKVYrpeDf8fAgcCMBpPwBN+38+QwTCr6YtEuHtKkipBYBMapH1HpMOdL/KRdAPool+V7zu5LPJzMH9PXYCh8kz7exNRfttXf/Ybj/WouJkXppeRdRS9CphT1Kp2tFgkGnbLVMzkAsBfmD5HmFciTgEzbIBT7jbCwFzKdv/zDNsdHM3u24NfaiU43JgLfS8Uh0YXfIDE9YvjSbfmwqIwmcu1sV4mOTgkIqgOnBtESt+DiZI4BsYYF0C8rwBZhQyr8sbO8ilfU/VrqtOlo8nQ+7Dgu6+4+vlvy373JlhOvnU5+g1lMo=
---END PC DATA---
설명이 필요없을텐데요. 본인 부주의 - 감염, 끝.
폴더 마다 CRAB-DECRYPT.txt 파일들을 심어두었는데, 파일들에 대한 암호화는 진행되지 않았습니다.
파일들을 암호화 하는 랜섬이었다면 이미 암호화 완료되었을 터인데, 멀쩡하였습니다.
사용하는 백신은 V3와 AntiLansumWare 입니다.
C 드라이버는 고스트 이미지를 풀어서 복원했고, 데이타 드라이버에는 무단 설치된 파일들을 검색해서 모조리 삭제하였습니다.
데이타 파일을 백업 해둔 별도 디스크는 있었지만, 긴장 상태를 유지하면서 계속 사용해봤는데, 더 이상의 별다른 오류는 발생치 않았습니다.
나 홀로 작업하는 환경이라 위험한 모험을 감행해본 것이지만, 다른 사용자들과 같이 작업하는 환경이라면 깨끗하게 포맷하는 것이 필요하리라 생각합니다.
CRAB-DECRYPT.txt 파일의 내용입니다.
---= GANDCRAB V2.1 =---
Attention!
All your files documents, photos, databases and other important files are encrypted and have the extension: .CRAB
The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.
The server with your key is in a closed network TOR. You can get there by the following ways:
0. Download Tor browser - https://www.torproject.org/
1. Install Tor browser
2. Open Tor Browser
3. Open link in TOR browser: http://gandcrab2pie73et.onion/fbb50603be68046e
4. Follow the instructions on this page
If Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:
0. https://gandcrab2pie73et.onion.rip/fbb50603be68046e
1. https://gandcrab2pie73et.onion.plus/fbb50603be68046e
2. https://gandcrab2pie73et.onion.to/fbb50603be68046e
ATTENTION! Use regular browser only to contact us. Buy decryptor only through TOR browser link or Jabber Bot!
On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.
The alternative way to contact us is to use Jabber messanger. Read how to:
0. Download Psi-Plus Jabber Client: https://psi-im.org/download/
1. Register new account: http://sj.ms/register.php
0) Enter "username": fbb50603be68046e
1) Enter "password": your password
2. Add new account in Psi
3. Add and write Jabber ID: ransomware@sj.ms any message
4. Follow instruction bot
It is a bot! It's fully automated artificial system without human control!
To contact us use TOR links. We can provide you all required proofs of decryption availibility anytime. We are open to conversations.
You can read instructions how to install and use jabber here http://www.sfu.ca/jabber/Psi_Jabber_PC.pdf
DANGEROUS!
Do not try to modify files or use your own private key - this will result in the loss of your data forever!