Ransom Note: h0lygh0st.html
Group: H0lygh0st
<html>
<head>
<style>
display: block
margin-left: auto
margin-right: auto
text-align:center
</style>
<img src="https://cloud-ex42.usaupload.com/cache/plugins/filepreviewer/374400/e13cb2db4180993642e2a5b800ec86206e0a0a4885349964868ad20c14f04ceb/1100x800_cropped.jpg" alt="H0lyGh0st" style="width:20%
</head>
<body>
<h1>Please Read this text to decrypt all files encrypted.</h1>
<p>We have uploaded all files to cloud. Url: <b><a href=https://[snip].com/5YYK/prime.7z></a></b></p>
<p>Don't worry, you can return all of your files immediately if you pay.</p>
<p>If you want to restore all of your files, Send mail to <b>%s</b> with your Id. Your ID is <b>%s</b></p>
<p>Or install tor browser and contact us with your id or <b>company name</b>(If all of pcs in your company are encrypted).</p>
<p>Our site : <b><a href=%s>H0lyGh0stWebsite</a></b></p>
<h1>Our Service</h1>
<p>After you pay, We will send unlocker with decryption key</p>
<h1>Attention
<p><b>1. Do not rename encrypted files.</b></p>
<p><b>2. Do not try to decrypt your data using third party software, it may cause permanent data loss.</b></p>
<p><b>3. Decryption of your files with the help of third parties may cause increase price.</b></p>
<p><b>4. Antivirus may block our unlocker, So disable antivirus first and execute unlocker with decryption key.</b></p>
</body>
</html>
Indicators of Compromise
| Type | IOC |
|---|---|
session id
|
e13cb2db4180993642e2a5b800ec86206e0a0a4885349964868ad20c14f04ceb
|
