Share this page!

Jakub Kroustek Profile picture
Twitter logo
22 Jan 19, 184 tweets, 183 min read
#CrySiS/#Dharma #ransomware again and again: extensions ".USA" and ".xwx", extortion email addresses "usacode@aol.com" and "data@decoding.biz". virustotal.com/#/file/35ade95… virustotal.com/#/file/60f5a7a… cc @demonslay335
'.best' - 'bestdecoding@cock.li' - virustotal.com/#/file/73bf556…
'.qwex' - 'backdata@qq.com' #CrySiS #Dharma #ransomware virustotal.com/#/file/b50caa0… cc @demonslay335
'.ETH' - helpfilerestore@india.com - virustotal.com/#/file/f6b1831…
'.air' - 'satco@tutanota.com' - virustotal.com/#/file/e0259f5…
'.888' - donald888@mail.fr - virustotal.com/#/file/8e31a1b…
'.amber' and '.frend' - 'korvin0amber@cock.li' and 'undogdianact1986@aol.com' - virustotal.com/#/file/ca8f6f2… and virustotal.com/#/file/3235e03… - cc @demonslay335 and @gexcolo #CrySiS #Dharma #ransomware
'.KARLS' - 'karlosdecrypt@outlook.com' - virustotal.com/#/file/c52e8e2… cc @demonslay335 #CrySiS #Dharma #ransomware
'.aqva' - 'crypted_files@qq.com' - virustotal.com/#/file/57b7d93… cc @demonslay335 #CrySiS #Dharma #ransomware
'.AYE' - 'sebekgrime@tutanota.com' - virustotal.com/#/file/3145ce9… … cc @demonslay335 #CrySiS #Dharma #ransomware
'.korea' - 'omfg@420blaze.it' - virustotal.com/#/file/068f9ed… cc @demonslay335 #CrySiS #Dharma #ransomware
'.NWA' - 'dr.crypt@aol.com' - virustotal.com/#/file/e18a042… #CrySiS #Dharma #ransomware
'.com' 🤦‍♂️ - 'trupm@protonmail.com' - virustotal.com/#/file/b8a8764… #CrySiS #Dharma #ransomware
'.azero' - 'cryptor55@cock.li' - virustotal.com/#/file/07d0532… #CrySiS #Dharma #ransomware - cc @gexcolo
another '.com' variant with contact email address 'ht2707@email.vccs.edu' 🙁virustotal.com/#/file/3275c6d… #CrySiS #Dharma #ransomware
'.bk666' - 'berserk666@tutanota.com' - virustotal.com/#/file/9b4612a… #CrySiS #Dharma #ransomware
'.ms13' - 'ms_13@aol.com' - virustotal.com/#/file/7459000… #CrySiS #Dharma #ransomware
'.carcn' - 'carcinoma24@aol.com' - virustotal.com/#/file/482722e… #CrySiS #Dharma #ransomware
'.btix' - 'encrypt11@cock.li' - virustotal.com/#/file/6a9fe57… #CrySiS #Dharma #ransomware cc @gexcolo
'.LOVE' - 'seeyoubro@tutanota.com' - virustotal.com/#/file/1c5c91b… - #CrySiS #Dharma #ransomware #MakeLoveNotRansomware
'.video' - 'tetty86@cock.li' - virustotal.com/#/file/1823504… … - #CrySiS #Dharma #ransomware - cc @demonslay335 @gexcolo
'.MERS' - 'crypt1style@aol.com' - virustotal.com/#/file/14397f1… - #CrySiS #Dharma #ransomware
'.bat' 🤦‍♂️ - 'idecryptyourdata@cock.li' and 'decryptyourdata@qq.com' - virustotal.com/#/file/907f48f… and virustotal.com/#/file/b9ba378… - #CrySiS #Dharma #ransomware - cc @demonslay335 @gexcolo
'.qbix' - 'backdata@qq.com' - virustotal.com/#/file/abbcff7… - #CrySiS #Dharma #ransomware - cc @demonslay335
more and more variants coming - '.aa1' - 'who8@mail.fr' - virustotal.com/#/file/4b82718… and '.wal' - 'decryptdocs@protonmail.com' - virustotal.com/#/file/955544a… #CrySiS #Dharma #ransomware - cc @demonslay335
'.qbtex' - '1btc@decryption.biz' - virustotal.com/#/file/4711834… #CrySiS #Dharma #ransomware - cc @demonslay335
'.yG' - 'sysadmin@mail.fr' - virustotal.com/#/file/27e7b3e… #CrySiS #Dharma #ransomware - cc @demonslay335
'.drweb' 🤣 - 'dr.web24@aol.com' - virustotal.com/#/file/0cecae2… #CrySiS #Dharma #ransomware - cc @demonslay335
@DrWeb_antivirus
'.jack' - 'lockhelp@qq.com' - virustotal.com/#/file/57cc351… and '.PLUT' - 'adolfhackler@tutanota.com' - virustotal.com/#/file/f70ea3e… #CrySiS #Dharma #ransomware - cc @demonslay335
'.DDOS' - 'decripted@cock.li' - virustotal.com/#/file/e66e746… #CrySiS #Dharma #ransomware - cc @demonslay335 @gexcolo
'.cry' - 'decryptoperator@qq.com' - virustotal.com/#/file/9c63223… #CrySiS #Dharma #ransomware - cc @demonslay335
'.4k' - 'rocosmon@cock.li' - virustotal.com/#/file/f7dbe91… #CrySiS #Dharma #ransomware - cc @demonslay335 @gexcolo
'.TOR13' - 'chanelcrypt@aol.com' - virustotal.com/#/file/22b683b… #CrySiS #Dharma #ransomware - cc @demonslay335
'.good' - 'onecrypt@aol.com' - virustotal.com/#/file/51e52c4… #CrySiS #Dharma #ransomware - cc @demonslay335
'.beets' - 'vombombom@cock.li' - virustotal.com/#/file/f6708ae… #CrySiS #Dharma #ransomware - cc @demonslay335 @gexcolo
'.BSC' - 'basecrypt@aol.com' - virustotal.com/gui/file/2e049… #CrySiS #Dharma #ransomware - cc @demonslay335
'.zoh' - 'restdoc@protonmail.com' - virustotal.com/gui/file/5a612… #CrySiS #Dharma #ransomware - cc @demonslay335
'.kjh' - 'datareturn@protonmail.com' - virustotal.com/gui/file/52259… #CrySiS #Dharma #ransomware - cc @demonslay335
'.html' 🤦‍♂️ - 'paydra@cock.li' - virustotal.com/gui/file/4e172… #CrySiS #Dharma #ransomware - cc @demonslay335 @gexcolo
'.harma' - 'ban.out@foxmail.com' - virustotal.com/gui/file/32d53… #CrySiS #Dharma #ransomware - cc @demonslay335
'.HACK' - 'mr.hacker@tutanota.com' - virustotal.com/gui/file/5d4e9… #CrySiS #Dharma #ransomware - cc @demonslay335
'.xxxx' - 'decryptxxx@protonmail.com' - virustotal.com/gui/file/c6517… #CrySiS #Dharma #ransomware - cc @demonslay335
'.php' + '.dqb' - 'back_me@foxmail.com' + 'btcdecoding@qq.com' - virustotal.com/gui/file/ac4a4… + virustotal.com/gui/file/fd3a4… #CrySiS #Dharma #ransomware - cc @demonslay335
'.1BTC' - 'btcdecoding@foxmail.com' - virustotal.com/gui/file/cac6e… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 '.com2' - 'DonovanTudor@aol.com' - virustotal.com/gui/file/96531… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 '.Acuf2' - 'panama777@tutanota' - virustotal.com/gui/file/5b420… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 '.nqix' - 'support@qbmail.biz' - virustotal.com/gui/file/a847f… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 '.Q1G' - 'getbtc@aol.com' - virustotal.com/gui/file/44586… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 '.pdf' 🤦‍♂️ - 'decryptbots@cock.li' - virustotal.com/gui/file/77122… #CrySiS #Dharma #ransomware - cc @demonslay335 @gexcolo
@demonslay335 @gexcolo '.cmd' 🤦‍♂️ - 'jsmith1974@mail.fr' - virustotal.com/gui/file/b39b8… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.MGS' - 'mrcrypt@cock.li' - virustotal.com/gui/file/54a6c… #CrySiS #Dharma #ransomware - cc @demonslay335 @gexcolo
@demonslay335 @gexcolo '.RSA' - 'rsa1024@tutanota.com' - virustotal.com/gui/file/6bf30… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.ebola' - 'newebola@aol.com' - virustotal.com/gui/file/65312… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.money' - 'cmdroot@airmail.cc' - virustotal.com/gui/file/95129… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.VIVAL' - 'vivaldicrypt@outlook.com' - virustotal.com/gui/file/5cae1… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.CASH' - 'cryptocash@aol.com' - virustotal.com/gui/file/1cc40… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.KRAB' - 'Blackmax@tutanota.com' - virustotal.com/gui/file/0fa6d… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.oo7' - 'b1tc01n@aol.com' - virustotal.com/gui/file/55ce1… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.bot' - 'nmode@tutanota.com' - virustotal.com/gui/file/35b61… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.wiki' - 'bitlocker@foxmail.com' - virustotal.com/gui/file/598bb… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.PBD' - 'paybuyday@aol.com' - virustotal.com/gui/file/3411a… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.one' - 'back_me@foxmail.com' - virustotal.com/gui/file/487a1… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.xda' - 'fullrestore@qq.com' - virustotal.com/gui/file/31409… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.asus' - 'DataBack@qbmail.biz' - virustotal.com/gui/file/a3e9b… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.start' - 'starter@cumallover.me' - virustotal.com/gui/file/d1609… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.VIRUS' - 'amandacerny89@aol.com' - virustotal.com/gui/file/bbb4d… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.rsa' - 'rsacrypt@aol.com' - virustotal.com/gui/file/3a26e… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.kr' - 'blablacar@airmail.cc' - virustotal.com/gui/file/8edf3… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.ninja' - 'ninja777@cock.li' - virustotal.com/gui/file/a3fbf… #CrySiS #Dharma #ransomware - cc @demonslay335 @gexcolo
@demonslay335 @gexcolo '.SySS' - 'syspentest@aol.com' - virustotal.com/gui/file/51c57… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.ROGER' - 'backdata.company@aol.com' - virustotal.com/gui/file/82ba3… #CrySiS #Dharma #ransomware - cc @demonslay335
@demonslay335 @gexcolo '.asd' - 'asdbtc@aol.com' - virustotal.com/gui/file/64e78… #CrySiS #Dharma #ransomware
@demonslay335 @gexcolo '.mr.crypteur@protonmail.com' - 'WHY' - virustotal.com/gui/file/336ef… #CrySiS #Dharma #ransomware
@demonslay335 @gexcolo '.LIVE' - 'cryptlive@aol.com' - virustotal.com/gui/file/9f5e7… #CrySiS #Dharma #ransomware
@demonslay335 @gexcolo '.Z9' - 'help.me24@protonmail.com' - virustotal.com/gui/file/98f2c… #CrySiS #Dharma #ransomware
@demonslay335 @gexcolo '.ncov' - '𝗰𝗼𝗿𝗼𝗻𝗮𝘃𝗶𝗿𝘂𝘀@𝗾𝗾.𝗰𝗼𝗺' - virustotal.com/gui/file/dddf7… #CrySiS #Dharma #ransomware #coronavirus🤦‍♂️
@demonslay335 @gexcolo '.self' - 'black@gytmail.com' - virustotal.com/gui/file/270e4… #CrySiS #Dharma #ransomware
@demonslay335 @gexcolo '.PAY' - 'decrypt@qbmail.biz' - virustotal.com/gui/file/870a9… #CrySiS #Dharma #ransomware
@demonslay335 @gexcolo '.NcOv' - 'ncov2020@aol.com' - virustotal.com/gui/file/3bcf1… #CrySiS #Dharma #ransomware🤦‍♂️
@demonslay335 @gexcolo '.PLEX' - 'dryidik@tutanota.com' - virustotal.com/gui/file/46082… #CrySiS #Dharma #ransomware
@demonslay335 @gexcolo '.rxx' - 'back_data@foxmail.com' - virustotal.com/gui/file/69859… #CrySiS #Dharma #ransomware
'.GTF' - 'grandtheftfiles@aol.com' - virustotal.com/gui/file/109fa… #CrySiS #Dharma #ransomware
'.Mark' - 'mark_white@mail.ua' - virustotal.com/gui/file/0eb5b… #CrySiS #Dharma #ransomware
'.IPM' - 'Decoding@qbmail.biz' - virustotal.com/gui/file/4ae80… #CrySiS #Dharma #ransomware
'.LX' - 'help.crypt@aol.com' - virustotal.com/gui/file/5dbc5… #CrySiS #Dharma #ransomware
'.C-VIR' - 'coronavirus@foxmail.com' - virustotal.com/gui/file/e71a1… #CrySiS #Dharma #ransomware #fuckers
'.2020' - 'btckeys@aol.com' - virustotal.com/gui/file/5837d… #CrySiS #Dharma #ransomware
'.dec' - 'de_cryption@tuta.io' - virustotal.com/gui/file/7a862… #CrySiS #Dharma #ransomware
'.love$' - 'im.online@aol.com' - virustotal.com/gui/file/e63f6… #CrySiS #Dharma #ransomware
'.0day0' - 'day_0@aol.com' - virustotal.com/gui/file/2d81b… #CrySiS #Dharma #ransomware
'.PHP' - 'decspeed@tutanota.com' - virustotal.com/gui/file/47f3e… #CrySiS #Dharma #ransomware
'.BANG' - 'gangflsbang@protonmail.ch' - virustotal.com/gui/file/ee277… #CrySiS #Dharma #ransomware
'.space' - 'Mail@qbmail.biz' - virustotal.com/gui/file/23af9… #CrySiS #Dharma #ransomware
'.BOMBO' - 'Bit_decrypt@protonmail.com' - virustotal.com/gui/file/30707… #CrySiS #Dharma #ransomware
'.ONE' - 'onepconebtc@protonmail.com' - virustotal.com/gui/file/7cb8e… #CrySiS #Dharma #ransomware
'.FRM' - 'hitsbtc@tuta.io' - virustotal.com/gui/file/0c3a4… #CrySiS #Dharma #ransomware
'.wch' - 'wecanhelpu@tuta.io' - virustotal.com/gui/file/40321… #CrySiS #Dharma #ransomware
'.club' - 'admin@stelsdatas.com' - virustotal.com/gui/file/d4de6… #CrySiS #Dharma #ransomware
'.hlpp' - 'hlpp@protonmail.ch' - virustotal.com/gui/file/48ffa… #CrySiS #Dharma #ransomware
'.dr' - 'dr.decrypt@aol.com' - virustotal.com/gui/file/537d6… #CrySiS #Dharma #ransomware
'.pgp' - 'openpgp@foxmail.com' - virustotal.com/gui/file/371e8… #CrySiS #Dharma #ransomware
'.hack' - 'mr.hackpr0@aol.com' - virustotal.com/gui/file/96905… #CrySiS #Dharma #ransomware
'.HCK' - 'cavefat@tuta.io' - virustotal.com/gui/file/2c37c… #CrySiS #Dharma #ransomware (including powershell scripts)
'.r3f5s' - 'r3ad4@aol.com' - virustotal.com/gui/file/12c24… #CrySiS #Dharma #ransomware
'.bad' - 'ucos2@elude.in' - virustotal.com/gui/file/4d48d… #CrySiS #Dharma #ransomware
'.lxhlp' - 'lxhlp@protonmail.com' - virustotal.com/gui/file/78c67… #CrySiS #Dharma #ransomware
'.HOW' - 'how_decrypt@aol.com' - virustotal.com/gui/file/aaa58… #CrySiS #Dharma #ransomware
'.NHLP' - 'newhelper@protonmail.ch' - virustotal.com/gui/file/75631… #CrySiS #Dharma #ransomware
'.gyga' - 'gygabot@cock.li' - virustotal.com/gui/file/9de6a… #CrySiS #Dharma #ransomware - cc @gexcolo
'.bmtf' - 'dfgkbtprz@aol.com' - virustotal.com/gui/file/ba373… #CrySiS #Dharma #ransomware
'.prnds' - 'prndssdnrp@mail.fr' - virustotal.com/gui/file/eba0e… #CrySiS #Dharma #ransomware
'.null' - 'nullcipher@cock.li' - virustotal.com/gui/file/41503… #CrySiS #Dharma #ransomware - cc @gexcolo
'.felix' - 'felix@countermail.com' - virustotal.com/gui/file/83ef5… #CrySiS #Dharma #ransomware
'.GNS' - 'geniusid@protonmail.ch' - virustotal.com/gui/file/4efa2… #CrySiS #Dharma #ransomware
'.data' - 'data@recovery.sx' - virustotal.com/gui/file/97157… #CrySiS #Dharma #ransomware
'.smpl' - 'crimecrypt@aol.com' - virustotal.com/gui/file/fbbe5… #CrySiS #Dharma #ransomware
'.HAT' - 'Zagrec@protonmail.com' - virustotal.com/gui/file/5d501… #CrySiS #Dharma #ransomware
'.LOG' - 'Logan8833@aol.com' - virustotal.com/gui/file/e59eb… #CrySiS #Dharma #ransomware
'.xati' - 'xatixxatix@mail.fr' - virustotal.com/gui/file/bd119… #CrySiS #Dharma #ransomware
'.GET' - 'getscoin2@protonmail.com' - virustotal.com/gui/file/dd0be… #CrySiS #Dharma #ransomware
'.Back' - 'Backdata@zimbabwe.su' - virustotal.com/gui/file/62e7e… #CrySiS #Dharma #ransomware
'.abc' - 'abc@countermail.com' - virustotal.com/gui/file/210df… #CrySiS #Dharma #ransomware
'.get' - 'getthefiles@protonmail.com' - virustotal.com/gui/file/
8f207c96ba8dec4304b6c394afd5e93266fa756018930fe70c201051fce7be94 #CrySiS #Dharma #ransomware
'.cl' - 'cl_crypt@aol.com' - virustotal.com/gui/file/b7a4b… #CrySiS #Dharma #ransomware
'.blm' - 'blacklivesmatter@qq.com' - virustotal.com/gui/file/3ffdc… #CrySiS #Dharma #ransomware
'.TEREN' - 'databack44@tuta.io' - virustotal.com/gui/file/da4a0… #CrySiS #Dharma #ransomware
'.fresh' - 'freshkart@420blaze.it' - virustotal.com/gui/file/00ce7… #CrySiS #Dharma #ransomware
'.FLYU' - 'yourfiles1@tutanota.com' - virustotal.com/gui/file/b565c… #CrySiS #Dharma #ransomware
'.gtsc' - 'getscoin3@protonmail.com' - virustotal.com/gui/file/62930… #CrySiS #Dharma #ransomware
'.dme' - 'decrypttme@airmail.cc' - virustotal.com/gui/file/e4a43… #CrySiS #Dharma #ransomware
'.LCK' - 'triplock@tutanota.com' - virustotal.com/gui/file/7deeb… #CrySiS #Dharma #ransomware
'.Crypt' - 'Decrypt@msgsafe.io' - virustotal.com/gui/file/d34b9… #CrySiS #Dharma #ransomware
'.259' - '259461356@qq.com' - virustotal.com/gui/file/23651… #CrySiS #Dharma #ransomware
'.kut' - 'kuk1@tuta.io' - virustotal.com/gui/file/08c3e… #CrySiS #Dharma #ransomware
'.dex' - 'decryptex@airmail.cc' - virustotal.com/gui/file/e181f… #CrySiS #Dharma #ransomware
'.sss' - 'm5b92n5p1@mail.com' - virustotal.com/gui/file/f12d0… #CrySiS #Dharma #ransomware
'.zimba' - 'backup@zimbabwe.su' - virustotal.com/gui/file/3510d… #CrySiS #Dharma #ransomware
'.help' - 'linas89@aol.com' - virustotal.com/gui/file/7d921… #CrySiS #Dharma #ransomware
'.cvc' - 'patrik008@tutanota.com' - virustotal.com/gui/file/a8c64… #CrySiS #Dharma #ransomware
'.SWP' - 'eusa@tuta.io' - virustotal.com/gui/file/c376e… #CrySiS #Dharma #ransomware
'.ZIN' - 'zinnik321@cock.li' - virustotal.com/gui/file/5c40e… #CrySiS #Dharma #ransomware - cc @gexcolo
'.SUKA' - 'kjingx@tuta.io' - virustotal.com/gui/file/c6a68… #CrySiS #Dharma #ransomware
'.msf' - 'metasploit@post.com' - virustotal.com/gui/file/5ad5f… #CrySiS #Dharma #ransomware
'.lock' - 'datafiles@waifu.club' - virustotal.com/gui/file/b5243… #CrySiS #Dharma #ransomware
'.mpr' - 'meterpreter@null.net' - virustotal.com/gui/file/2439d… #CrySiS #Dharma #ransomware
'.gac' - 'getacrypt@tuta.io' - virustotal.com/gui/file/620fb… #CrySiS #Dharma #ransomware
'.21btc' - '1btc@cock.li' - virustotal.com/gui/file/b3488… #CrySiS #Dharma #ransomware - cc @gexcolo
'.gac' - 'getacrypt@tuta.io' - virustotal.com/gui/file/620fb… #CrySiS #Dharma #ransomware
'.4help' - 'hlper4y@tutanota.com' - virustotal.com/gui/file/eaa04… #CrySiS #Dharma #ransomware
'.hub' - 'crypthub@tuta.io' - virustotal.com/gui/file/0e918… #CrySiS #Dharma #ransomware
'.aol' - 'astra2eneca@aol.com' - virustotal.com/gui/file/8264b… #CrySiS #Dharma #ransomware
'.14x' - 'axitrun@cock.li' - virustotal.com/gui/file/ceeeb… #CrySiS #Dharma #ransomware - cc @gexcolo
'.dis' - 'decrypt@disroot.org' - virustotal.com/gui/file/4ddaa… #CrySiS #Dharma #ransomware
'.Avaad' - 'Avaaddams@msgsafe.io' - virustotal.com/gui/file/272a9… #CrySiS #Dharma #ransomware
'.crypt' - 'wannacry@msgsafe.io' - virustotal.com/gui/file/36e14… #CrySiS #Dharma #ransomware
'.22btc' - '22btc@tuta.io' - virustotal.com/gui/file/041c0… #CrySiS #Dharma #ransomware
'.TomLe' - 'TomLee240@aol.com' - virustotal.com/gui/file/875ab… #CrySiS #Dharma #ransomware
'.wcg' - 'btc11@gmx.com' - virustotal.com/gui/file/429fa… #CrySiS #Dharma #ransomware
'.con30' - 'con3003@msgsafe.io' - virustotal.com/gui/file/19854… #CrySiS #Dharma #ransomware
'.text' - 'helpdecrypt@msgsafe.io' - virustotal.com/gui/file/fd7a7… #CrySiS #Dharma #ransomware🤦‍♂️
'.word' - 'vm1iqzi@aol.com' - virustotal.com/gui/file/05e21… #CrySiS #Dharma #ransomware
'.LOTUS' - 'paymei@cock.li' - virustotal.com/gui/file/d4d34… #CrySiS #Dharma #ransomware - cc @gexcolo
'.pauq' - 'carbanak@aol.com' - virustotal.com/gui/file/6260c… #CrySiS #Dharma #ransomware
'.four' - 'lizardcrypt@msgsafe.io' - virustotal.com/gui/file/ad56c… #CrySiS #Dharma #ransomware
'.clman' - 'coleman2021@aol.com' - virustotal.com/gui/file/0175e… #CrySiS #Dharma #ransomware
'.ORAL' 🤷‍♂️- 'oral@tuta.io' - virustotal.com/gui/file/5292a… #CrySiS #Dharma #ransomware
'.urs' - 'necurs@aol.com' - virustotal.com/gui/file/9a3b8… #CrySiS #Dharma #ransomware
'.Jessy' - 'JessyMail26@aol.com' - virustotal.com/gui/file/502a7… #CrySiS #Dharma #ransomware
'.ROG' - 'embog@firemail.cc' - virustotal.com/gui/file/21de5… #CrySiS #Dharma #ransomware
'.biden' - 'biden@cock.li' - virustotal.com/gui/file/e3ed5… #CrySiS #Dharma #ransomware - cc @gexcolo
'.eofyd' - 'filerecovery@zimbabwe.su' - virustotal.com/gui/file/1c52c… #CrySiS #Dharma #ransomware
'.duk' - 'dokulus@tutanota.com' - virustotal.com/gui/file/f50e3… #CrySiS #Dharma #ransomware
'.LAO' - 'filerecovery@zimbabwe.su' - virustotal.com/gui/file/e263d… #CrySiS #Dharma #ransomware
'.pirat' - 'brokendig@zimbabwe.su' - virustotal.com/gui/file/e9b6e… #CrySiS #Dharma #ransomware
'.liz' - 'lizardcrypt@tuta.io' - virustotal.com/gui/file/64a4d… #CrySiS #Dharma #ransomware
'.bqd2' - 'badhach@aol.com' - virustotal.com/gui/file/a09b8… #CrySiS #Dharma #ransomware
'.4o4' - 'godecrypt@onionmail.org' - virustotal.com/gui/file/df90f… #CrySiS #Dharma #ransomware
'.ctpl' - 'catapultacrypt@tuta.io' - virustotal.com/gui/file/89187… #CrySiS #Dharma #ransomware
'.2122' - '2021@onionmail.org' - virustotal.com/gui/file/310b2… #CrySiS #Dharma #ransomware
'.HPJ' - 'hpjar@keemail.me' - virustotal.com/gui/file/882e6… #CrySiS #Dharma #ransomware
'.bdev' - 'bad_dev@tuta.io' - virustotal.com/gui/file/659fa… #CrySiS #Dharma #ransomware
'.eye' - 'eye@onionmail.org' - virustotal.com/gui/file/60c17… #CrySiS #Dharma #ransomware
'.root' - 'getdecrypt@disroot.org' - virustotal.com/gui/file/54815… #CrySiS #Dharma #ransomware
At least they are clear about the infection vector:
'.rdp' - 'rdphack@onionmail.org' - virustotal.com/gui/file/d13c7… #CrySiS #Dharma #ransomware

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Jakub Kroustek

Jakub Kroustek Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @JakubKroustek has new unrolls!

Check out other threads from @JakubKroustek!

Read all threads by @JakubKroustek

:(