暂无数据
.eight勒索病毒
|
|
病毒家族 | Phobos家族 |
|---|---|---|
| 病毒别名 | Eight | |
| 影响系统 | Windows | |
| 出现时间 | 2022 |
局域网内设备批量被感染；所有文件被加密成源文件名.id[8位字符-四位数字].[邮件地址].eight扩展名；系统部分服务、安全软件、进程被中止运行；日志被删除；病毒自销毁；
info.hta、info.txt
“ Files are locked* but not corrupted
Your computer is infected with a virus.
Files are locked* but not corrupted.
Send an email g.buttery@aol.com, specify in the subject unique identifier ********-**** and you will definitely be helped to recover.
*you can send us a couple of files and we will return the restored ones to prove that only we can do it
IMPORTANT:
1. the infection was due to vulnerabilities in your software
2. if you want to make sure that it is impossible to recover files using third-party software, do this not on all files, otherwise you may lose all data.
3. only communication through our email can guarantee file recovery for you. We are not responsible for the actions of third parties who promise to help you - most often they are scammers.
4. if we do not respond to you within 24 hours, send a message to the email blair_lockyer@aol.com or chocolate_muffin@tutanota.com or telefram acc - @phobos_support
5. if you need an alternative communication channel - write a request by e-mail
6. our goal is to return your data, but if you do not contact us, we will not succeed
”
RDP的弱口令攻击；很多客户为虚拟机。
use_harrd@protonmail.com, bill.g@onionmail.org, g.buttery@aol.com, henrystanley1861@gmx.com, markzober1987@gmx.com, fasthelper@gmx.com, benfestomser@tutanota.com, albertmatews1972@tutanota.com, recovery2021@onionmail.org, recovery2021@inboxhub.net, bill.g@gmx.com, bill.gteam@gmx.com, hughclapperton1877@gmx.com, bernhardriemann1901@tutanota.com, johnwilliams1887@gmx.com, samuelwhite1821@tutanota.com, louisvega@tutanota.com, bramwell.i@aol.com, g.uan_yu@aol.com, guan_yu@tutanota.com, 100returnguarantee@keemail.me, useHHard@cock.li, nopain555@protonmail.com, foxbox@airmail.cc, vivanger123@tutanota.com, ICQ@VIRTUALHORSE, 2020x0@protonmail.com, bondy.weinholt@aol.com, fidelako@int.pl, shelfit@airmail.cc, bertylarwayorstoner@jabb.im, ICQ@HONESTHORSE, robertwels@airmail.cc, sorysorysory@cock.li, helprecoveryfiles@cock.li, ezequielanthon@aol.com, xsupportx@countermail.com, messi_tr_2020@protonmail.com, mccreight.ellery@tutanota.com, verious1@cock.li, willi.stroud@aol.com, foxbox@xmpp.cz, hershel_houghton@aol.com, jewkeswilmer@aol.com, patiscaje@airmail.cc, decryptfilesonlinebuy@pm.me, ICQ@Horseleader, Bk_Data@protonmail.com, Petya20@tuta.io, SupportC4@elude.in, decrypt2021@elude.in, wang_team888@aol.com, barnabas_simpson@aol.com, emerson.parkerdd@aol.com, brandon_draven@protonmail.com, erich_northman@protonmail.com, lyontrevor@aol.com, mccandlessronald@aol.com, AaronKennedy74@cock.li, bhattarwarmajuthani@420blaze.it, brokenbrow.teodorico@aol.com, cornellmclearey@aol.com, ximenezpickup@aol.com, verilerimialmakistiyorum@mail.ru, sookie.stackhouse@gmx.com, dupuisangus@aol.com, s.boultons@aol.com, blair_lockyer@aol.com, murryu@aol.com, chocolate_muffin@tutanota.com, frankfbagnale@gmail.com, frankfbagnale@cock.li, victorlustig@gmx.com, elfbash@protonmil.com, alexei.v@aol.com, eppinger.adams@aol.com, martinwilhelm1978@cock.li, fredmoneco@tutanota.com, andreashart1834@cock.li, recoveryufiles@tutamail.com, cheston_windham@aol.com, augusto.ruby@aol.com, coxbarthel@aol.com, tsai.shen@mailfence.com, frankmoffit@aol.com, benwell_jonathan@aol.com, onlybtcp@tutanota.com, herbivorous@keemail.me, bernard.bunyan@aol.com, dillon.dabzac@aol.com, sofiabecker21@cock.li, dalgliesh.aaron@aol.com, cullan_cash@aol.com, decode@criptext.com, howtodecrypt2@cock.li, serhio.vale@tutanota.com, totalsupportcom@cock.lim, aa1b2c3cc@protonmail.com, 131845@cock.li, paynotanotherway@tutanota.com, kalimenok@gmx.com, clausmeyer070@cock.li, angus_frankland@aol.com, johannesjokinen1977@gmx.com, liamwake714@tutanota.com, matheuscosta0194@gmx.com, ryanmackin83@gmx.com, spacerecovery@tutanota.com, bossdata@keemail.me, bossdata@protonmail.com, bothelper@mailfence.com, albertpattisson1981@protonmail.com, sorryneedbtc@gmx.com, getdata@gmx.com, ferdinandcohn1828@gmx.com, barenukles@tutanota.com, cashanddash@tutanota.com, greenbookbtc@gmx.com, greenbookbtc@protonmail.com, louispasteur1824@gmx.com, recoveryufiles@gmx.com, williamdampier1651@gmx.com, guan_yu@mailfence.com, jamesgadsden1788@gmx.com, helpermail@onionmail.org, helperfiles@gmx.com, albertwesker1998@tutanota.com, guan_yu@zohomail.com, firstaidfiles@protonmail.com, firstaidfiles@gmx.com, guan_yu@jabber.systemli.org (Jabber), guan.yu@xmpp.jp (Jabber), tsai.shen@xmpp.jp (Jabber), vickre me (Wickr), @phobos_support (Telegram)
根据勒索病毒的计算机数据加密原理，国瑞团队修复或者解密被加密数据，不限任何扩展名，但需要针对不同病毒家族、版本，了解病毒的特性和加密率，用来决策采取对应的处理方法手段。 所以，当您寻求国瑞团队救援数据或其他专业数据恢复或安全机构的帮助之前，最好掌握一些信息，提前介绍给专业人员，以便我们更快速准确判断和解决灾难事件。
核心数据服务器上，分区数量、分区空间使用量，被加密文件的总数量（比如几百个、几万个、百万级），核心数据大小（比如：数据库总共20个、总大小1T、最大的库100G等），数据备份损失情况，是否有未被加密文件情况。
——— 联系我们 Contact Us ———
24小时应急响应电话：15021662155 (微信同号)
serve@grit.com.cn
样本提交 2012 - 2020 Copyright © 国瑞IT安全服务中心 沪ICP备09036178号
