Ransomware note ransomware-note
ransomware-note Dragonforce .txt [rand].README.txt note-dragonforce-rand-readme-txt Ransomware note Dragonforce — [rand].README.txt

Archived note body

Plain text · original whitespace retained

Source and hash

Hello! 

Your files (orcl, IADeAPP, [snip] dbs) have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics.
All you need to do is contact us and pay.

--- Our communication process:

	1. You contact us.
	2. We send you a list of files that were stolen.
	3. We decrypt 1 file to confirm that our decryptor works.
	4. We agree on the amount, which must be paid using BTC.
	5. We delete your files, we give you a decryptor.
	6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future.
   
--- Client area (use this site to contact us):

	Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
	>>> Use this ID: [snip] to begin the recovery process.
	
	* In order to access the site, you will need Tor Browser, 
	  you can download it from this link: https://www.torproject.org/

--- Additional contacts:

	Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20

--- Recommendations: 

	DO NOT RESET OR SHUTDOWN - files may be damaged.
	DO NOT RENAME OR MOVE the encrypted and readme files.
	DO NOT DELETE readme files.

--- Important:

	If you refuse to pay or do not get in touch with us, we start publishing your files.
	21/01/2024 00:00 UTC the decryptor will be destroyed and the files will be published on our blog.
	
	Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion

Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101

Related negotiation records

View all 14 records

An explicit alias maps the note family Dragonforce to the Ransomchats actor label Dragonforce. This relationship does not merge either corpus or its statistics.

Up to ten negotiation records from the mapped actor collection
Record IDIndexed dateMessagesThreat actor
058f4b92-ae99-45c7-bf35-5d2d6754b3de Date not recorded 19 Dragonforce
05f724f8-906e-4739-8177-815852cc2c3f Date not recorded 29 Dragonforce
29BBE03074FDBB8D Date not recorded 10 Dragonforce
7A313D13EB6B4E58 Date not recorded 32 Dragonforce
89716D29D2CEE36F Date not recorded 23 Dragonforce
AB0404E049514B50 Date not recorded 28 Dragonforce
b8e14e1a-548f-4eec-bd6e-a590126e57c9 Date not recorded 14 Dragonforce
BD004D632D87DBA0 Date not recorded 25 Dragonforce
C2A3C7249797F5ED Date not recorded 66 Dragonforce
C42CDF65B97D0E92 Date not recorded 30 Dragonforce