Kawalocker
Original ransom notes collected for this group.
!!Restore-My-file-Kavva.txt 2997
| Content | Action |
|---|---|
- - K a W a L o c k e r
> Y o u r n e t w o r k / s y s t e m w a s e n c r y p t e d .
> E n c r y p t e d f i l e s h a v e n e w e x t e n s i o n .
> W e h a v e d o w n l o a d e d c o m p r o m i s i n g a n d s e n s i t i v e d a t a f r o m y o u r s y s t e m / n e t w o r k .
> O u r g r o u p c o o p e r a t e s w i t h t h e m a s s m e d i a .
> I f y o u r e f u s e t o c o m m u n i c a t e w i t h u s a n d w e d o n o t c o m e t o a n a g r e e m e n t ,
> y o u r d a t a w i l l b e r e v i e w e d a n d p u b l i s h e d o n o u r b l o g a n d o t h t e r d a r k w e b m a r k e t s .
> I n s t a l l t o r b r o w s e r , v i s i t K a W a B l o g > h t t p : / / k a w a s a 2 q o 7 3 4 5 d t 7 o g x m x 7 q m n 6 z 2 h n w a o i 3 h 5 a e o s u p o z k d d q w p 6 l q q d . o n i o n
D a t a i n c l u d e s :
> E m p l o y e e s p e r s o n a l d a t a , c o r p p a r t n e r , I n c o m e , c u s t o m e r i n f o r m a t i o n , H u m a n r e s o u r s e , C V s , D L , S S N ,
> C o m p l e t e n e t w o r k m a p i n c l u d i n g c r e d e n t i a l s f o r l o c a l a n d r e m o t e s e r v i c e s .
> F i n a n c i a l i n f o r m a t i o n i n c l u d i n g c l i e n t s d a t a , b i l l s , b u d g e t s , a n n u a l r e p o r t s , b a n k s t a t e m e n t s .
> C o m p l e t e d a t a g r a m s / s c h e m a s / d r a w i n g s f o r m a n u f a c t u r i n g i n s o l i d w o r k s f o r m a t
> A n d m o r e . . .
W a r n i n g :
> 1 ) I f y o u m o d i f y f i l e s - o u r d e c r y p t s o f t w a r e w o n ' t a b l e t o r e c o v e r d a t a
> 2 ) I f y o u u s e t h i r d p a r t y s o f t w a r e - y o u c a n d a m a g e / m o d i f y f i l e s ( s e e i t e m 1 )
> 3 ) Y o u n e e d c i p h e r k e y / o u r d e c r y p t s o f t w a r e t o r e s t o r e y o u f i l e s .
> 4 ) T h e p o l i c e o r a u t h o r i t i e s w i l l n o t b e a b l e t o h e l p y o u g e t t h e c i p h e r k e y . W e e n c o u r a g e y o u t o c o n s i d e r y o u r d e c i s i o n s .
R e c o v e r y :
> D o w n l o a d t o x c h a t : h t t p s : / / t o x . c h a t
> G o t o a d d a s f r i e n d I D > 6 A 3 4 0 2 0 7 2 4 6 B 4 7 E 3 7 F 6 D 0 9 4 D 2 2 3 6 E 5 C 6 2 4 2 B 6 E 4 4 6 1 E E F 8 0 2 1 F E D 2 C 9 8 5 5 2 4 0 C 3 E 1 1 A E E 8 8 6 F A A F
|
!!Restore-My-file-Kavva_ascii.txt 1499
| Content | Action |
|---|---|
-- KaWaLocker
> Your network/system was encrypted.
> Encrypted files have new extension.
> We have downloaded compromising and sensitive data from your system/network.
> Our group cooperates with the mass media.
> If you refuse to communicate with us and we do not come to an agreement,
> your data will be reviewed and published on our blog and othter darkweb markets.
> Install tor browser,visit KaWa Blog > http://kawasa2qo7345dt7ogxmx7qmn6z2hnwaoi3h5aeosupozkddqwp6lqqd.onion
Data includes:
> Employees personal data, corp partner, Income, customer information, Human resourse, CVs, DL , SSN,
> Complete network map including credentials for local and remote services.
> Financial information including clients data, bills, budgets, annual reports, bank statements.
> Complete datagrams/schemas/drawings for manufacturing in solidworks format
> And more...
Warning:
> 1) If you modify files - our decrypt software won't able to recover data
> 2) If you use third party software - you can damage/modify files (see item 1)
> 3) You need cipher key / our decrypt software to restore you files.
> 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions.
Recovery:
> Download tox chat: https://tox.chat
> Go to add as friend ID> 6A340207246B47E37F6D094D2236E5C6242B6E4461EEF8021FED2C9855240C3E11AEE886FAAF
|