Matryoshka勒索病毒家族详情
【家族名】Win32/Ransom. Matryoshka
[平台] / [主类型].[家族名]
平台类型 :Win32 Win64
威胁类型 : Ransom
【是否支持解密】
360解密大师：暂不支持
在线解密：暂不支持
【被加密文件】
被加密文件后缀格式： 修改文件后缀为.matryoshka
【勒索提示信息】：
文件名：
文件内容 ：
-------------------------------------------------------------------------------
Ooops!!!
You have been infected by Matryoshka Ransomware.
Read all instructions carefully to recover files.
What is Matryoshka Ransomware?
Ransomware is a computer program that encrypts files with military grade cryptography algorithms. This means you cannot decrypt it alone, you need creators of such virus to decrypt for you.
Matryoshka has infected you and your files are now encrypted. Good news! We can decrypt for you. That, however, comes with small price: $75 (seventy five US dollars). Very cheap, yes? Other ransomwares charge up to $1000, we are being generous!
You are advised to pay the fee within 20 days of infection (as seen on left of window). If demand is not met, all encrypted files are deleted FOREVER.
Things you must know
Only Matryoshka Team (Йосеф and Алик) can decrypt your files. Any attempt you do is futile. If you delete this program, you never recover files!!! Uninstall or stop your antivirus or it may remove Matryoshka and, by consequence, your files. Immediately.
How to pay
You pay the fee using cryptocurrency. No worries, it is easy! We only accept Monero for payment because is very private and your information is not leaked. You can buy Monero on sites online, like Binance.
To buy cryptocurrency Monero (XMR), you need wallet. When buying Monero from Binance for example it will create the wallet for you. The wallet is how we identify your computer and unlock your files.
Go on Google to learn more of how to buy XMR (Monero).
YOU MUST SEND PAYMENT TO THE WALLET BELOW:
47NVMZew49WYxzHGQUJZARRXu38ydxCyj4iXPn69jL5xXvitL8wyq7yVpYcfNxs6M5ckDdpJdpMbP7buEqtNs1FE15wmby4
How are files unlocked
When you send payment, it takes a little time (around 30 minutes) to the Blockchain to register it. You will then need to insert your wallet (is 95 characters long) in this program on the payment field below, and press "CONFIRM". But be careful, if you specify wrong wallet, it will be bad and you will not be able to recover your files! We have program running to check payments, when you confirm that you have sent it our server receives information and will wait to see if payment is received.
Encryption keys are stored in our server, you do not have access. When payment is confirmed, the program gets the key and performs decryption unlocking your precious files.
This program asks the server if payment is received every 10 minutes. If yes, then files are recovered, decrypted, everything is fixed and this program is gone. If you have any problem, email us at matryoshka.iosef@airmail.cc and we provide support. Only email if problem is with payment confirmation delay!
-------------------------------------------------------------------------------
[弹窗]
【防护建议】
1.多台机器，不要使用相同的账号和口令
2.登录口令要有足够的长度和复杂性，并定期更换登录口令
3.重要资料的共享文件夹应设置访问权限控制，并进行定期备份
4.定期检测系统和软件中的安全漏洞，及时打上补丁。
5.定期到服务器检查是否存在异常。查看范围包括：
a)是否有新增账户
b) Guest是否被启用
c) Windows系统日志是否存在异常
d)杀毒软件是否存在异常拦截情况
6.安装安全防护软件，并确保其正常运行。
7.从正规渠道下载安装软件。
8.对不熟悉的软件，如果已经被杀毒软件拦截查杀，不要添加信任继续运行。
家族：Matryoshka
被加密文件后缀:matryoshka
黑客邮箱/Url：matryoshka.iosef@airmail.cc
页:
[1]