PatchWorkAPT勒索软件家族详情

【家族名】
Win32/Ransom.PatchWorkAPT
[平台]   /   [主类型]  .  [家族名]
平台类型 :  Win32 Win64
威胁类型 : Ransom
【是否支持解密】
360解密大师：暂不支持
在线解密：暂不支持
【被加密文件】
被加密文件后缀格式： 修改文件后缀为VdHOFDder


【勒索提示信息】：
文件名：VdHOFDder.README.txt
文件内容 ：
-------------------------------------------------------------------------------
Your network has been breached by PatchWorkApt ransomware group.
Your network and encrypted the data on your systems.
Decryption is only possible with a private key that only we posses.
Our group's only aim is to financially benefit from our brief acquaintance,this is a guarantee that we will do what we promise.
Scamming is just bad for business in this line of work.
All your files are encrypted using AES-256 military grade algorithm. So,
1. Don't try to recover data, because the encrypted files are unrecoverable unless you have the key.
Any try for recovering data without the key (using third-party applications/companies) causes PERMANENT damage. Take it serious.
2. You have to trust us. This is our business (after firing from high-tech companies) and the reputation is all we have.
3. All you need to do is following up the payment procedure and then you will receive decrypting key using for returning all of your files and VMs.
Contact us to negotiate the terms of reversing the damage we have done.
We advise you not to use any data recovery tools without leaving copies of the initial encrypted file.
You are risking irreversibly damaging the file by doing this. ok33
How to contact us?
Before contacting our organization, download an application(Wire), this process requires you to use a VPN to continue.
Wire (https://wire.com/en/download/), this is safe and non-malware software for online communication and privacy protection.
After downloading and registering, you need to search for our name In the crowd, our name is what you and I know, @patchworkapt, add us, wait for our consent
Add us online for faster communication, we look forward to your reply
That must sound cool, and conversations get quick responses and issues get resolved quickly instead of using email to communicate!
When the name is added, please reply to the email below about your website and encryption type, this is a two-way authentication,  please complete these two steps
1. Search our name (@patchworkapt) in the crowd using the Wire app,be sure to add @ in front of the name, because the crowd is full of imitations and you will lose your way
2. Send an email to our two email, we will start the decryption work arrangement soon, and will also accept Wire  requests for communication
We affirm our credit in the name of God
Our email:
patchworkapt@msgden.net
PatchWorkApt@tutanota.com
why trust us?
If you pay the ransom, we will provide the decryption key software and send it to your mailbox.
Provide some encrypted files, send them to us, and verify our authenticity and trustworthiness through this amazing decryption.
-------------------------------------------------------------------------------
【防护建议】
1.多台机器，不要使用相同的账号和口令
2.登录口令要有足够的长度和复杂性，并定期更换登录口令
3.重要资料的共享文件夹应设置访问权限控制，并进行定期备份
4.定期检测系统和软件中的安全漏洞，及时打上补丁。
5.定期到服务器检查是否存在异常。查看范围包括：
a)是否有新增账户
b) Guest是否被启用
c) Windows系统日志是否存在异常
d)杀毒软件是否存在异常拦截情况
6.安装安全防护软件，并确保其正常运行。
7.从正规渠道下载安装软件。
8.对不熟悉的软件，如果已经被杀毒软件拦截查杀，不要添加信任继续运行。

家族：PatchWorkAPT
被加密文件后缀:VdHOFDder
黑客邮箱/Url：patchworkapt@msgden.net

家族：PatchWorkAPT
被加密文件后缀:VdHOFDder
黑客邮箱/Url：PatchWorkApt@tutanota.com