(Scarab)_Ransomware_IOCs_11-01-2019

#Ransomware (#Scarab)
-------------------------------
10-01-2019			IOC's
-------------------------------
Main object- "02dbf34b3426528f699f8ddb135e8026162078b5ae347d09fe36f04764931709.bin.gz"
	sha256	1b99e16f4ab4fdf221852a540a081bd7a7611f625470912e35898029805bc6e8
	sha1	d88a1b10dd2085b92be5cc2f2dae648d4bf30c2f
	md5	1e7275efddc646ea81f64052784a7827
Dropped executable file
	sha256	C:\Users\admin\Desktop\02dbf34b3426528f699f8ddb135e8026162078b5ae347d09fe36f04764931709.bin.gz	02dbf34b3426528f699f8ddb135e8026162078b5ae347d09fe36f04764931709

---------------------
Contact Emails:
xcv786@mail.ee
xcv786@india.com
xcv786@tutanota.co
----------------------
appends .crypted034 to encrypted files.

----------------------
RANSOMNOTE
----------------------
Your files are now encrypted!

Your personal identifier:
6A0200000000000056E7A6641D92C91180300C035B926FBBFFC6D830C30312CBBA9055DDB8F6CC4FE57BE167D733D6527372
D1D7E1EB1DA76C5B46D7B37AE579F2B6CCBD0617FFC8682A463D67A5DAC94BD9D6ACE5F09259F386B5E957EEB13DA681BC43
4A64C4DBB70651E74D77A12BD37459A90D2F9322DA9DADE777DEE7E5BD3BA5D4C5356BCD73A33790C065C90C9A29DB66FD00
CCF709C159A3AD72A76BF7F9C55EAECB1ABC418E73B69100962B0CF59C8FBCD0273E1135D362E86EB223AA7B48D5E290C463
3BDE32CCCD33807A3C81F38905EB23B913DA2DEEC4122AA8B12BD2C8888C7AE43A3AC176230C7941F6C9BE3393DB453C14B6
59CC1CB554711B81D1B859D4F90E41D1902D601C89E6C290E131478E541588C91515729AA9C2F9D1799BF157CC3DD26DD188
C0BFB848051AD7989330ED386E6C66B3A105B5C47FB5F101

All your files have been encrypted due to a security problem with your PC.

Now you should send us email with your personal identifier.
This email will be as confirmation you are ready to pay for decryption key.
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.
After payment we will send you the decryption tool that will decrypt all your files.

Contact us using this email address: xcv786@mail.ee (xcv786@india.com, xcv786@tutanota.com)
If you don't get a reply or if the email dies, then contact us using Bitmessage.
Download it form here: https://github.com/Bitmessage/PyBitmessage/releases
Run it, click New Identity and then send us a message at BM-2cVX9BfFbwjVZSi9jMPY22F6aeKMTny46y

Free decryption as guarantee!
Before paying you can send us up to 3 files for free decryption.
The total size of files must be less than 10Mb (non archived), and files should not contain
valuable information (databases, backups, large excel sheets, etc.).

How to obtain Bitcoins?
 * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click
   'Buy bitcoins', and select the seller by payment method and price:
   https://localbitcoins.com/buy_bitcoins
 * Also you can find other places to buy Bitcoins and beginners guide here:
   http://www.coindesk.com/information/how-can-i-buy-bitcoins

Attention!
 * Do not rename encrypted files.
 * Do not try to decrypt your data using third party software, it may cause permanent data loss.
 * Decryption of your files with the help of third parties may cause increased price
   (they add their fee to our) or you can become a victim of a scam.