0000 CryptoMix Ransomware
=========================

File Hashes:

SHA256: 7bbd1d047b5cb3d7f073e3a5cfbf81cdb8fee970fe62ee4135f56e68245eba2f

Filenames associated with the 0000 Cryptomix Variant:

_HELP_INSTRUCTION.TXT
C:\ProgramData\[random].exe

0000 Ransom Note Text:

Hello!

Attention! All Your data was encrypted!

For specific informartion, please send us an email with Your ID number:

y0000@tuta.io

y0000@protonmail.com

y0000z@yandex.com

y0000s@yandex.com

Please send email to all email addresses! We will help You as soon as possible!

DECRYPT-ID-[id]

Emails Associated with the 0000 Ransomware:

y0000@tuta.io
y0000@protonmail.com
y0000z@yandex.com
y0000s@yandex.com

Executed Commands:

sc stop VVS
sc stop wscsvc
sc stop WinDefend
sc stop wuauserv
sc stop BITS
sc stop ERSvc
sc stop WerSvc
cmd.exe /C bcdedit /set {default} recoveryenabled No
cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet

Bundled Public RSA-1024 Keys:

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCyagbOaf3s/ePCxre9cs9BwaX3 D40qF7jAzB/xoWktfDlY2PVslZ2reYhQC9dSIvkEtuZqlUUYgFUdaaqTsE7pA8ik 2zXI5Ou7I0YtwWRoFNCl8YlMTRKgDHRQhclPNbtpi2ucm507Unr8EnT2ZzcTOYv1 7ITFgkBdNr4zHLFrpQIDAQAB
-----END PUBLIC KEY-----

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDChVnFfbDa3rp1sug7tbE6ba/O RWAwsk6WQ21XHgAXF7dKuEtG/4q7QJyHahQvys2oLkJ4Et2+S4YS3FSYXYqNOq/e 5ahdS19KiuGLnf1u7acnsGvikJgvXiwe/NH2h48ZtK0Uyn1Q1ijVNU66f1pehSmB YQupamnC2XkV9d6Z0wIDAQAB
-----END PUBLIC KEY-----

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXbf7u6Pq5kB+O1Cb9GIG9GlVG Mswk342Er1HMiHFXUsVMlljLFTJPz5rdcVB4QAXsOynm67uw8yEAlNC90AHohuIV dGDNVoQuuyNvanI1Ur4cA4aKqpJZKbkVauTpCDdEAse4LSH4NrGTgCao42jiaksj pZvKyFK8yvdoAwd3JQIDAQAB
-----END PUBLIC KEY-----

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCetENrtjivjYOthpX2yTlYKJ0x gZ0R367J8tSFikEhVoko4SKRmN9Y1s88iCdeRPUZh2Q0rHOesf/AxONK1buzygXl BkE5X86I3EFUFbPjyOnIgEKFru728aLlwkslqYPIWS29DZUCboHzv1YWU8gtFkwL 5bUEB444se2UXi+pjwIDAQAB
-----END PUBLIC KEY-----

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCQa9aSkupoA7jxeOhS/mbRvy4u H/hI6XbTsv+ilfj8v9XHBaptsExUvCDG3fXvDKxSLxa6HBXnemM3weUDS0njH9Sb MJjImRjQ+OambwAYaj/hnFM3TYWU4KhPPKWrsxHT1ReSo1i+G2bNxr2gyS2D606N xaN4LNmYw3PLL2omGQIDAQAB
-----END PUBLIC KEY-----

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCIiEAs1V5JBCLKmDy0Il6rfC4w pQm0s9224Yvxs5pRRic3IQwAJ6wWw0Nrl42LxiA88jggso2EZ05lAl9FIuCNvzCr PO2QOjRLT0w2bYEEneK+rQR9sexZSI90zYVjziI26muOG1M8neAHqWkPvZI1a1sd hG5MwboKBkPYbtXI1wIDAQAB
-----END PUBLIC KEY-----

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4ShCcW3W2gmG5HT/Vcrzf4HKi OXAmVWpTRkyqxkw/wU7Ax+A63Fgo5tV4psuxHcJUGYQv4B8+Ag+POHmE4a7Vd4Ra 7tVXBEoyl1ZKF8fFCAAaw6G/ALCL0LEQiTLaqQuIjNXRo7S4Mt/alOM18uMP/kEA mqnGDXEblePIsMUzkQIDAQAB
-----END PUBLIC KEY-----

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOXllDk/itDr0oW7hxm01XLeEo pVCg63jWxr5ZEKMU3zmYPtIPGayJbOacU+pPf6t77IMR8ainmJXjAK1c0V07XJv2 UrRsQARYDGEnItYphiYI7t1AgXSPoUi8pvQJrpja3WpuFNmhsWE2lz5uEO7QeejG jSToXALGsvmgvGq5SQIDAQAB
-----END PUBLIC KEY-----

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCWeBww97UHcRLjztOKvXB0xzRC LcZGov/Y/6x/m8uo42nLkyPgUjrqR7EAzB6bbB6L6aOgCJb2WyffOaNN5df07gIV f1Ea8u/jMIr5uhR+pnFMNB0jQIqqU9/slURM+U7dFvELbli5HL+7Ac/EehJNjLNW bpB5dTPCSSpKFoeoxQIDAQAB
-----END PUBLIC KEY-----

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCIX+Ay2zjnnViZsCDCk/TS2wZV 85YVVWpAXzsu4wzJzo4Mux2PK5pW0+i6+O1KZLcu+d5xElKM0KgrmE8uY1xylA18 SMBHHhBNhJdYXIaARFNp1uRG+kR8IDgT3sDrSseTt//l2tn8oo5xxw6UHtsBqRwF KP3u+Vspd+gFRsTC5wIDAQAB
-----END PUBLIC KEY-----

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxsV6vYenwHV4noHlPuOL/Dc7b dcLDWzJCmCToF5wCnUdkeifop7s6Kuz4nujPWq+6/foz5od8GySTtKiZtoq3lcmI 04RMzKqvo1PkR4RzfXGBLVk6EqeCrueY86l8Gu71oiPois8jJV6VQ96IJuc0HNRb IVKuPQZRttC1CjuZHQIDAQAB
-----END PUBLIC KEY-----