Michael Gillespie

@demonslay335

Loves cats and coding. Hunter. Creator of ID Ransomware.

United States
id-ransomware.malwarehunterteam.com
Tilmeldt april 2014
684 billeder og videoer Billeder og videoer

Tweets

Du blokerede @demonslay335

Er du sikker på, at du vil vise disse Tweets? At vise Tweets vil ikke fjerne blokering af @demonslay335

  1. Fastgjort tweet
    24. mar. 2016

    ID is live! Special thanks to for the sub-domain.

    13 svar 98 retweets 154 likes
    Fortryd
  2. retweetede
    for 14 timer siden

    Microsoft Releases KB4090913 Update to Fix Critical USB Driver Issue

    10 retweets 17 likes
    Fortryd
  3. for 14 timer siden

    Looks like has updated to v1.5.1.0. ID Ransomware picked up on example file named "[email protected] -1614714137-578233478334310455516964.fname-README.txt.doubleoffset"

    6 retweets 6 likes
    Fortryd
  4. retweetede
    for 17 timer siden

    ScammerLocker (Hidden Tear) ransomware: Ext: .jodis Based on name & the GUI (it won't appear if you just run, it will only encrypt & drop note), prob. will target scammers. 🤔 Also, first time I hear about IOTA related to RW.

    3 svar 20 retweets 29 likes
    Fortryd
  5. retweetede
    for 19 timer siden

    New Ladon ransomware portal cdmsxo25y4lfht6v[.]onion cc:

    1 svar 12 retweets 18 likes
    Fortryd
  6. for 22 timer siden

    Spanish with extension ".jes" and a sweet Cthulhu image. Decrypter updated.

    1 svar 12 retweets 20 likes
    Fortryd
  7. 5. mar.

    , possible extension ".BLOCKED". Has a function for every possible drive of the system... talk about inefficient. Crashes with a 403 on trying to contact its C2, lol. Seems based on LightningCrypt and other junk ones according to

    2 svar 26 retweets 39 likes
    Fortryd
  8. 5. mar.

    Weird changes for , this one appends extension "! ,--, Revert Access ,--, [email protected] ,--,.BlockBax_v3.2" (lots of spaces in there) to files.

    1 svar 8 retweets 12 likes
    Fortryd
  9. 5. mar.

    Anyone familiar with command line? I'm not sure from the commands used by the malware in the screenshots if we can help victims decrypt.

    Interesting spotted by , tries to use GPG to do its encryption for it, then sdelete. Supposed to use extension ".<number>.qwerty", but since I didn't have those exes bundled, just drops the note and does nothing. ¯\_(ツ)_/¯
    Vis denne tråd
    4 svar 2 retweets 4 likes
    Fortryd
  10. retweetede
    4. mar.

    It works! / Это работает!

    1 svar 10 retweets 12 likes
    Vis denne tråd
    Vis denne tråd
    Fortryd
  11. retweetede
    5. mar.

    So, the new GandCrab is arrived. 👏 And they are using a new extension, note name & even TOR domain, so we are good (). Thanks guys. 😂 They now linking to the decryption tutorial on NoMoreRansom, and says that won't work...

    Can't wait to see GandCrab v2. 😂 Just one thing GandCrab team: please use extension GDCB2 (or anything different than the current one), so we can properly separate them. Thanks. And good luck...
    Vis denne tråd
    2 svar 38 retweets 43 likes
    Vis denne tråd
    Vis denne tråd
    Fortryd
  12. retweetede
    4. mar.

    SpyHunter again deceives users

    1 svar 11 retweets 13 likes
    Fortryd
  13. 4. mar.

    Interesting here, using extension ".Bitconnect" and some new extortion text wanting you to take a photo of yourself to post on Instagram.

    3 svar 7 retweets 15 likes
    Fortryd
  14. retweetede
    3. mar.

    just found this site infected with "Awesomeware" . an email for the list xD

    1 svar 5 retweets 13 likes
    Fortryd
  15. 3. mar.

    If anyone has been hit by , please contact me. The current published decrypter can't decrypt your files right away, I have to actually bruteforce your keys manually at the present time.

    3 svar 28 retweets 44 likes
    Fortryd
  16. 3. mar.

    I've updated detection on ID Ransomware. Seems they've started using "READ_ME.txt" for the note, which is way too generic... but I can detect based on format of the URLs in the note dynamically now.

    14 retweets 18 likes
    Fortryd
  17. retweetede
    2. mar.

    The Week in Ransomware - March 2nd 2018 - GandCrab Decrypted, RaaS, and More - by

    1 svar 25 retweets 31 likes
    Vis denne tråd
    Vis denne tråd
    Fortryd
  18. 1. mar.

    seems to be still out there. ID Ransomware just got a submission with note "=_HOW_TO_FIX_RQZLIN.txt" and Tor address royal25fphqilqft[.]onion. Seeing no references to this address yet, site is still up as of now.

    7 svar 31 retweets 29 likes
    Fortryd
  19. 1. mar.

    Oh, we got 2 victim submissions to IDR this week that were false-positive for an old HiddenTear-based ransomware (sorry). This one definitely isn't HiddenTear.

    1 retweet 4 likes
    Vis denne tråd
    Vis denne tråd
    Fortryd
  20. 1. mar.

    Interesting spotted by , tries to use GPG to do its encryption for it, then sdelete. Supposed to use extension ".<number>.qwerty", but since I didn't have those exes bundled, just drops the note and does nothing. ¯\_(ツ)_/¯

    2 svar 23 retweets 26 likes
    Vis denne tråd
    Vis denne tråd
    Fortryd
  21. 1. mar.

    ID Ransomware spotted a new extension for yesterday - ".id-<id>.[<email>].arrow"

    1 svar 13 retweets 12 likes
    Fortryd

@demonslay335 har ikke tweetet endnu.

Indlæsning ser ud til at tage noget tid.

Twitter kan være overbelastet eller have en midlertidig forstyrrelse. Prøv igen, eller se flere oplysninger på Twitter Status.

    Du vil måske også kunne lide

    ·