Michael Gillespie

@demonslay335

Loves cats and coding. Hunter. Creator of ID Ransomware.

United States
id-ransomware.malwarehunterteam.com
Unit: abril de 2014
684 fotos i vídeos Fotos i videos

Tuits

Has blocat @demonslay335

Estàs segur que vols veure aquests tuits? Això no desblocarà @demonslay335.

  1. Tuit fixat
    24 de març de 2016

    ID is live! Special thanks to for the sub-domain.

    13 respostes 98 retuits A 154 els agrada
    Desfés
  2. ha retuitat
    fa 15 hores

    Microsoft Releases KB4090913 Update to Fix Critical USB Driver Issue

    10 retuits A 17 els agrada
    Desfés
  3. fa 14 hores

    Looks like has updated to v1.5.1.0. ID Ransomware picked up on example file named "[email protected] -1614714137-578233478334310455516964.fname-README.txt.doubleoffset"

    6 retuits A 6 els agrada
    Desfés
  4. ha retuitat
    fa 17 hores

    ScammerLocker (Hidden Tear) ransomware: Ext: .jodis Based on name & the GUI (it won't appear if you just run, it will only encrypt & drop note), prob. will target scammers. 🤔 Also, first time I hear about IOTA related to RW.

    3 respostes 20 retuits A 29 els agrada
    Desfés
  5. ha retuitat
    fa 19 hores

    New Ladon ransomware portal cdmsxo25y4lfht6v[.]onion cc:

    1 resposta 12 retuits A 18 els agrada
    Desfés
  6. fa 22 hores

    Spanish with extension ".jes" and a sweet Cthulhu image. Decrypter updated.

    1 resposta 12 retuits A 20 els agrada
    Desfés
  7. 5 de març

    , possible extension ".BLOCKED". Has a function for every possible drive of the system... talk about inefficient. Crashes with a 403 on trying to contact its C2, lol. Seems based on LightningCrypt and other junk ones according to

    2 respostes 26 retuits A 39 els agrada
    Desfés
  8. 5 de març

    Weird changes for , this one appends extension "! ,--, Revert Access ,--, [email protected] ,--,.BlockBax_v3.2" (lots of spaces in there) to files.

    1 resposta 8 retuits A 12 els agrada
    Desfés
  9. 5 de març

    Anyone familiar with command line? I'm not sure from the commands used by the malware in the screenshots if we can help victims decrypt.

    Interesting spotted by , tries to use GPG to do its encryption for it, then sdelete. Supposed to use extension ".<number>.qwerty", but since I didn't have those exes bundled, just drops the note and does nothing. ¯\_(ツ)_/¯
    Mostra el fil
    4 respostes 2 retuits A 4 els agrada
    Desfés
  10. ha retuitat
    4 de març

    It works! / Это работает!

    1 resposta 10 retuits A 12 els agrada
    Mostra el fil
    Mostra el fil
    Desfés
  11. ha retuitat
    5 de març

    So, the new GandCrab is arrived. 👏 And they are using a new extension, note name & even TOR domain, so we are good (). Thanks guys. 😂 They now linking to the decryption tutorial on NoMoreRansom, and says that won't work...

    Can't wait to see GandCrab v2. 😂 Just one thing GandCrab team: please use extension GDCB2 (or anything different than the current one), so we can properly separate them. Thanks. And good luck...
    Mostra el fil
    2 respostes 38 retuits A 43 els agrada
    Mostra el fil
    Mostra el fil
    Desfés
  12. ha retuitat
    4 de març

    SpyHunter again deceives users

    1 resposta 11 retuits A 13 els agrada
    Desfés
  13. 4 de març

    Interesting here, using extension ".Bitconnect" and some new extortion text wanting you to take a photo of yourself to post on Instagram.

    3 respostes 7 retuits A 15 els agrada
    Desfés
  14. ha retuitat
    3 de març

    just found this site infected with "Awesomeware" . an email for the list xD

    1 resposta 5 retuits A 13 els agrada
    Desfés
  15. 3 de març

    If anyone has been hit by , please contact me. The current published decrypter can't decrypt your files right away, I have to actually bruteforce your keys manually at the present time.

    3 respostes 28 retuits A 44 els agrada
    Desfés
  16. 3 de març

    I've updated detection on ID Ransomware. Seems they've started using "READ_ME.txt" for the note, which is way too generic... but I can detect based on format of the URLs in the note dynamically now.

    14 retuits A 18 els agrada
    Desfés
  17. ha retuitat
    2 de març

    The Week in Ransomware - March 2nd 2018 - GandCrab Decrypted, RaaS, and More - by

    1 resposta 25 retuits A 31 els agrada
    Mostra el fil
    Mostra el fil
    Desfés
  18. 1 de març

    seems to be still out there. ID Ransomware just got a submission with note "=_HOW_TO_FIX_RQZLIN.txt" and Tor address royal25fphqilqft[.]onion. Seeing no references to this address yet, site is still up as of now.

    7 respostes 31 retuits A 29 els agrada
    Desfés
  19. 1 de març

    Oh, we got 2 victim submissions to IDR this week that were false-positive for an old HiddenTear-based ransomware (sorry). This one definitely isn't HiddenTear.

    1 retuit A 4 els agrada
    Mostra el fil
    Mostra el fil
    Desfés
  20. 1 de març

    Interesting spotted by , tries to use GPG to do its encryption for it, then sdelete. Supposed to use extension ".<number>.qwerty", but since I didn't have those exes bundled, just drops the note and does nothing. ¯\_(ツ)_/¯

    2 respostes 23 retuits A 26 els agrada
    Mostra el fil
    Mostra el fil
    Desfés
  21. 1 de març

    ID Ransomware spotted a new extension for yesterday - ".id-<id>.[<email>].arrow"

    1 resposta 13 retuits A 12 els agrada
    Desfés

@demonslay335 encara no ha tuitat.

Sembla que triga molt a carregar-se.

És possible que el Twitter hagi assolit el límit de capacitat o que experimenti una sobrecàrrega momentània. Torna-ho a provar o vés a l'estat del Twitter si en vols obtenir més informació.

    També et pot interessar

    ·