- Ad: Elbie virüsü
- Tehdit Türü: Fidye Yazılımı, Crypto Virüsü, Dosya Kilitleyici, Ransomware
- Şifrelenmiş Dosya Uzantısı: .Elbie
- Fidye Talep Mesajları: info.hta, info.txt, ##-IMPORTANT_NOTICE-##.Txt
luciolussenhoff@aol.com, jabberpaybtc@sj.ms, hope2honest@aol.com, Keta990@protonmail.com, duckjahana@onionmail.com, wang_team999@aol.com, grander123@tutanota.com, decryptfiles@420blaze.it, zitenmax@onionmail.org, debourbonvincenz@aol.com, DonovanTudor@aol.com, fileback@cock.li, datadecrypt@onionmail.org, supportcrypt2019@cock.li, backmydata@outlookpro.net, recoverydata@onionmail.org, ryzen@cyberfear.com, phobos_healper@xmpp.jp, b.morningtonjones@aol.com, worldofdonkeys@xmpp.jp, backvondatten@msgden.net, datanigerial@bk.ru, securityss@cock.li, mccreight.ellery@tutanota.com, tirrellipps@aol.com, metro777@messagesafe.io, goodbooom@tutanota.com, fileb@protonmail.com, danger@countermail.com, worldofdonkeys@protonmail.com, recovery2021@msgsafe.io, atomanus@tutanota.com, chillyvilly@mail2tor.com, MerlinWebster@aol.com, cosmotec@tuta.io, help.encryptorr@gmail.com, wingood12@tutanota.com, torresproxytg@proton.me, kabennalzly@aol.com, karlosdecrypt@outlook.com, tuttyfrutty@msgsafe.io, darillkay@aol.com, Dcryption@Mailfence.com, anamciveen@aol.com, decryptyourfile@gmail.com, planet500@jabbim.club (Jabber), shonpen@mailfence.com, nichols_l@aol.com, posiccimen1982@aol.com, planet500@tuta.io, stuart.wittie@aol.com, cleverhorse@ctemplar.com, anygrishevich@yandex.ru, @ebby_gale (Telegram), decrypt2023@cock.li, washapen@cock.li, wanheda@cock.li, crypt2022@aol.com, helprecover@foxmail.com, itlab@cyberfear.com, decrypt@files.mn, filerecoverycompany@onionmail.org, anna.brown.la.ca@gmail.com, file.decrypt@onionmail.org, restorebackup@qq.com, kokux@tutanota.corn, rapidorecovery@protonmail.com, samersby@tuta.io, itbox@keemail.me, alexnoyz2@mein.gmx, azidadabass@proton.me, grattan.l@aol.com, raphaeldupon@aol.com, ofizducwe111988@aol.com, metro777@cock.li, topot@cock.li, britt.looper@aol.com, member987@cock.li, petinjon@vpn.tg, carbonayra@mailfence.com, set2JV@tutanota.com, tedmundboardus@aol.com, itbox@techmail.info, alphonsepercy@aol.com, hermes@onionmail.org, beautydonkey@xmpp.jp, @covid7000 (Telegram), rikyrank113@protonmail.com, recoversupportman@firemail.cc, @Online7_365 (Telegram), autrey.b@aol.com, goodbooom@cock.li, sverdlink@aol.com, decryptme@msgsafe.io, samersby@tutanota.com, xfactor@anche.no, francispilmoor@aol.com, stopdata@tuta.io, silverhand@onionmail.org, eddyayman@gmail.com, jiminok31@cock.li, zoye1596@msgden.net, helprequest@techmail.info, dominga.k@aol.com, cleverhorse@protonmail.com, hero77@cock.li, friends2019@protonmail.com, lewisswaffield.a@aol.com, dennet.smellie@aol.com, bexonvelia@aol.com, antidecryp.io@yandex.ru, simonsbarth@aol.com, accidental_genius@tuta.io, bitlander@armormail.net, back7@protonmail.ch, saveyourfiles@qq.com, 3ncryptionfile@gmail.com, klemens.stobe@aol.com, 2hlkhbebenw@tuta.io, dschen010203@gmail.com, encryptionransomware@tutanota.com, lockhelp@qq.com, p500@keemail.me, leeming.derick@aol.com, park.jehu@aol.com, upfileme@protonmail.com, decrypt4data@protonmail.com, petinjon@gmail.com, recovermyfiles2019@thesecure.biz, octopusdoc@mail.ee, findithere@disroot.org, recovery_2021@tutanota.com, bbitcrypt@protonmail.com, winboom@tutanota.com, decryptyourdata@gmail.com, decryptmenow@onionmail.org, torres@proxy.tg, for_recovery@privatemail.com, paybtc@sj.ms, ramsey_frederick@aol.com, surprize12@tutanota.com, winboom@cock.li, key07@qq.com, backup.iso@aol.com, fileisafe@tuta.io, absonkaine@aol.com, hermesih@rambler.ru, cello_dodds@aol.com, eking@dnmx.org, withdirimugh1982@aol.com, happy2022@cock.li, data_recovery_asia@xmpp.jp (Jabber), datasecurity1@tutanota.com, veritablebee@protonmail.ch, cadillac.407@aol.com, hartpole.danie@aol.com, hpsupport@privatemail.com, jackdecrypt@msgsafe.io, yongloun@tutanota.com, costelloh@aol.com, larabita@cock.li, raynorzlol@tutanota.com, supportcrypt2019@protonmail.com, 2hlkhbebenw@proton.me, lettointago@onionmail.org, gabbiemciveen@aol.com, member987@tutanota.com, samercin1@tuta.io, returnmefiles@aol.com, help.encryptor@gmail.com, cercisori1979@aol.com, decrypt_here@xmpp.jp, file.decrypt@yahoo.com, xats@privatemail.com, datarecoveryasia@onionmail.org, decphob@tuta.io, tirrelllipps@aol.com, elbie.restore@gmail.com, phobos_helper@xmpp.jp, crypt22@aol.com, walletdata@hotmail.com, xxxnxxx@cock.li, raynorzlol@thesecure.biz, datarecoveryasia@msgsafe.ninja, cynthia-it@protonmail.com, plombiren@qq.com, subik099@tutanota.com, kickclakus@protonmail.com, 2020x@cock.lu, bbbitcrypt@tutanota.com, filesreturn@cock.li, helprecoverthis@mailfence.com, decrypt22@proton.me, ebby.gale@tutanota.com, The777@tuta.io, decphob@protonmail.com, onlyfiles@aol.com, checkcheck07@qq.com, recoverhelp2020@thesecure.biz, datadecryption@countermail.com, xavax@tutanota.com, cinzzz@cock.li, lettoindago@tutanota.com, sifremialayim@cock.li, helprecoverthis@cock.li, cosmotec@jabb.im (Jabber), horsesecret@xmpp.jp, Datarest0re@aol.com, cleverhorse@xmpp.jp, flexney.pail@aol.com, deltatech@tuta.io, savemyself1@tutanota.com, walletwix@aol.com, itweb@techmail.info, zax4444@qq.com, lachneyorlachb@aol.com, support24@firemail.cc, @Stop_24 (Telegram), sonendon@cyberfear.com, lockhelp@xmpp.jp, pixell@tutanota.com, squadhack@email.tg, decryptbox@airmail.cc, job2019@tutanota.com, beltoro905073@aol.com, taverptintra1985@aol.com, phobosrecovery@cock.li, itbox@onionmail.com, patern32@protonmail.com, ban.out@foxmail.com, helpdecrypt2023@protonmail.com, funnyredfox@aol.com, ofizducwell1988@aol.com, Troll900@tutamail.com, guan_yu@zohomail.com, kalle.tomlin@aol.com, zax444@qq.com, elizabeth67bysthompson@aol.com, grander123@tutanota.com –, mr.helper@qq.com, robdasupp@aol.com, fileback@tuta.io, cosmecollings@aol.com, harlin_marten@aol.com, randal_inman@aol.com, decryptfiles@cock.lu, fastdatarecovery@onionmail.org, resolvethis@gmx.com, happy2022@tutanota.com, filerecoveryassistant@privatemail.com, datacenter2022@mail.ru, decrypt2023@outlookpro.net, tlalipidas1978@aol.com, datawarehouse@inbox.ru, contactme@msgden.net, spider_jasper@tutanota.com, @decrypt2023 (Telegram), carmichael.lion@aol.com, Admincrypt@protonmail.com, decrypt22@mailfence.com, OttoZimmerman@protonmail.ch, keysfordecryption@airmail.cc, ftsbk@protonmail.com, batecaddric@aol.com, chinadecrypt@fasthelpassia.com, werichbin@cock.li, oslapisavkusna@onionmail.org, helpyourdata@qq.com, datastore@cyberfear.com, leejohn@cryptolab.net, hidebak@protonmail.com, elbie.recovery@gmail.com, mecybaki@firemail.cc, Raphaeldupon@aol.com, restoringbackup@airmail.cc, kickclak@cock.li, ginnydterrell@onionmail.org, com-gloria@protonmail.com, noyes.brice@aol.com, phobos.encrypt@qq.com, octopusdoc@airmail.cc, wang_team777@aol.com, decrypt2023@cyberfear.com, backmydata@bk.ru, datashophere@mail.ru, lucky_top@protonmail.com, writehelp@privatemail.com, 2172998725@qq.com, relvirosa1981@aol.com, decryptfiles@qq.com, htuospace@onionmail.org, werichbin@protonmail.com, jewkeswilmer@aol.com, ragnarok@cyberfear.com, wikibit@keemail.me, back2restore@neomailbox.ch, hadleeshelton@aol.com, kenny.sarginson@aol.com, kokux@tutanota.com, FobosAmerika@protonmail.ch, stanodexne1982@aol.com, elizabethz7cu1jones@aol.com, Unlockfiles@qq.com, waitheisenberg@xmpp.jp, thorpe.grand@aol.com, sookie.stackhouse@gmx.com, barcelona_100@aol.com, chagenak@airmail.cc, 3ncrypter.m4n@gmail.com, v.li17@tutanota.com, carbonayra@onionmail.com, wewillhelpyou@qq.com, painplain98@protonmail.com, helpdecrypt@kolabnow.com, SimpleSup@cock.li, decriptionsupport911@airmail.cc, viadolorosa@tuta.io, tylecotebenji@aol.com, sailormorgan@protonmail.com, leonardo@cock.lu, decrypt_here@xrnpp.jp, decrypt2020@aol.com, back_ins@protonmail.ch, lofutesdogg1983@aol.com, v.li17@zohomail.eu, for_recovery@cyberfear.com, set2JV@msgsafe.io, decryptfiles@hot-chilli.eu, burnofin@hotmail.com, 90F10F411075C64928D9DC3B35303B94133513903EF0FE7992748CAF2EC65D3D127FFB6FF7D6 (Tox), asiarecoverydata@cock.li, wiruxa@airmail.cc, madisonx@tuta.io, colexmix@tutanota.com, captainpilot@cock.li, Konwarszawski (ICQ), night_illusion@aol.com, eking@firemail.cc, itlab@keemail.me, @datadecrypt (Telegram), itland@techmail.info, theonlyoption@qq.com, xfactor@keemail.me, meojinpao@onionmail.org, snowbox@tuta.io, bambam988@tutanota.com, irvinclarke@aol.com, Everest_2010@aol.com, ezequielanthon@aol.com, berne.fiddell@aol.com, abbott_wearing@aol.com, bad_boy700@aol.com, Quantroei@protonmail.com, madisonx@jabb.im (Jabber), andrew.tompson@tutanota.com, SimpleSup@tutanota.com, itbox2@techmail.info, backmydata@mail.ua, Unlockm301@cock.li, danianci@airmail.cc, keysfordecryption@jabb3r.org, jujumba@tuta.io, crioso@protonmail.com, security_ss123@tutanota.com, raynorzlol@protonmail.com, antidecryp@keemail.me, hpsupport@cyberfear.com, helpdecrypt@dnmx.org, naqohiky@firemail.cc, hoshimin@onionmail.org, patiscaje@airmail.cc, gomer_simpson2@aol.com, 2183313275@qq.com, helpforyou@gmx.com, apoyo2019@protonmail.com, datasecurity@cock.li, grander123@protonmail.com, back2datten@tutanota.com, firmaverileri@internet.ru, fasthelper@onionmail.org, trimak@cock.li, phobosrecovery@tutanota.com, tracks@keemail.me, drebtips@gmx.com, Tedmundboardus@aol.com, youcanwrite24h@airmail.cc, leejohn@inboxhub.net, antich154@privatemail.com, hanesworth.fabian@aol.com, jongohelper007@proton.me, 2020×0@protonmail.com, mr.helper@jabb3r.de, ebby.gales@tutanota.com, Bexonvelia@aol.com, dessert_guimauve@aol.com, kylenoble726@aol.com, eccentric_inventor@aol.com, stocklock@airmail.cc, back2up@swismail.com, crysall.g@aol.com, samercin@tutanota.com, supportmanrecover@airmail.cc, agent5305@firemail.cc, itlab@techmail.info, anticrypto@tutanota.com, pixell@cock.li, filerecoverycompany@email.tg, helpteam38@protonmail.com, energyhack@cock.li, thedecrypt111@qq.com, wanheda@dnmx.org, bowen.bord@aol.com, colony96@cock.li, toridastford@zohomail.com, gherardobaxter@aol.com, antistress.ir@yandex.ru, prndssdnrp@mail.fr, walterjmurray@onionmail.org, troppocs@onionmail.org, christosblee@aol.com, eject24h@protonmail.com, ciaprepoulep1977@aol.com, covid777@aol.com, file_recovery@privatemail.com, maitlandtiffaney@aol.com, robinhood@countermail.com, William_Kidd_2019@protonmail.com, greg.philipson@aol.com, hickeyblair@aol.com, repairfiles@foxmail.com, gruzudo@cock.li, bambam988@tuta.io, recoveryfast@airmail.cc, tlalipidas1978@aol.com.exe, thekeyishere@cock.li, jokers777@tutanota.com, phobos_helper@exploit.im, xfactor@msgsafe.io, prejimzalma1972@aol.com, com-gloria@tutanota.com, alexnoyz@gmx.de, guan_yuy@zohomail.com, files2@protonmail.com, verious1@cock.li, lealir@tutanota.com, forrecovery@onionmail.org, limboshuran@cock.li, paper_plane1@aol.com, deltatechit@protonmail.com, phobos_helpper@xmpp.jp, DavidsHelper@protonmail.com, zoye596@protonmail.com, wikibit@techmail.info, sacipaws@tutanota.com, ryuhb12@protonmail.com, antistresas.ir@keemail.me, kew07@qq.com, antistress.il@keemail.me, helpisos@aol.com, online24decrypt@airmail.cc
.octopus, .eight, .Banks, .Devon, .bqux, .blend, .WALLET, .deuce, .top, .Frendi, .6y8dghklp, .magic, .BANKS, .1500dollars, .PERDAK, .HORSELIKER, .angus, .Devos, .Banta, .karma, .elbow, .ZOZL, .Devoe, .zax, .DEWAR, .phoenix, .acute, .pHv1, .Caleb, .Calum, .banjo, .ELDAOLSA, .SHTORM, .VXUG, .2QZ3, .kmrox, .Adame, .PLUT, .com, .Acuna, .eking, .LEAKDB, .WIN, .mamba, .s4b, .worry, .BORISHORSE, .deep, .age, .banhu, .CAPITAL, .Cales, .eject, .mango, .adage, .calix, .XIII, .Dever, .revon, .Calvo, .rdptest, .HORSEMONEY, .elpy, .help, .DLL, .barak, .Acton, .phobos, .LOWPRICE, .chinz, .elder, .isos, .Calle, .bablo, .Caley, .Elbie, .actin, .dewar, .luck, .gotmydatafast, .Adair, .Drik, .Acuff, .duck, .MURK, .faust, .devil, .2700, .deepindeep, .grt, .google, .LIZARD, .deal, .GrafGrafel, .ebaka .Antivirus, .DDoS, .DIKE .decrypt, .jopanaxye, .WannaCry, .eject .Frendi, .HuiVJope, .KARLOS, .Barak, .ACTIN, .bbc, .SDK, .actor
- Algılama İsimleri:
- BitDefender (Gen:Variant.Ransom.Phobos.62)
- ESET-NOD32 (A Variant Of Win32/Filecoder.Phobos.C)
- Kaspersky (HEUR:Trojan.Win32.Generic)
- EmsiSoft (Trojan.Ransom.PHU (B))
- Sophos ( Troj/Phobos-B)
- TrendMicro (Ransom.Win32.PHOBOS.SMYXCCW)
- Microsoft (Ransom:Win32/Phobos.PC!MTB)
- McAfee (Ransom-Phobos!9E79576CBD90)
- VirusTotal Algılama Listesi
- Belirtiler:
- Bilgisayar üzerindeki dosyaların açılamaması.
- Dosyaların farklı bir uzantıya sahip olması (örneğin, my.docx.elbie).
- Masaüstünde fidye talebi mesajının görüntülenmesi.
- Dosyaların kilidini açmak için bitcoin cinsinden ödeme talebi.
- Yayılma Yöntemleri:
- Enfekte e-posta ekleri (makrolar).
- Torrent siteleri.
- Zararlı reklamlar.
- RDP portları
- SQL portları
- Zararlar:
- Tüm dosyalar şifrelenir, ödeme olmadan erişilemez hale gelir.
- Fidye yazılımı yanında ek trojan ve malware enfeksiyonları olasılığı.
Ek Detaylar:
- Dosya Yeniden Adlandırma Deseni:
- Şifrelenmiş dosya adlarına kurbanın kimliği, e-posta adresi ve “.Elbie” uzantısı eklenir.
- Fidye Notları:
- Çeşitli fidye notu mesajlarını kullanır, bunlar arasında info.hta, info.txt, ##-IMPORTANT_NOTICE-##.Txt bulunur.
- İletişim Bilgileri:
- Çeşitli iletişim e-postalarını sağlar, saldırının arkasında geniş bir siber suçlu ağı olabileceğini düşündürür.
- Algılama:
- Avast, BitDefender, ESET-NOD32, Kaspersky ve Microsoft gibi çeşitli antivirüs çözümleri tarafından tanımlanmıştır.
- Belirtiler ve Riskler:
- Kullanıcılar dosyalara erişim kaybı ve değiştirilmiş uzantılarla karşılaşırlar.
- Önemli bir fidye mesajı, genellikle bitcoin cinsinden ödeme yapılmasını dosyaların şifresini çözmek için talep eder.
- Ek malware yüklemeleri ve veri tehlikesi olasılığı.
Önleyici Tedbirler:
- Özellikle makro içeren e-posta eklerine dikkat edin.
- Güvenilmeyen torrent sitelerinden indirmekten kaçının.
- Zararlı reklamlardan ve pop-up’lardan kaçının.
Tepki Adımları:
- Fidye ödemekten kaçının, çünkü dosyaların kurtarılmasının garanti olmadığı bir durumdur.
- Algılama ve temizleme için antivirüs çözümlerinden yararlanın.
- Dosyaları güvenli bir şekilde depolanan bir yedekten geri yükleyin.
Elbie fidye yazılımının özelliklerini anlamak ve önleyici önlemleri almak, kullanıcıların bu tür tehditlere karşı bilincini arttırır. Düzenli yedeklemeler ve güvenlik önlemleri, fidye yazılımı saldırılarına karşı korunmada kritik öneme sahiptir.