RE:
Am Montag, den 11. April 2016 wurde durch unbekannte Dritte die folgende E-Mail in englischer Sprache versendet:
Your package has been successfully delivered. The proof of delivery (TRK:043001569) is enclosed down below.
Der E-Mail mit dem Betreff „RE:“ ist eine Datei mit dem Namen (Benutzername)_invoices_290626.zip beigefügt, welche ein JavaScript enthält. Von einem Server wird der Verschlüsselungs- und Erpressungstrojaner TeslaCrypt nachgeladen.
Nach der Verschlüsselung der Dateien werden die entsprechenden Meldungen angezeigt:
=!:+ !+9*57-8,*1;7+&?95):,24(+( ——- =!:+ !+9*57-8,*1;7+&?95):,24(+(
NOT YOUR LANGUAGE? USE https://translate.google.com
What’s the matter with your files?
Your data was secured using a strong encryption with RSA-4096.
Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem)=!:+ !+9*57-8,*1;7+&?95):,24(+( ——- =!:+ !+9*57-8,*1;7+&?95):,24(+(
What exactly that means?
It means that on a structural level your files have been transformed . You won’t be able to use , read , see or work with them anymore .
In other words they are useless , however , there is a possibility to restore them with our help .What exactly happened to your files ???
!!! Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private.
!!! All your data and files were encrypted by the means of the public key , which you received over the web .
!!! In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers.=!:+ !+9*57-8,*1;7+&?95):,24(+( —– =!:+ !+9*57-8,*1;7+&?95):,24(+(
!!! What should you do next ???
In case you have valuable files , we advise you to act fast as there is no other option rather
than paying in order to get back your data.In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below :
http:// 74bfc.flubspiel[.]com/***
http:// ibf4d.ukegaub[.]at/***
http:// k3cxd.pileanoted[.]com/***If you can’t access your personal homepage or the addresses are not working, complete the following steps:
*** Download and Install TOR Browser – http://www.torproject.org/projects/torbrowser.html.en
*** Run TOR Browser Insert link in the address bar: xzjvzkgjxebzreap.onion/***=!:+ !+9*57-8,*1;7+&?95):,24(+(—-IMPORTANT*****************INFORMATION———=!:+ !+9*57-8,*1;7+&?95):,24(+(
Your personal homepages
http:// 74bfc.flubspiel[.]com/***
http:// ibf4d.ukegaub[.]at/***
http:// k3cxd.pileanoted[.]com/***Your personal homepage Tor-Browser xzjvzkgjxebzreap.onion/***
Your personal ID ***=!:+ !+9*57-8,*1;7+&?95):,24(+(
=!:+ !+9*57-8,*1;7+&?95):,24(+(
=!:+ !+9*57-8,*1;7+&?95):,24(+(
Die verlinkte Internetseite zeigt die typische Forderung nach 1,3 BitCoin:
