Funksec勒索软件家族详情

【家族名】
Win32/Ransom.Funksec
[平台]   /   [主类型]  .  [家族名]
平台类型 :  Win32 Win64
威胁类型 : Ransom
【是否支持解密】
360解密大师：暂不支持
在线解密：暂不支持
【被加密文件】
被加密文件后缀格式：.funksec
修改文件后缀为


【勒索提示信息】：
文件名：README-daHnl5AxJM.md
文件内容
--------------------------------------------------------------------------------------------------------------------------------------------------------------
# 🔒 FUNKLOCKER DETECTED 🔒
✨ **Congratulations** ✨ Your organization, device has been successfully infiltrated by funksec ransomware!
## 🛑 **Stop**
- Do NOT attempt to tamper with files or systems.
- Do NOT contact law enforcement or seek third-party intervention.
- Do NOT attempt to trace funksec's activities.
## 📚 **What happened**
- Nothing, just you lost your data to ransomware and can't restore it without a decryptor.
- We stole all your data.
- No anti-virus will restore it; this is an advanced ransomware.
## 💸 **Ransom Details**
- Decryptor file fee: **0.1 BTC**
- Bitcoin wallet address: `bc1qrghnt6cqdsxt0qmlcaq0wcavq6pmfm82vtxfeq`
- Payment instructions:
  1. Buy 0.1 bitcoin.
  2. Install session from: https://getsession.org/
  3. Contact us with this ID to receive the decryptor: 0538d726ae3cc264c1bd8e66c6c6fa366a3dfc589567944170001e6fdbea9efb3d
## 📚 **How to buy bitcoin**
- Go to [Coinbase](https://www.coinbase.com/) or any similar website like [Blockchain](https://www.blockchain.com/), use your credit card to buy bitcoin (0.1 BTC), and then send it to the wallet address.
## 📚 **Who we are**
- We are an advanced group selling government access, breaching databases, and destroying websites and devices.
## 📚 **Websites to visit**
- funkiydk7c6j3vvck5zk2giml2u746fa5irwalw2kjem6tvofji7rwid.onion
- funknqn44slwmgwgnewne6bintbooauwkaupik4yrlgtycew3ergraid.onion
- funkxxkovrk7ctnggbjnthdajav4ggex53k6m2x3esjwlxrkb3qiztid.onion
🎵 *Start dancing, 'cause the funk's got you now!* 🎵
Sincerely,
Funksec cybercrime
--------------------------------------------------------------------------------------------------------------------------------------------------------------

【防护建议】
1.多台机器，不要使用相同的账号和口令
2.登录口令要有足够的长度和复杂性，并定期更换登录口令
3.重要资料的共享文件夹应设置访问权限控制，并进行定期备份
4.定期检测系统和软件中的安全漏洞，及时打上补丁。
5.定期到服务器检查是否存在异常。查看范围包括：
a)是否有新增账户
b) Guest是否被启用
c) Windows系统日志是否存在异常
d)杀毒软件是否存在异常拦截情况
6.安装安全防护软件，并确保其正常运行。
7.从正规渠道下载安装软件。
8.对不熟悉的软件，如果已经被杀毒软件拦截查杀，不要添加信任继续运行。