Shadow ransomware is a custom-built ransomware that is written in the .NET platform. It is dubbed as shadow because of the extension of the encrypted files. The extension name chosen by the threat actor (*.shadow) is too generic to be future-proof. Hence, please check the ransom note before using the decryptor and see if the ransom note is the same or similar to the given sample ransom note.
Shadow ransomware uses AES-128 in CFB mode. In this configuration of AES, one needs to know the key and the IV to fully decrypt an encrypted file. The IV is saved to the start of the encrypted file (first 16 bytes) and the key is generated by character substitution of the personal ID. Hence, it is possible to decrypt any file given a personal ID. The only downside is, that AES is a block cipher and after the decryption, we have a padded version of the plain text. For most file types this is not a problem but one should consider this padding while using the decryptor.
- Download the ShadowDecryptor.py python file
curl -O https://raw.githubusercontent.com/prodaft/malware-ioc/master/ShadowRansom/ShadowDecryptor.py
- Install the required python packages
pip install -r 'https://raw.githubusercontent.com/prodaft/malware-ioc/master/ShadowRansom/requirements.txt'- Locate the ransom note and copy the personal ID. This personal ID is used by the key generation algorithm.
- Run the decryptor with the personal ID and the path to encrypted file arguments
py .\ShadowDecryptor.py --file <FileToDecrypt> --id <PersonalID>
ATTENTION!
All files on your computer have been seized. All your files have been encrypted and become inaccessible. You must contact us to recover your files.
Payment Method: Bitcoin
Wallet Address: It will be sent via e-mail and the sent wallet number will be active for 60 minutes. The second wallet number will not be sent.
Please note that if you do not pay before the expiration date, your files will be permanently deleted. For any questions or further information you can contact us at the following email address:
Email: [email protected]
Duration: 72 hours
Refund amount: $1000 (#Thousand$#)
If you do not receive a response within more than 6 hours, please check your spam folder or write to another e-mail address below.
Email: [email protected]
There is no alternative solution to recover your files before paying. After sending the specified amount to the specified Bitcoin address, you will receive a decryption program for your files via email.
- How will I trust you?
+ Send us an encrypted junk file to wetransfer.com and we will send it to you decrypted. This process will be done to prove that your files can be decrypted. The file you send must be junk, otherwise we will not decrypt your password.
Personel ID: <32 character personal ID>
DİKKAT!
Bilgisayarınızdaki tüm dosyalara el konuldu.Tüm dosyalarınız şifrelendi ve erişilemez hale geldi.Dosyalarınızı kurtarmak için bizimle iletişime geçmelisiniz.
Ödeme Yöntemi: Bitcoin
Cüzdan Adresi: E - posta yoluyla gönderilecek ve gönderilen cüzdan numarası 60 dakika boyunca aktif olacaktır. İkinci cüzdan numarası gönderilmeyecektir.
Son kullanma tarihinden önce ödeme yapmazsanız dosyalarınızın kalıcı olarak silineceğini lütfen unutmayın. Herhangi bir sorunuz veya daha fazla bilgi için aşağıdaki e-posta adresinden bizimle iletişime geçebilirsiniz:
E - posta: [email protected]
Süre: 72 saat
Geri ödeme tutarı: 1000 $ (#Bin$#)
6 saatten daha uzun bir süre içinde yanıt alamazsanız lütfen spam klasörünüzü kontrol edin veya aşağıdaki başka mail adresine yazın.
Email: [email protected]
Ödeme yapmadan önce dosyalarınızı kurtarmanın alternatif bir çözümü yoktur. Belirtilen miktarı belirtilen Bitcoin adresine gönderdikten sonra, e-posta yoluyla dosyalarınız için bir şifre çözme programı alacaksınız.
- Sana nasıl güveneceğim?
+ Wetransfer.com'a şifreli bir önemsiz dosya gönderin, biz de size şifresi çözülmüş olarak gönderelim. Bu işlem dosyalarınızın şifresinin çözülebileceğini kanıtlamak için yapılacaktır. Göndereceğiniz dosya önemsiz olmalıdır, aksi takdirde şifrenizin şifresini çözemeyiz.
Personel ID: <32 character personal ID>
| File Name | MD5 | SHA1 | SHA256 |
|---|---|---|---|
Fatura_Detay_22042024_xxx.com.PDF.zip |
abb567c1a9a80e018347203ab2d004f3 |
089c7d8387f683d52a792045c5788f447e70b654 |
17a481a4ba038a8d927bd940a5c2c79b40dfaa1b10f55fca28aa6c2f91143dde |
RootDesign.exe |
65fa40ed942c4ba5f0adf5b06a376b75 |
c01626b7e663c8ce320d7b23074d91b929b5fefa |
2682ef98b5570bd6b1ce79e8926b1db705935cf7464a51bc1175d83508bf5207 |
S_etup.zip |
aba1f907faab6eb99b46f61eed831bba |
c14ff5e9ca4304a340337613feb349ae69ee1244 |
40a5ef6ed2586a1b90d1754c064704e3a6f49f4e7811ade9b2674689cea8ce52 |
1.zip |
75c1a81512b5bfd5a014e22faee6a1ac |
a18fb12ddacb8a6c334718d8726653c29d3c646e |
5030b36719243095cdd8ceefc27c8d9ae89fb998f5cd7df5be296fc46816e710 |
RootDesign.exe |
afdc636affae107a89d5f0ff1939f98c |
de9cec580a6ebeb5968cdf02da201a1ee5a731a1 |
7371fbeeda68d449d80a3d9dc320353542b70d2490533f5dd72dc0100c4a2b83 |
1_encrypted_decrypted_encrypted_decrypted_encrypted_decrypted_encrypted_decrypted_encrypted_decrypted.rar |
18039120b55369dea5ad93c649083e8b |
6bf7e3ba3bf2bb9d956c0026d68d26c4fa250e81 |
99f4b63d2bf2da023b278b60907708e0807f7624eedc5e8eb6531e2c62b8eab4 |
Setup.zip |
9d9ce7d17554e79fd7387de211867209 |
865224bc3ec74c981993fd45e965c8f90de6b59c |
addf56c7f00ba7989b3d6d0475dfa6a3f2be69a93b338483dd7f690a5d0a29a6 |
xxx.pdf |
31b207d6ba8c2ed469cb838546943326 |
59bc4dfa07d23ca2bf049ad54da8d68672ccea64 |
341ad74c0d882674136fbc9b1021315aa37bd1f07e445e85eec8995c98c61ceb |
Setup.exe |
bc3953a9ce1f9d841d0ab3fa9c468ce2 |
16ab180985b3fd12602ad2e62a377e9c3f04f8d4 |
ba025ed8f1c76334666001cfa910b675aea2574297123ff57a0413cc7185733b |
1_encrypted_decrypted_encrypted_decrypted_encrypted_decrypted_encrypted_decrypted_encrypted_decrypted.exe |
5162290153ed59cb982aae7bb2230a76 |
adeffb14a0f11fa13129273629ac4e8e0960df3f |
cd55bc9d25bad608a2f806afce2b1e0fbf953b7ba404f49b630000000fec4e65 |
FaturaDetay_xxx.com.tr.PDF.zip |
20d8d6ce8812e30ae6623d07179a3027 |
7b7739663b1f7a1a2f703be195bfa43932333c52 |
cf11767cbd4f84a26f84dc9dedfd9dfd69e34f807db8cad3d685eed163e044a4 |
Fatura_Detay_22042024_xxx.com.PDF.zip.exe |
c9ab7cc55a64ffc538d0775ccc55aa96 |
49557610e16f4b35ae5b50eac61013ba154372b2 |
7b2c9cb8d3e5dec6906610ffab61934c1052d1b0e28b0769d01dae7cb9bc10f9 |
FaturaDetay_xxx.com.tr.PDF.exe |
de92408b6549097cb5b6496ec89a4408 |
a8f22bb6f9dd69a77a4278667af0d4323bb19da8 |
3b1d975e17ec74b820ffbd792fd067b84444c2b02337a7a401fb434ed5aa0bc9 |
installer.config |
226c59a7ecb0296ca26706436a91f35a |
4a223a1e2dc58decb642617ce40c487efeff23d6 |
b4361328f47df2694b4377e6d69d940047b25f498ae05b63df671ded4d2494f4 |
installer.config |
26da8f858841e13be8c6ea797413e5a1 |
7ff1a5e941507248617a0da58860fa04506cf910 |
5b91b0b61d11be5dc822b613d1394f6e701cdaa8a09b1eb2a34424fa65050611 |
installer.config |
9d75aa94101edfa1fc0510692614d218 |
3a7c32490dd815ef4bd66e44c53c19edcbb7e930 |
a69b94d75fe167e6f89d213727f6b1a578b6bfed0b3235dfa39a3322b4dcf0a1 |
installer.config |
be659d2b672281848c6c55d69fabfbfe |
09a88d6a4f86f4b2768e7c268329849e2f5c91c2 |
3e1e45bb2a119d32b2a52f98ca0677f83644ba4525d2c1bdc72963bb6015c944 |
installer.config |
cba4a3ac8dbeeb2f7adefc182625ee06 |
b7cfccddd196af7f127605a85aec505d9597bbdb |
54edd5f6945bbb2ea2906d9b8927ba969405ecbd02c06ede9686528bec521375 |
installer.config |
d7aadcda685d40fbb3cd1c31bb5e8183 |
7e249b0c6e132675bd7452771b3a2e4c0ca8cba2 |
e970068ba01c5b0db81bbe38ead21acdea6f3afb7395e10d61efe21563070fdb |
RD.exe |
013c32fe853b869632a067bfe2d75cce |
6cc5157f74ae676da357067e3f9eeddda5bb2d24 |
31f922356db3f3773d9b9dab3b327bd84d082ab80cd5278be828eee1fa63622f |
RootDesign.exe |
6200ed6cae3e9b4cf2eb813d7f5a9633 |
1ab9f653820263036044879e4179db55332ec2cd |
de810269d08dee689fd1bcd5948fe003b91a475c203b665ab455dbc6a65e90c6 |
RootDesign.exe |
687dace870adc14ed3139047ee6b1e02 |
2450407b627c8da838cc7acce79f6f3d1ddc3273 |
e696f463ab674c780f4cafbd0f056e5b3d72b6027b6cd80ab30e2e6fb1f4f74e |
RootDesign.exe |
dccf876e0f9592391fa7487cf5d2a153 |
5cb67b406c125a16e6631870b4a72258d3c25e35 |
735ed575da13d7a193e019618a4add25ff6dee916863d359fe44cc5871910595 |
RootDesign.exe |
e6d5dd33e2455eb52560034a23822385 |
ffc9e1ed944fa354f71c9e932cefbb626ca033dd |
9bbbd965dc14a3ecfd554eaef2b97babb42d9997cf424eb1a1aa38964ef01ce6 |
RootDesign.exe |
eaa4c4e4220f37e7614bed7c7a640959 |
ddf3210d5ef480bd8689e51249f9e6cdc44ff330 |
b5d31d34d88ed37056128e733c9fb303071fdc381a35f213c12667abad542e95 |
RootDesign.exe |
f2334c9ee0e7a36811316228151be9d7 |
fbac2144ce2db9e62bb3f3c7a083d52cec570fe1 |
e77e537ee76a5235a7cd5009474ab6ebd92ebaa68f2f7a9880354b87efcdec93 |
RootDesign.exe.config |
9dbad5517b46f41dbb0d8780b20ab87e |
ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e |
47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf |
RootDesign.pdb |
33ad512624d4456da14f544a41594416 |
610f0811a8e7701578957977fbd83c1bad2657aa |
31416dc1a4cf44a84c6fdb1e191d3e043b1d43dbf0c60fcdf6b7e18bbabba974 |
RootDesign.pdb |
3aa9c707804cf58b235d38d7ce0a712a |
2f6ebe2496cf4c44b17cce3ae2372b6bd11fcd39 |
896f07bf350d553be65814bdd0944393d26b253c004c427a0fd6b7fbafa836bb |
RootDesign.pdb |
752c85873b6ea899407fa45b5fc5116e |
813c7acf6a1afe7124b0d21feac71d3585ec8a8f |
e5b2ed3b7d4b87725edaede5a86de8da2f4600e0407fcdc7f4ed7c36fdb03dde |
RootDesign.pdb |
917759856cf168dfcd604c99bc8e9128 |
46919c3e1963a4a447431a251d5f091cd15f715b |
e193e4f41469baf4d861987e6e7d9fd51d45d1183522eb0d9f402993b60f991b |
RootDesign.pdb |
a8e0e940c6ca50a3680201ee7413c6af |
e8e5892789f69586051a7eaefec4cb5ef4cc72e1 |
1d05547a346ea4a9786284ab5f0e3b52c6d4a2970f04f3b24e7fa2b758aa262d |
RootDesign.pdb |
b78f378ba6f6c860402ecf94a98fa43f |
33d9e1afb9961b568099a53afbc9b179cd5010c6 |
c92a4d5c766bf6bf47472ef6c93508aeee458db0a7822871cd1401c50ea218ae |
runtime.cab |
8708699d2c73bed30a0a08d80f96d6d7 |
684cb9d317146553e8c5269c8afb1539565f4f78 |
a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f |
Setup.exe |
9dddca52c9c4c36b16c752cbcfdbb2d7 |
4e12afb2434cde64d6db0038b384816cb1c53f4e |
83a2044f7f5967d62574627c72d4d314fbc3f9b04213eac982c6121bc670c604 |
Setup.exe |
eb59218fcd95f3c54b78b02cd57b0f2f |
83b6f23f8c6c22f23ba02d5daae97ded4104b3b2 |
8596db089140c21300dbc010ae63913cc48ebda2e23f913206f01d37acd2dfd8 |
xxx.pdf |
f7028790dca3fb1dccff7b65ead71dee |
d6e3947c4b1e0b331b7e7844c2b7638699fc7bc0 |
f57c6f8cafe4e9024793272c63b80bf4acdcd4916a6fe1f13e06bc8c47357225 |
Uninstall.exe |
499ccc8d6d7c08e135a91928ccc2fd7a |
78b2b70ad8e49cd2e8518501a29d1af1e714a16f |
1fa5d83a5766556cf2ff16ad279e73cb40584746bd388e0a4e818a2cc06613d |