PayloadBIN Ransomware Download

In 2019 the government barred negotiation firms from facilitating ransom payments for Evil Corp, they renamed their ransomware operations to different names such as WastedLocker, Hades and Phoenix to circumvent these hurdles. After encrypting user files a file PAYLOADBIN-README.txt is opened with following text.

The network is LOCKED with PAYLOADBIN ransomware. Don't try to use other software.
For decryption KEY write HERE: #1 rickhood@armormail.net | #2 meredithpatrick@protonmail.com

All encrypted files are padded with .PAYLOADBIN extension.

PayloadBIN Ransomware Signatures

Family: Ransom:Win32/Filecoder!MSR
MD5: 063771d5573448ee6a271584a4b6a26a
SHA256: 69775389eb0207fec3a3f5649a0ad9315856c810f595c086ac49d68cdbc1d136

PayloadBIN Ransomware Download