README

PhoBOSS_Decryptor

• The source code of the decryptor can be found in the "Decryptor" subfolder
• The "Supporting_materials" subfolder contains samples (starting with "7za.exe.ID-9A" and "processhacker-2.39-setup.exe.ID-9A") to test the functionality of the decryptor. These are legit, uninfected executables.
• For decryption, the test files should be copied next to the .exe.
• The scripts located in the "Support_materials" folder were used during the attack to delete logs and shadow copies

Should you have any questions, please contact inquiry@subscuto.com