It's a "Command-and-Control" server (C&C or C2). https://en.wikipedia.org/wiki/C...

Matt3o12_ · on March 6, 2016

Thanks, I just realized it after reading Claud Xiao and Jin Chen's analysis, too. Apparently, this ransomware uses Tor to hide its origin.

vmorgulis · on March 6, 2016

I liked the "We have ticket system." (in the screenshot of "README_TO_DECRYPT.txt").

They ask (only) 1 BtC as a ransom.

moyix · on March 7, 2016

And they decrypt one file for free, to prove they can do it. Nice touch.

Screenshots of the web UI: