Ransomware (.crypted)

Did you find any ransom notes? If so, what is the actual name of the ransom note?
Can you provide (copy & paste) the ransom note contents in your next reply?

The .crypted (.CRYPTED) extension is more generic and has been used by several types of known ransomware to include Hakbit (Thanos), HiddenTear/EDA2, Tripoli, HelloKitty, MegaLocker (NamPoHyu), Yoshikada Decryptor (GlobeImposter variant), System Crypter and Nemucod. The .crypted extension is also used by many unidentified ransomwares.
 
You can submit (upload) samples of encrypted files, ransom notes and any contact email addresses provided by the malware developer to ID Ransomware (IDR) for assistance with identification and confirmation of the infection. ID Ransomware can identify ransomware which adds a prefix instead of an extension and more accurately identifies ransomware by filemarkers if applicable. Doing this also ensures we get the ransomware information into the IDR system for reference. Uploading both encrypted files and ransom notes together along with any email addresses provided gives a more positive match with identification and helps to avoid false detections. Please provide a link to the ID Ransomware results. 
 
 

I did find a note, but in windows operating systems, in computers that have windows the files were like this example: 157121.pdf.5OSQe5NUm and the name of the note is: 5OSQe5NUm.README.txt, but for linux servers there was no note, the files were only .crypted.

Mail to which they are waiting for a reply: farmacon@protonmail.com

ID Ransomware, cannot determine which ransomware is

Contents of the note:

Edited by krlosrhg, 25 June 2024 - 06:00 AM.

It appears you have been hit with more than one ransomware infection.
 
Ransomware can be responsible for double (multiple) encryptions since it will encrypt any directory or file it can read/write to regardless if previously encrypted by another ransomware variant. Ransomware does not care about the contents of the data or whether your files are already encrypted...it will just re-encrypt them again and again if it has access. Even the same ransomware can encrypt data multiple times with different strains and that means the files may get corrupted multiple times. Any file corruption complicates possible decryption solutions.
 
Double (multiple) infections also means having to deal with all ransom demand payments and different decryptors created by the criminals in order to decrypt data if the encryption was caused by different ransomware families. Unfortunately there is not much you can do in scenarios like this especially if any of the ransomwares are not decryptable. 
 

From what you have provided (157121.pdf.5OSQe5NUm with a 5OSQe5NUm.README.txt note) looks to be LockBit 3.0 (Black) + a ransomware that also appended the .crypted extension.

In your case, the random 9 char naming format of your README.txt ransom note together with the same random 9 alpha-numerical char extension appended to your encrypted files are similar to what we have seen with this ransomware. These are some examples.

.hZiV1YwzR
.3WbzmF0CC
.JxxLLpPns
hZiV1YwzR.README.txt
3WbzmF0CC.README.txt
JxxLLpPns.README.txt

Your personal DECRYPTION ID: 495927C9CC58D8A36B47827EAE1AEA72
»» Your personal DECRYPTION ID: 9FE85D4F9C7EA210F904E9BC55F74ECA
>>>> Your personal DECRYPTION ID: 8F2AC6FD69FFFB2BEF710F5010CA2763
specify your ID - 6800F4848694EC5B39B3525AF9F34521
report your ID - C7EC9516C90F63DF285
YOU LOCK-ID: 7565BD6495000673051C5B6F24EE1B30

>>>> Your personal DECRYPTION ID: F99931269EE37BDC3E8BBDA1F6CA0C5E

Without more information, it will be difficult to identify the second ransomware which used the .crypted extension.