ID Ransomware - Identify What Ransomware Encrypted Your Files

 

Hello,

ID Ransomware is not able to identify my encrypted files

"Please reference this case SHA1: 0c2fd8ed5906b57b3f60d20703758a1bcbe1aeca"

No tool was able to decypt. Only jpeg-preview is shown after decryption.

Th files are in my dropbox

https://www.dropbox.com/sh/tee9c9tj5ay06kg/AABga2e2nmQQN_FI5hQfY2aIa?dl=0

 

Please Help

Josef

 

It looks like you were hit by KEYHolder, which does not appear to have been decrypted from what I've seen. Some may have had luck using ShadowExplorer or Recuva, always worth a shot. Looks like a rather old one. I'll add detection for that one soon here (missed my spreadsheet somehow).

 

You can read more in this topic: http://www.bleepingcomputer.com/forums/t/559463/keyholder-ransomware-support-and-help-topic-how-decryptgifhow-decrypthtml

 

I read this before, but I only have the crypted files and folders. I was asked to help after the admin has formated all server harddisks.

Thanks

Josef

Has anyone ever been infected by  CryptXXX 2.0 ?

According to ID_Ransome,

This ransomware is still under analysis.

ransomnote_filename: 0845B236889D.html

sample_extension: .crypt

• CryptXXX Ransomware Support and Help Topic (.crypt ext, de_crypt_readme.html)

Hi, here is one ransomware that might not exist on id-ransomware:

 

Question:
http://www.bleepingcomputer.com/forums/t/601379/teslacrypt-vvv-ccc-etc-files-decryption-support-requests/page-205#entry3979333

Answer:
http://www.bleepingcomputer.com/forums/t/601379/teslacrypt-vvv-ccc-etc-files-decryption-support-requests/page-205#entry3979335
@slstaut,
It is not Teslacrypt,
write in this topic: Filecoder.NFY / Genasom
http://www.bleepingcomputer.com/forums/t/607680/troldeshshade-extensionid-numberemailxtbl-support/

User to answer: al1963

File location:
https://www.sendspace.com/file/rwg3n8
 

I have no more information about this.

 

Regards

Hi, I just repeat this post. Is this infection added? I don't know if the files are availeble anymore, and I cannot find Genasom on ID-ransomware. I do see that it also states xtbl and troldeshade which might be mentioned on ID-ransomware (shade is). I ask this so no one can slip away.. just in case...

That service is proving to be state of the art, so I look forward to see it tuned with less false positives and more advices.

It would be nice to have the code and run it on my server to test different scenarios, and add more advices / tests on different samples I have:) It is probably copyrighted, encrypted and secret :D. I understand you are in the planning phase for another or more permanent service eventually, but the beta here is much better than many released services I have experienced so keep up the hard work, and to all... continu getting trojans so the identification service may be improved... Sorry bad joke, the fact is that it is the users trouble that lead to a service like this, and if more had backups or knew how to make them recover from ransomware would not be neccesary and the criminals would not be multi millinaires / billinaires / tril... hope not, at least not yet..

Regards

Hi there,

My name is Nick. I was infected by a ransomware. I used ID Ransomware. The site identified the malware as CryptXXX and told me that the file is decryptable and sent me to Kaspersky tool. I used it and it worked very well on .doc, .xls, .pdf, .jpg files, but on .dwg, .dxf and .txt files the tool don't identify them as encrypted files even these files have the .crypt extension. What shall I do to decrypt those files ?

Thanks a lot

version of the decrypter. 1.9.1.0

Edited by nickhope, 15 May 2016 - 04:41 AM.

...I used ID Ransomware. The site identified the malware as CryptXXX and told me that the file is decryptable and sent me to Kaspersky tool. I used it and it worked very well on .doc, .xls, .pdf, .jpg files, but on .dwg, .dxf and .txt files the tool don't identify them as encrypted files even these files have the .crypt extension. What shall I do to decrypt those files ?

• CryptXXX Ransomware Support and Help Topic (.crypt ext, de_crypt_readme.html)

thank you

Got another "new" one that ends in .crypt but the ransome note is !Recovery followed by a personal ID. Sample and note submitted to ID Ransomeware.

Edited by DStamm, 18 May 2016 - 11:33 AM.

I have been infected with the new Trojan-Ransom.Win32.CryptXXX Variant of the virus and all my files have .crypt extensions... and the ransom note is !Recovery followed by my personal ID just as DStamm mentioned.  I tried Kaspersky Rannohdecryptor with no luck.  I get a popup that states this variant is not supported.  Does anyone know of any recent decryption software handling this variant?  Or are my files going to be in lockup till one comes out in the future?  I have tried system restore but does not go back far enough and I have no shadowcopy.   

@DStamm @Tauni

Please refer to the CryptXXX support topic and post there with any questions. Currently there is no way of decrypting files by the newest variant of CryptXXX. You will have to backup your encrypted files, and wait for any possible developments in the future. If there are, they will be posted to that topic.

• CryptXXX Ransomware Support and Help Topic (.crypt ext, de_crypt_readme.html)

The discussion of a particular ransomware that has already been identified is not the subject of this topic.

Thanks again, the only reason I posted here was the ransom note was different and unidentified. Wasn't sure if it was something new version or a variant of cryptxxx. 

 

Hi. I noticed in the list  ID Ransomware missing: GNL Locker and EnCiPhErEd.

Why is that?

 

EnCiPhErEd is actually confirmed as a variant of Xorist, so I removed the duplication. GNL Locker has become Zylok Locker (we gave it an arbitrary name, then a newer sample added their own name).