UltraDeCrypter...a new variant of CryptXXX 3.0 - cryp1 extension, !(hex-id).html

One of my client got this ransomware, anyone knows this? Thanks.

Admin Note: UltraDeCrypter is CryptXXX. Please use this topic: CryptXXX Ransomware Support and Help Topic (.crypt ext, de_crypt_readme.html) for support.

Edited by Grinler, 03 June 2016 - 07:46 AM.

Hi there,

 

Is there any ransom notes left (.txt, .png, .html) and what extension is added to the files?

 

Samples of any encrypted files, ransom notes or suspicious executables (installer, malicious files, attachments) that you suspect were involved in causing the infection can be submitted here with a link to this topic. 

 

xXToffeeXx~

"UltraDecrypter" is also a known software program:

 

http://blog.domwareapps.com/category/apps/

Edited by cybercynic, 25 May 2016 - 11:37 AM.

This has been identified as a new variant of CryptXXX 3.0. Leaves .cryp1 extension, and ransom note "!(hex-id).html".

 

https://twitter.com/demonslay335/status/736200061047189504

This has been identified as a new variant of CryptXXX 3.0. Leaves .cryp1 extension, and ransom note "!(hex-id).html".

 

https://twitter.com/demonslay335/status/736200061047189504

This is what Maxfine in the CryptXXX topic reported. I had uploaded his ransom note and encrypted file to ID-Ransomware.

Edited by cybercynic, 27 May 2016 - 10:27 AM.

Topic title changed to reflect new variant of CryptXXX and aid with Google searches.

There is an ongoing discussion in this topic where other victims can ask questions and seek further assistance.

• CryptXXX Ransomware Support and Help Topic (.crypt ext, de_crypt_readme.html)

Rather than have everyone with individual topics, it would be best (and more manageable for staff) if you posted any more questions, comments or requests for assistance in the above support topic discussion. To avoid unnecessary confusion, this topic is closed.

Thanks
The BC Staff