Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Register a free account to unlock additional features at BleepingComputer.com

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News: SEC Fines Yahoo $35 Million for Data Breach That Affected 500 Million Users

Featured Deal: Pay What You Want Complete Cyber Security Certification Bundle Deal

Need help identifying Ransomware

Started by omnichad , Jan 21 2017 11:26 AM

This topic is locked

3 replies to this topic

#1 omnichad

Members
1 posts
OFFLINE

Local time:09:40 PM

Posted 21 January 2017 - 11:26 AM

Filenames that are encrypted have the following appended to the filename:
ID-ADD471B8US[crypt32@mail.ru].mgazadcanwa2aa

So file.txt becomes file.txt.ID-ADD471B8US[crypt32@mail.ru].mgazadcanwa2aa

I searched the ID Ransomware site and was given a case SHA1 of 58e663031b092c5d5e13763721d67013909a844d

Edited by omnichad, 21 January 2017 - 11:26 AM.

Back to top

BC AdBot (Login to Remove)

BleepingComputer.com
Register to remove ads

#2 thyrex

Members
526 posts
OFFLINE

Gender:Male
Location:Belarus
Local time:12:40 AM

Posted 21 January 2017 - 01:08 PM

I think that it something like that

Microsoft MVP 2012-2016 Consumer Security

Microsoft Reconnect 2016

Back to top

#3 Demonslay335

Ransomware Hunter

Security Colleague
3,430 posts
OFFLINE

Gender:Male
Location:USA
Local time:04:40 PM

Posted 21 January 2017 - 11:45 PM

It's Al-Namrood 2.0. I added rules after seeing your submission multiple times actually.

I'm afraid there is no way to decrypt the files, it is the secure version of the ransomware that they updated, the Emsisoft decrypter no longer works for it. You'll want to lock down your RDP, as that's how they got in...

ID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

CryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.

Back to top

#4 quietman7

Bleepin' Janitor

Global Moderator
50,957 posts
OFFLINE

Gender:Male
Location:Virginia, USA
Local time:05:40 PM

Posted 22 January 2017 - 06:34 AM

There is an ongoing discussion in this topic where you can ask any more questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

Al-Namrood Ransomware (.access_denied) Support & Help Topic

Rather than have everyone with individual topics, it would be best (and more manageable for staff) if you posted any more questions, comments or requests for assistance in the above support topic discussion. To avoid unnecessary confusion, this topic is closed.

Thanks
The BC Staff

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015