Need help identifying Ransomware

Filenames that are encrypted have the following appended to the filename:
ID-ADD471B8US[crypt32@mail.ru].mgazadcanwa2aa

So file.txt becomes file.txt.ID-ADD471B8US[crypt32@mail.ru].mgazadcanwa2aa

I searched the ID Ransomware site and was given a case SHA1 of 58e663031b092c5d5e13763721d67013909a844d

Edited by omnichad, 21 January 2017 - 11:26 AM.

I think that it something like that

It's Al-Namrood 2.0. I added rules after seeing your submission multiple times actually.

 

I'm afraid there is no way to decrypt the files, it is the secure version of the ransomware that they updated, the Emsisoft decrypter no longer works for it. You'll want to lock down your RDP, as that's how they got in...

There is an ongoing discussion in this topic where you can ask any more questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

• Al-Namrood Ransomware (.access_denied) Support & Help Topic

Rather than have everyone with individual topics, it would be best (and more manageable for staff) if you posted any more questions, comments or requests for assistance in the above support topic discussion. To avoid unnecessary confusion, this topic is closed.

Thanks
The BC Staff