Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Pendor Ransomware (.pnr - READ_THIS_FILE_1.TXT) Support Topic


  • Please log in to reply
7 replies to this topic

#1 translatorsafy

translatorsafy

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:06 PM

Posted 07 February 2018 - 05:48 PM

im in big crisis for nearly six months now. my bad luck led mt to press a link which contained a ransomeware called (pendor)
all files are decrypted now. im a refugee i have not all this money they want and even if i have i would never surrender to thieves. please advise me with a free app or cheap one. i tried many apps but in vain
 
the extension of files .pnr
 
id ransomware told me it's called pendor
 
 

Operating System: Windows 7
 32-bit (x86)
Infection date and initial symptoms: nearly august 2017. pendor ransomeware crypted allll my files
 
 i used spy hunter and removed the virus but all my files are still encrypted

 
i can buy cheap software but not too expensive. please help and advise me with guaranteed one. all my memories gone with the wind

Edited by quietman7, 08 February 2018 - 06:18 PM.


BC AdBot (Login to Remove)

 


m

#2 translatorsafy

translatorsafy
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:06 PM

Posted 07 February 2018 - 05:51 PM

please help  i put my hope in you after God :(



#3 translatorsafy

translatorsafy
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:06 PM

Posted 07 February 2018 - 05:56 PM

this is what the thieves said to me

 

If YOU SEE THIS TEXT, THEN YOUR FILES ARE ECNRYPTED!

===============================================================================

Nobody can recover your files without our decryption service.

We guarantee that you can recover all your files.

All you need to do is submit the payment and purchase the decryption key.

 

 

Please follow the instruction:

 

1. Send $50 worth of Bitcoin to following address:

1KBLAXQJQida4NM4AMkZNc6h42ddASLpaj

 

2. Send your PERSONAL ID and Bitcoin address:

-- 1. To our TOR decryption service: http://pendor4cys5ofnxh.onion/

-- 2. To e-mail: pendor@tuta.io

 

 

 

 

Detailed instructions:

===============================================================================

     

I. Registration bitcoin purse

-- 1. Follow this link: https://blockchain.info/wallet/#/signup

-- 2. Sign up for an account.

-- 3. Copy a recieve address to your clipboard.

          

II. Replenishment of the bitcoin account

     

* Webmoney instructions:

-- https://wmeng.exchanger.ru/asp/wmlist.asp?exchtype=34

-- https://wmx.wmtransfer.com/Home/Withdraw

          

* Qiwi instructions:

-- https://www.bestchange.ru/qiwi-to-bitcoin.html

-- https://ww-pay.com/qwrub-to-btc   

     

* Paypal instructions:

-- https://99bitcoins.com/buying-bitcoins-with-paypal-a-practical-guide/

-- https://paxful.com/buy-bitcoin/paypal    

     

* Visa instruction:

-- https://www.bestchange.ru/visa-mastercard-usd-to-bitcoin.html

         

* Also, you can read this recomendations:

-- https://www.bitcoin.com/getting-started        

     

III. Send bitcoin ($50) to our address: 1KBLAXQJQida4NM4AMkZNc6h42ddASLpaj    

     

IV. Getting decryption key:

-- 1. Go to:  https://www.torproject.org/download/download-easy.html.en

-- 2. Click "DOWNLOAD" button.

-- 3. Download and install Tor Browser.

-- 4. Open Tor Browser and follow this link: http://pendor4cys5ofnxh.onion

-- 5. Enter your Bitcoin address and your PERSONAL ID.

-- 6. Press "CHECK" button.

 

 

 

 

 

ALTERNATIVE TOR DECRYPTION SERVICES:

===============================================================================

If our main TOR decryption service doesn`t work, you can use this once:

     

* http://pendor4cys5ofnxh.onion/

     

* http://pendorh4pamngr6t.onion/

     

* http://pendorqpdauhcmzp.onion/

     

* http://pendoru632ry2xiu.onion/

     

     

Alternative e-mails:

     

* pendor@tuta.io

 

* pendor_1@tutanota.com

 

 

-



#4 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,366 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:06 AM

Posted 07 February 2018 - 06:06 PM

I have Pendor marked as "Possible" for decryption, and I have some tools laying around for it, but I don't remember if I was successful in fully cracking it. I'll have to take a further look, I hardly remember that one.

 

Could you PM me some encrypted files and their originals? I will also need your "PERSONAL ID", which should be in that ransom note.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#5 translatorsafy

translatorsafy
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:06 PM

Posted 07 February 2018 - 07:02 PM

thank u bro

i sent u msg plz check ur inbox



#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,606 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:06 AM

Posted 08 February 2018 - 07:02 AM

Please be patient until Demonslay335 has a chance to review the information you provided. BleepingComputer is inundated with support requests and he is not logged in at the moment.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 Amigo-A

Amigo-A

  • Members
  • 334 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:3st station from Sun
  • Local time:03:06 PM

Posted 08 February 2018 - 11:23 AM

I checked the contents of this ransom note with my article about Pendor Rw.
The text is identical. Even the addresses are the same.

My projects: Digest "Crypto-Ransomwares" + Anti-Ransomware Project (In Russian) + Google Translate Technology

Have you been attacked by a Ransomware? Report here. Пострадали от шифровальщика? Сообщите мне здесь. 


#8 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,366 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:06 AM

Posted 08 February 2018 - 11:54 AM

Yes, it's Pendor. We're still currently working on a decrypter; it is completely crackable, just working on the encryption part.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users