[12321]

Hi!
anyone know how to get rid of this (without paying them!)

*** ALL YOUR WORK AND PERSONAL FILES HAVE BEEN ENCRYPTED *

To decrypt your files you need to buy the special software. To recover data, follow the instructions!
You can find out the details/ask questions in the chat:
fgb45ft3pqamyji7.onion.to (not need Tor)
fgb45ft3pqamyji7.onion.cab (not need Tor)
fgb45ft3pqamyji7.onion.nu (not need Tor)

You ID: ##########

If the resource is not available for a long time, install and use the Tor-browser:
1. Run your Internet-browser
2. Enter or copy the address torproject.org/download/download-easy.html in the address bar of your browser and press key ENTER
3. On the site will be offered to download the Tor-browser, download and install it. Run.
4. Connect with the button "Connect" (if you use the English version)
5. After connection, the usual Tor-browser window will open
6. Enter or copy the address fgb45ft3pqamyji7.onion in the address bar of Tor-browser and press key ENTER
7. Wait for the site to load

If you have any problems installing or using, please visit the video tutorial youtube.com/watch?v=gOgh3ABju6Q

in the chat they giving you this:

To decrypt your files you need to buy the special software – «Nemesis decryptor»

The cost of the decoder: 300 USD
Payment method: Bitcoin
Bitcoin Wallet: 154HVeXdQUTTHVMoiM2gdm5rUho7W4khb1

// After payment you will receive an instruction, decoder software and private key.

INSTRUCTIONS:
1. It is necessary to register here - blockchain.info/wallet/new
2. Find online shop that sells Bitcoin (cryptocurrency) and replenish your wallet. Query: buy bitcoin (in google) or from the list below.
3. en.bitcoin.it/wiki/Help:FAQ (for newbies) **********************************
Online shop:
coincafe.com
localbitcoins.com
remitano.com
coinbase.com
buybitcoinworldwide.com
xmlgold.eu
cex.io
247exchange.com
************************************

they got my family photos just before backup... 😭

[5chn4pp]

Submit the note and a encrypted file to this site:

https://id-ransomware.malwarehunterteam.com/

Also please tell us what extension your encrypted files has.

[12321]

Submit the note and a encrypted file to this site

it says This

ransomware is decryptable!
Identified by
ransomnote_url: fgb45ft3pqamyji7.onion

and possible to use cry9, but

oi66.tiny pic.com/14abu6p.jpg
oi64.tiny pic.com/34jajoj.jpg (sorry can't post images, remove space in tiny_pic)

Also please tell us what extension your encrypted files has.

Rufus v2.14.1086.exe.id_##########_fgb45ft3pqamyji7.onion

###### - my id number for the ransom

[5chn4pp]

Try using a larger file than the one you used there, then post results.

[12321]

it wants differences between files 68b
and my files ~36b

[5chn4pp]

Try these decryptors and see if it does anything:

https://decrypter.emsisoft.com/cry9

https://decrypter.emsisoft.com/cry128

[Ranger.]

You should seek out real professional advice from someone such as a malware researcher.
If it turns out that the data cannot be decrypted & retrieved, due to the way that is coded then there is nothing that you can do.
Most of the ransom-ware nowadays are pretty secure and it should be pretty hard to retrieve the data, unless you're in a special case with a complete idiot of a programmer; if someone has done research on the piece of ransom-ware that infected you and it can be easily decrypted due to flaws in code.

If the family photos are really important for you and for your family then just pay the ransom.
$300 is a lot, I get it, but you will still end up wasting a lot by trying to find out if the data can be decrypted (through e.g. sending the PC to repair shops.)
And let me not mention the time that you will lose by trying to solve the issue..

[12321]

@Satudarah
i already tried almost all emsisoft tools, they heard about this malware version and on their forum they are talked about started working on the solution with crypton/cry9/cry128... but they don't know how long it will take...

@Ranger.
the problem with paying ransom is will i get files back or they just ruined them and want money, or will just take money and then what keep waiting in the stupid chat that they opened?

[5chn4pp]

If you pay, theres like a 85% chance of getting your files back.

How did you get infected in the first place? Do you still have the file?

[12321]

i have no idea how it happened, there was random resets last week or two and yesterday after reset got this surprise...
how do i find out if it's still around or some timers waiting to "finish the job"?

[5chn4pp]

What about this one:

https://decrypter.emsisoft.com/crypton

Also, please upload an encrypted file and post it here so i can look closer.

[12321]

yes
emsisoft have only 3 potential tools for this problem that they are working on their update crypton/cry9/cry128


original:
upload.ee/files/6989190/SpeedyFox_v2.0.20.117.zip.html

changed:
upload.ee/files/6989192/SpeedyFox_v2.0.20.117.zip.id_188510917_fgb45ft3pqamyji7.onion.html


if it'll help more, i also have NFO files, maybe it'll be easier to find how they did it:
original:
upload.ee/files/6989228/uTorrent_-_Remove_Ads.nfo.html

changed:
upload.ee/files/6989229/uTorrent_-_Remove_Ads.nfo.id_188510917_fgb45ft3pqamyji7.onion.html

[5chn4pp]

I can't get anything off them, all you can do now is either wait or pay sadly.

https://www.bleepingcomputer.com/forums/...ion-virus/

Also, it looks like this guy has the exactly same infection as you, so if you feel lucky you can lurk this thread to see if they find a way to decrypt.

[12321]

thanks! will add it to emsisoft's forum links...

if anyone else have this crap, this is the links i found:
bleepingcomputer.com/forums/t/646173/emergency-need-help-about-onion-virus/ - thanks to Satudarah
bleepingcomputer.com/forums/t/645847/unable-to-determine-ransomware-files-crypted/
bleepingcomputer.com/forums/t/635859/crypton-ransomware-support-help-topic-id-number-x3m-locked-r9oj/page-10
support.emsisoft.com/topic/27231-cry9-invalid-crypton-file-pair/

[Nickname.]

Same issue! Any update? My RDP got hit by the Ransom none of Emisoft decrypters seemt too work!