TzingTzongPing Posted June 28, 2023 Report Share Posted June 28, 2023 (edited) Salut, am un client care a luat ransomware pe doua servere SQL, extensia ransomware este .ohkmdo3 si nu pot gasii pe internet nimic pentru a decrypta fisierele. Ma poate ajuta cineva cu o sugestie, un program orice. Platesc daca este nevoie! Din cate am observat cred ca este ransomware BlackCat " Important files on your network was ENCRYPTED and now they have "ohkmdo3" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your network was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more... Samples are available on your User Panel. >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next?" Multumesc Edited June 28, 2023 by TzingTzongPing Quote Link to comment Share on other sites More sharing options...
Nytro Posted June 28, 2023 Report Share Posted June 28, 2023 Salut, daca nu apare ceva public, gen un decryptor de la o firma care face research/antivirus sunt mici sansele sa mearga ceva. Unele ransomeware sunt idioate si nu fac cine stie ce encryption, dar nu e un proces complicat ca sa greseasca des. Asta ar necesita reverse engineering pe ransomware facut de cineva priceput si poate sa nu functioneze. Dar clientul nu are backups? Ransomware mi se par niste janghine de malware ca un simplu backup poate scapa de el. Quote Link to comment Share on other sites More sharing options...
TzingTzongPing Posted June 28, 2023 Author Report Share Posted June 28, 2023 Salut, Au backup dar sunt mai vechi, de duminica, vroiam sa recuperez cel mai recent backup. Este o frima din Australia si au multe date. Pot face file system restoring de pe HD? sunt si Windows VDI, trebuie neaparat sa recuperez aceste data, bagamias picioarele in iei de Rusi cu ransomeware lor. este vorba de ALPHV Blackcat, nu pot gasii nici pe deep web un decryptor ? Quote Link to comment Share on other sites More sharing options...
Nytro Posted June 28, 2023 Report Share Posted June 28, 2023 Decryptere exista pentru foarte putine ransomware, cazurile in care: 1. S-a putut face unul - aka algoritmi de criptare facuti prost sau deloc 2. A meritat - aka cazuri in care companii importante au fost atacate si firme de research au avut motivatie financiara sa faca unul Dar sunt mii astfel de ransomware si sansele de decryptor sunt mici... Backup de duminica e lux, problema e la cei care nu au deloc. Da, nu e ideal, dar e foarte bine totusi. Oficial pot sa dea vina ca le-au crapat niste servere. Quote Link to comment Share on other sites More sharing options...
TzingTzongPing Posted June 28, 2023 Author Report Share Posted June 28, 2023 Am inteles. O sa incerc totusi cu ceva programe gen : https://www.easeus.com/ad/data-recovery-wizard.htm poate reusesc sa recuperez ceva mai recent, trebuie sa fie undeva pe HD ceva ramas. Quote Link to comment Share on other sites More sharing options...
Nytro Posted June 28, 2023 Report Share Posted June 28, 2023 Poti incerca, conteaza mult cum se face suprascrierea de date de catre ransomware si de filesystem. Daca nu se modifica datele inline pe disk e posibil sa poti recupera anumite date, dar sansele sunt mici dat fiind faptul ca ransomware suprascrie fisiere care in final au aceeasi dimensiune. Quote Link to comment Share on other sites More sharing options...
Kev Posted July 3, 2023 Report Share Posted July 3, 2023 incearca sa citesti fisierele cu un Live Linux Quote Link to comment Share on other sites More sharing options...
aelius Posted July 3, 2023 Report Share Posted July 3, 2023 On 6/28/2023 at 3:52 PM, TzingTzongPing said: bagamias picioarele in iei de Rusi cu ransomeware lor. Aia nu ie rusi bre. E ucrainieni, fută-i soarele si bunicu lu Hristos. 🤣🤣🤣 Quote Link to comment Share on other sites More sharing options...
