Topic: DELETE ME PLEASE (Read 1010 times)

@OP: Let me be very frank and honest with you:

Anyone here who will mention that they can decrypt the files - is talking shit purely because they 1) just want to get your wallet.dat hoping that they can get lucky, or, 2) have no idea what they are talking about.
You can quote me on this: no-one, and I repeat NO-ONE will be able to decrypt your files. You can try to prove me wrong - but before that go take a primer in basic cryptography, specifically asymmetrical encryption to see why it is impossible to decrypt a message without having the signing private key. Unfortunately for you- the only person/people having this private key are those who have written the malware/ransomware. So basically - if you cannot get at least the latter (i.e.: actual ransomware app used for encryption) for someone to reverse engineer and extract the private key used for signing - I am afraid you are solely at the mercy of the people that have created the ransomware.

For anyone else now who will be able to claim that they can decrypt the OP's wallet.dat - please send me a PM, I will make you famous for being able to do the impossible.

@OP: If you someday can find the actual ransomware app - let me know, I am a Certified Ethical Hacker, and have reverse engineering skills. I make no promises of being able to extract the private key (assuming it is embedded therein without heavy code obfuscation) but will do it for you for free - I don't expect remuneration for helping someone.

The more people see this, less people fall for your scam.

Looking forward to that day you send a signed message from this address 13Lo5aZDZuEm4qVF478KfWJUvi9JCDngAx .

You clearly are blind.
Did you notice the "Either Near28 is you alt-account OR you are actually the guy behind the proton email-address replying him", that makes you a suspect at best.

I accused TS, and suddenly you make it all about you, so you are TS after all?

I do not care what you think, I never defended the TS. Your allegations against him are not my problem.

And now I'll explain it in detail because you are too blind to see it.


refers only to that:



Roger that? Because slowly it gets annoying.

Seriously, if the guy was legit, he would just post his encrypted wallet.dat file instead of his qr code.
He claims the wallet file is password protected, so I see no reason not to give it to anyone who wants to crack this type of encryption. There is a password protected file with 1 BTC in it, which nobody has cracked, so this is safe.

You are welcome, the whole story doesn't looks strange to me, it looks exactly like a scam attempt.
You are just too blind to see.

What did you accomplish by sending that email? Let me tell you, nothing at all.
TS is the one behind that email and playing you like a fool.


You know what, what about you bet with me?
A symbolic amount of 0.1BTC, of course we will use a trusted escrow for that.

If TS can't provide a signed message from his address 13Lo5aZDZuEm4qVF478KfWJUvi9JCDngAx within 3 months time, I win.
Otherwise you win.

Thanks for the accusation but next time let it be if you have no proof and only suspect because.. because of what?
If you had read the whole thread, you would have seen that the whole story looks strange to me as well - That's why I sent an email to the operator of the onion site - to see how he reacts.

However, I can not help the TS - So I stay away from the thread before the next "investigator" comes and suspects me for no reason.

This mean for pc that still infected with ransomware which "??.exe" is ransom software that active on your pc background.

This is exactly what caught my attention to investigate.

Either Near28 is you alt-account or you are actually the guy behind the proton email-address replying him.
You trying so hard to act like you are the victim backfired.

Good luck with your scamming.

Kahc, you're one smart ass motherfucka, nice one.

SCAM alert!
You are right, I'm certain this is a scam.


There are just too many signs that point to scam:
 
1. How convenient that this http://www.fixallthreats.com/help-get-rid-igza4c-file-virus/ suddenly appears on search engine.
Lol, check their removal methods for all their malwares/viruses listed on their page,  the same fucking screenshots.

2. TS had the chance to decrypt one file for free and chooses to decrypt a QR image instead of his wallet.dat .

3. iGZa4C isn't mentioned anywhere before, because the name was recently made up by TS.

4. TS tries to play innocent and offers to send his wallet and password to the trusted escrow ognasty, and that anyone willing to give 0.1 BTC would get 0.25 BTC after the wallet is decrypted.
However an escrow wouldn't be of much help in this case, since the wallet.dat most probably is empty/fake.

5. http://igza4c6icqzboodb.onion got indexed 08.03.2018. (image  provided)
TS thought people would not notice since they can't do a whois-lookup?

You are in a really shitty situation, I do not know how I would react. as I have already told you: I also talked to them and I do not think that's scam.
I also offered to send him 0.35BTC (Of course I would not have sent it to him, I just wanted to see how he reacted) but he refused with the same explanation he give you, everything is automated.
No idea, if all was fraud, he would have safely accepted the 0.35BTC.

I hope for you that you still find someone who can crack that - but unfortunately I see little to no chance.

The issue now isn't about recovering your wallet through cracking it, I think your chances here are pretty well impossible without even knowing the ransomware responsible and the little information we have to go on.

The issue now is, do you waste $5000 for nothing, providing the wallet address means you can do a lookup, see when it was last active etc.

Right now, I'm thinking your $5000 will go to complete waste.

Would rather not go on to a tor website just to get his wallet address, can you post it here?

I cant find good information about this encrypted file on that site. I posted it on facebook group too but they dont know what is this ransom or how to decrypt it  .

Do you have his wallet address? have you looked it up?

Have you googled his email or contact method?
I would be careful expecting a result from a person doing this back in 2014.

What is uniquePass? if that's your wallet password then I would avoid going through with this, in that case it's most likely he has your wallet.dat and is using this to try get your password so he can take over your wallet, probably takes the wallet, assigns an ID, waits for you to hand over your pass phrase then you're screwed, you'll lose what ever you send him + your wallet.

It's a shame you formatted the computer and lost the malware/virus that did this, cracking a key on a strong encryption is going to be pretty well impossible, your best bet would of been to try reverse engineer the executable that encrypted your wallet.dat and find the key this way, good chance they're using a mainstream encryption like AES, getting the key from the executable was really your only hope.

If you can some how get it back through a file recovery tool, assuming you identified it first, I'll give it a go.

But not backing up wallet.dat and formatting the machine seems a bit suspicious.

Never heared from such an idea 

I think this depends on how the ransomware is coded. It might be the case that the ransomware is going to encrypt the whole HD (not just all files, but all sectors of the hard drive).
In this case this wouldn't work, unfortunately.

Additionally it also depends on whether the deleted files already got overwritten.
Assuming HDD (because recovery is extremely difficulty on SSD's):
If you move your file into the trashcan and empty it, the file is not really 'deleted'. The space (where the file was) is being released.
Depending on how much space your HD has and how much you are writing onto your HD, the timeframe in which the file is still available varys heavily.
For example: If you 'fill' your harddrive completely, your file is no longer available on your HD, for sure.




At least that could work in such a case
But i'd still recommend a 'standard' backup (e.g. move to USB's) instead of deleting a copy in the hope of being able to recover it someday

So basically if the guy at some point moved - duplicated - deleted to trashcan one copy of wallet.dat - emptied the trashcan, Recuva would work to recover it even if the HD is encrypted, since the ransomware would not encrypt that deleted file. Wow, that's a good reason to create a copy of your wallet.dat, delete it to trashcan and empty it, just in case you ever get ransomware. Interesting way to back up a wallet.dat 

Ransomware is coded to encrypt the whole HD (somtimes: except from a few directories to still show desktop, ransom notice, etc.. ).
Usually there are no unencrypted files anywhere on the hard drive left.

Since recuva is a software to restore deleted[1] files, this unfortunately can't work out.


[1] deleted in terms of removed from the trash bin, but not yet overwritten on the HD.

I haven't tried breaking ransomeware before, sounds challenging.
A question though ,would it not be easier to run something like Recuva on the HD to try to recover the old unencrypted wallet.dat instead of trying to decrypt the new one?
This would be your decoded QR file, right?
https://imgur.com/a/uR1lN

It seems you have a lot of people professing they can solve your problem but the fact of the matter is that most ransomware viruses generate special keys per infected user usually something like (public key + master key) = decrypt files. most of the time the time these ransomware programs are impossible to decrypt unless there keys have been confiscated by authorities. I was surprised that google showed virtually nothing for igza4c as this seems to be there file extension. do you recall anything else around the time of infection such as a screen locker any relevant pictures or even a brand such as (coinvault) ?

Hi just went through ur post mayb I can help u . But not here start with email and on email we will share our numbers then we will start decrypting
Regards
Chandan
[email protected]

can you upload more encrypted files except your wallet without renamed it (3 or 5 encrypted files)

May I ask why you didn't use the offered one free decrypt on your wallet?
Instead you upload a QR image?

I can help you. The encryption on this is weak. Email me at [email protected]

You should provide a file that is not allready cracked and downloadable for each one on the .onion site.
Each dork can download the decrypted .png file (http://igza4c6icqzboodb.onion/tmpdwn/Q7Lh4Rqr.png.iGZa4C.decrypt) and claim he has cracked it.

just my 2 cents.

PM sent.

If this is the encryption used here, then i think you don't have a problem

https://imgur.com/a/1KX1j

Don't deal with anyone or newbie except for higher ranks with neutral or positive trust.

Could you try this method?

First, you must show hidden files and folders by opening folder option,

Folder option can be found here, click start>use the search bar>type "folder option" without quote>click view tab

Now, change the "hidden files and folders" to show hidden files, folders and drive-off

Then scroll down and look for "Hide protected operating system files" then uncheck.

Now go to  C:\Users\admin\AppData\Roaming\Electrum\wallets

inside the folder, it must be your wallet.dat but the attributes still are hidden you can use the unhide tool.

Copy that wallet.dat into USB and use this tool http://ccm.net/download/download-24190-usb-show

open USB show then locate your USB to unhide the file.

Now you should have the wallet.dat unhide,

Note you must use a clean computer where you wanted to import your wallet.dat for safety purposes.

Hope this time your problem solve.

If not let me try to solve your problem via chrome remote desktop just pm me.

if only you've made several copies of your wallet.dat, this won't be happening
make multiple copies, rename them and store them in different places
or dump private keys in a text, zip encrypt it, hide it with inconspicuous name
anything could've helped you gain control back of your fund without paying the ransom

I might be able to help.   shoot me an email [email protected], I need additional information.

@OP: There's something odd here - how were you notified by the attacker of the ransomware and receive instructions for payment? 
It's highly improbable that you were sent an email. So what method was used to inform you??

your encrypted file is only qr code of your address? LOL

https://prnt.sc/ip088v

I experienced to remove encrypted files or infected PC with ransomware before I use 2 types of tools, one is kaspersky ransomware decryptor and the other one is Hiren's Proteus, which is paid version. I don't know if the free version of hiren's can remove the latest ransomware but you can try.

Try this first https://noransom.kaspersky.com/

There are different tools of decryptor in kaspersky and try them 1 by 1 because we don't know what type of ransomware you have.

You can try the hiren's for scanning your pc on bootable built in os and scan using avira and you must choose clean or fix only Do this at your own risk because if you choose to delete/remove some of your system files could be deleted that can affect your pc boot up.

You can download the free version of hiren's here https://www.hiren.info/pages/bootcd

But you need an extra usb flashdrive or cd to burn hiren's bootcd.

This tool is for technician only, but if you wanted to repair and remove viruses and malware to your pc this tool could help.

Honestly, I am using the hiren's proteus version which includes premium tools than a free version. However, you can try the free version.

for complete decryption i need access to infected computer its not so easy as you think

Profile, than in the menu left, Personal Message Options, "allow Newbies to send you PNs".

The public key is written in every file (It is the Unique-ID). The Scammer will send him the Master-Key + the Software that reverse the encryption. The chance to Crack/Brutforce what ever is is almost zero

Sure resembles asymmetrical encryption to me.
Can you go to the infected PC and run the following at the command prompt:

certmgr.msc

Then in the window that opens- in the left pane, click on the "Personal" folder and see what comes up (if anything) in the right pane.

My guess is that the malware created a self-signed certificate in the certificate store then used the public key to encrypt the content of files in the background.
So if you were to pay the ransom - the app sent to you would reverse the process using the private key.

Sorry to say this - but if this is the case then there is no way to get the private key used for encryption. No hacker or service can help - we don't have the quantum computing technology for this yet.

give me a try to decrypt files let me see what i can do i have solved similar cases there is no 100% success but we can

Turn your PNs on for "Newbies". i want to send you something.

they answered you?

turn on your PNs for Newbies.

Calm down, eternalgloom is not wrong, caution is always required. Nobody can check if the wallet is real or fake, it is fully encrypted so nobody can verify it.

Honestly, I do not think it's easy to crack, the encryption and everything around it (the site etc) looks solid, it does not look like amateurs.
No idea how you got that on your pc, apparently it was never really in circulation otherwise we would have heard of it already.

That's probably the most realistic chance you have.

I'm really not buying it, I agree with what DannyHamilton said and I think it's option 2. I would really advise against giving this guy any money.
OP, if you are somehow telling the truth, you shouldn't be trying to beg for money on this forum.

For all we know, you could be the one in control of that ransomware deposit address. I'm sorry if you are being honest OP, but even then you should pay for this yourself.

The whole thing is pretty confused.

I tried to decrypt your private key with known master keys, but unfortunately no success.
All persons I know have never heard of it or of the Nazi story...

I'm running out of ideas, the page actually seems to be fully automatic and someone pays the server bills... So it's up to you to pay or not or try to get in touch with this guys.

Try this site to detect your ransom type https://id-ransomware.malwarehunterteam.com/index.php , i want try to identify it but need more info about it such as ransom note to upload. I think you still have it.
If thats not detect as ransom, then you can Contact them and fill anything they need. AFAIK they probably can solve your problem by detect the ransom and give you the decrypt tool for free, and you can donate your bitcoin to their address. So you dont need to give your wallet to another people, just wait them to make decrypt tool for you.

I'm a bit skeptic on this discussion.
I have some beliefs that the wallet is not his, and he just found it somewhere from the web
the wallet dated back 2014 and no transactions ever since and he just come forward today?
did it get infected by ransomware recently or a long time ago?

have news for you.

I think the encryption was done with the old "Enc.Module", 2014 there was a wallet.dat with the same encryption which some people wanted to crack - recently, someone has managed to crack it.
Maybe somehow I'll get it in my hands - It seems to be a "two step" encryption.


Your wallet.dat looks like this?:

https://pastebin.com/raw/TunXFaDT

There are two possibilities here:

1.  Needfasthelp123 legitimately has 10.5 BTC locked up in a ransomware attack and can't afford the 0.5 BTC necessary to get the decryption completed (or is intelligently is unwilling to pay the ransom).

2.  Needfasthelp123 is a scammer that has provided a fake encrypted wallet and is trying to trick greedy people into sending him 0.5 BTC. He is hoping that someone will try to pay the ransom thinking that they will be able to decrypt the wallet and take the 10.5 BTC.  In that case, he receives the 10.5 BTC, and the fool that pays the ransom discovers that the encrypted file is not the wallet that Needfasthelp123 claims it is.

Unless you are Needfasthelp123 (or are willing to lose 0.5 BTC), DO NOT PAY THE RANSOM!
Unless you have adequate collateral (or are willing to lose 0.5 BTC), DO NOT LOAN the funds for the ransom to Needfasthelp123!

Hopefully the OP is honest, and hopefully someone can either help him crack the encryption of SELL him the necessary funds.

Did you make a backup of your wallet.dat or seed phrase?

@OP:

Can you do the following:

1) Assuming you are on Windows- press Crt+Alt+Del to bring up the Task Manager.
2) Click on the Processes tab and maximize the screen so that all running processes are in view.
3) Take a screenshot of the above and upload somewhere - post the link here.
4) Download Malwarebytes Anti-Malware (if you don't have it already) and update the signature/pattern database to the latest.
5) Run a full malware scan (might take an hour or 2 - depending on how big your HDD is) - post the results of the scan here.

Currently, not much. I will ask a few more people. The Decryption seems to work (i have seen your .png) but otherwise 0.5BTC is pretty much, what I know about such shi* scammer is that the normaly take a 100-500$ fee but not 5K - The number of people who would pay so much is extremely low.

I think this Ransomware-shit is a bit older.

I'll stay tuned, but I'm not home until evening.

Not for me. I only reach the "Enter-Page" "Welcome to our Service" enter the Gate Code - Timeout!

Got it

Post the instructions here. I get a timeout all the time...

when was the data encrypted? recently?

Edit:

Unfortunately, I find no information, not in Clearnet and nothing in the deepweb (in my sources). The thing is either pretty new or not mainstream.
At first glance, I would say it's a base64 encryption.

delete thread please