Press Ransomware (.press, .spfre; RECOVERY NFO.txt) Support Topic

Any files that are encrypted with Press Ransomware will have an .press, .dwarf, .spfre extension appended to the end of the encrypted data filename and typically leave files (ransom notes) named RECOVERY NFO.txt as explained here by Amigo-A (Andrew Ivanov).

rivitna (Andrey Zhdanov) may be able to help victims but you need to contact him privately.

If you have become a victim of this ransomware, write to me PM :-)

 
 
Hi, I have attack from an unknown ransomware. I can't find a decryption tool for it. Can you help me identify it and know which tool to use?
I am attaching the ransom note and the affected files.
All the files in the computer were given an extension: .press
 
ID Ransomware
SHA1: f20cf0856a94f8678f0a9876cd3c660062c20a4c
 
Thx!

Is .press the full extension appended to the end of the encrypted data filename or is there an .[email], an ID number with random characters (.id-A04EBFC2, .id[4D21EF37-2214]), an ID number with an email address (.id-BCBEF350.[<email>], .id[7A9B748C-1104].[<email>]) or just a series of random characters (.8SLV8GMp-hjqo9v3s) preceding the extension?

RECOVERY NFO.txt contents:

Hi, it's always the .press extension without any other data. Thx

If you can find the malicious executable that you suspect was involved in causing the infection, you can submit (upload) a sample to VirusTotal and provide a link to the results...this is the safest way of sharing malware since only vetted researchers can access it. Doing that may be helpful with any of the following: analyzing, investigating, identification of the ransomware and possibly finding a flaw which could be useful for decryption of encrypted data. Refer to my comments in this topic (Post #18) for the most common locations malicious executables are know to hide.

I think the files can be decrypted. :-)

Hi,

Ok, I'm going to try to find the culprit. Thx

If you can find the malicious executable that you suspect was involved in causing the infection, you can submit (upload) a sample to VirusTotal and provide a link to the results...this is the safest way of sharing malware since only vetted researchers can access it. Doing that may be helpful with any of the following: analyzing, investigating, identification of the ransomware and possibly finding a flaw which could be useful for decryption of encrypted data. Refer to my comments in this topic (Post #18) for the most common locations malicious executables are know to hide.

I think the files can be decrypted. :-)

Thx

Hi,

I have passed the MalwareBytes scan, attached the result, so I see indicates that it is the virus.neshta.

"Virus.Neshta, C:\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\MAINTENANCESERVICE.EXE, Sin acciones por parte del usuario, 1944, 1196847, 1.0.79047, , ame, , 99AC881582035C636C2359FCC7C72B71, 8AA538991767D32B538AD399C1E2AF1E536AB9FC04CA70F13C0728347F404753

Virustotal ID:

Thx

Edited by Sr_Scorpio, 30 December 2023 - 02:39 PM.

This is the legitimate Microsoft Edge module infected with the Neshta virus.

Most likely, the ransomware was infected with the Neshta virus.

Ransomware families such as Proxima and LokiLocker are often used in conjunction with the Neshta virus

Edited by rivitna, 30 December 2023 - 02:58 PM.

Hi,

Sorry, I didn't attach the full log correctly.Can this give more information ?

This is the legitimate Microsoft Edge module infected with the Neshta virus.

 

Most likely, the ransomware was infected with the Neshta virus.

Ransomware families such as Proxima and LokiLocker are often used in conjunction with the Neshta virus

I haven't found the file that may have caused the infection.

Any tool to decrypt the files of the ransomware you mention? I don't see anything related in "nomoreransom .org"

Thx

 

Any tool to decrypt the files of the ransomware you mention? I don't see anything related in "nomoreransom .org"

Yesterday I sent you PM what I need to decrypt

Any news on that? I have the exact same problem eheh

I have an idea. I have sent you PM :-)

If you have become a victim of this ransomware, write to me PM :-)

A friend has been hit with exactly the same but the files end in .spfre

 

A friend has been hit with exactly the same but the files end in .spfre

 

Yeah, Press ransomware use this extension :-)