Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News:    NSA shares zero-trust guidance to limit adversaries on the network

Featured Deal: Enjoy quick, compatible data transfers with this $59.99 portable SSD

Latest Buyer's Guide:    Hotspot Shield VPN review

Generic User Avatar

Checkmate Ransomware (.checkmate) Support Topic

Started by sikich , Jun 08 2022 05:30 AM

  • Please log in to reply
91 replies to this topic

#1 sikich

sikich

  • Avatar image
  • Members
  • 11 posts
  • OFFLINE
    •  
  • Local time:07:08 AM

Posted 08 June 2022 - 05:30 AM

Hi!
I need some help wit new (I believe)  ransomware, which encrypt files on QNAP storage of my clients. Ransom puts .checkmate file extension.
 

Please, reffer to this id-ransomware case SHA1: f0512f8e17ad4fdc9e880775d012a9b1be275871 
 

Thanks in advance!


BC AdBot (Login to Remove)

 

#2 quietman7

quietman7

    Bleepin' Gumshoe


  • Avatar image
  • Global Moderator
  • 61,818 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:08 AM

Posted 08 June 2022 - 05:32 AM

Is there an .[email], an ID number with random characters (.id-A04EBFC2, .id[4D21EF37-2214]) or an ID number with an email address (.id-BCBEF350.[<email>], .id[7A9B748C-1104].[<email>], _ID_<id***>_<email>) preceding the extension?
 
Did you find any ransom notes? If so, what is the actual name of the ransom note?
Can you provide (copy & paste) the ransom note contents in your next reply?


.
.
Microsoft MVP Alumni 2023, Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 sikich

sikich
  • Topic Starter

  • Avatar image
  • Members
  • 11 posts
  • OFFLINE
    •  
  • Local time:07:08 AM

Posted 08 June 2022 - 05:38 AM

 

 

Is there an .[email], an ID number with random characters (.id-A04EBFC2, .id[4D21EF37-2214]) or an ID number with an email address (.id-BCBEF350.[<email>], .id[7A9B748C-1104].[<email>], _ID_<id***>_<email>) preceding the extension?
 
Did you find any ransom notes? If so, what is the actual name of the ransom note?
Can you provide (copy & paste) the ransom note contents in your next reply?

Sorry, no email, but there is a file called "!CHECKMATE_DECRYPTION_README"

Here is the content: 
"

.........
You was hacked by CHECKMATE team.

All your data has been encrypted, backups have been deleted.
Your unique ID: bc75c72[edited]
You can restore the data by paying us money.
We have encrypted 267183 office files.
We determine the amount of the ransom from the number of encrypted office files.
The cost of decryption is 15000 USD.
Payment is made to a unique bitcoin wallet.
Before paying, you will be able to make sure that we can actually decrypt your files.
For this:
1) Download and install Telegram Messenger https://telegram.org/
3) Send a message with your unique ID and 3 files for test decryption. Files should be no more than 15mb each.
4) In response, we will send the decrypted files and a bitcoin wallet for payment. Bitcoin wallet is unique for you, so we can find out what you paid.
5) After the payment is received, we will send you the key and the decryption program.
...........
"

#4 Amigo-A

Amigo-A

    Security specialist and Ransomware expert


  • Avatar image
  • Members
  • 3,049 posts
  • ONLINE
    •  
  • Gender:Male
  • Location:Bering Strait
  • Local time:10:08 AM

Posted 08 June 2022 - 12:19 PM

Attach file "!CHECKMATE_DECRYPTION_README"  to your message. 

Do not change anything, the file must be original. 

 

Attach an zip-archive with 2-3 files for comparison. 


Edited by Amigo-A, 08 June 2022 - 12:20 PM.

My site: The Digest "Crypto-Ransomware"  + Google Translate 

 

#5 duttex

duttex

  • Avatar image
  • Members
  • 4 posts
  • OFFLINE
    •  
  • Local time:10:08 PM

Posted 09 June 2022 - 12:00 AM

@sikich by any chance can I get one ID to try and speak with him on tele and get their btc address? thanks


#6 sikich

sikich
  • Topic Starter

  • Avatar image
  • Members
  • 11 posts
  • OFFLINE
    •  
  • Local time:07:08 AM

Posted 09 June 2022 - 04:11 AM

@Amigo-A, sorry ;-) 

Attached Files


Edited by sikich, 09 June 2022 - 04:13 AM.

#7 sikich

sikich
  • Topic Starter

  • Avatar image
  • Members
  • 11 posts
  • OFFLINE
    •  
  • Local time:07:08 AM

Posted 09 June 2022 - 04:15 AM

@duttex, I'm not completely shure that is a good idea ...


#8 Amigo-A

Amigo-A

    Security specialist and Ransomware expert


  • Avatar image
  • Members
  • 3,049 posts
  • ONLINE
    •  
  • Gender:Male
  • Location:Bering Strait
  • Local time:10:08 AM

Posted 09 June 2022 - 05:00 AM

The ID-Ransomware service does not identify this to previous ransomware. 
Visually, there are no elements that I can link to those already known ransomware. 
 
Therefore, it can be considered a new Checkmate Ransomware.

Edited by Amigo-A, 09 June 2022 - 07:43 AM.

My site: The Digest "Crypto-Ransomware"  + Google Translate 

 

#9 Amigo-A

Amigo-A

    Security specialist and Ransomware expert


  • Avatar image
  • Members
  • 3,049 posts
  • ONLINE
    •  
  • Gender:Male
  • Location:Bering Strait
  • Local time:10:08 AM

Posted 09 June 2022 - 11:17 AM

If you can collect a collection of encrypted image files (jpg, png), then send me and I will try several recovery tools.

The result is not known in advance, I'll just try what I can.


Edited by Amigo-A, 09 June 2022 - 11:19 AM.

My site: The Digest "Crypto-Ransomware"  + Google Translate 

 

#10 rohitsecres

rohitsecres

  • Avatar image
  • Members
  • 3 posts
  • OFFLINE
    •  
  • Local time:10:38 AM

Posted 09 June 2022 - 12:22 PM

Sample available ?


#11 sikich

sikich
  • Topic Starter

  • Avatar image
  • Members
  • 11 posts
  • OFFLINE
    •  
  • Local time:07:08 AM

Posted 10 June 2022 - 01:40 AM

@Amigo-A Ok. try those :) 

Attached Files


#12 Amigo-A

Amigo-A

    Security specialist and Ransomware expert


  • Avatar image
  • Members
  • 3,049 posts
  • ONLINE
    •  
  • Gender:Male
  • Location:Bering Strait
  • Local time:10:08 AM

Posted 10 June 2022 - 01:54 AM

I forgot to say, me need at least one original unencrypted file from these files.


My site: The Digest "Crypto-Ransomware"  + Google Translate 

 

#13 rohitsecres

rohitsecres

  • Avatar image
  • Members
  • 3 posts
  • OFFLINE
    •  
  • Local time:10:38 AM

Posted 10 June 2022 - 02:00 AM

Can any please provide the sample for deep analysis purpose, would be great


Edited by rohitsecres, 10 June 2022 - 02:00 AM.

#14 Amigo-A

Amigo-A

    Security specialist and Ransomware expert


  • Avatar image
  • Members
  • 3,049 posts
  • ONLINE
    •  
  • Gender:Male
  • Location:Bering Strait
  • Local time:10:08 AM

Posted 10 June 2022 - 02:04 AM

rohitsecres

There are no samples. There are only encrypted files.


My site: The Digest "Crypto-Ransomware"  + Google Translate 

 

#15 DecAns

DecAns

  • Avatar image
  • Members
  • 46 posts
  • OFFLINE
    •  
  • Local time:08:08 AM

Posted 10 June 2022 - 03:17 AM

try those

It looks like that the only first 8192 bytes are encrypted. And jpeg files can be partially repaired with JpegMedic ARWE.


Back to Ransomware Help & Tech Support


1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users


  1. BleepingComputer.com
  2. → Security
  3. → Ransomware Help & Tech Support
  4. Privacy Policy
  5. Rules ·