HsHarada/Rapture Ransomware ([random 6 chars]; -README.txt) Support Topic

Any files that are encrypted with HsHarada Ransomware (Rapture Ransomware) will have a random 6 or 14 character alpha-numerical extension appended to the end of the encrypted data filename and typically will leave ransom notes which include apparently the same [random 6 or 14 character]-README.txt but actually a "hard-coded character string" as part of its name as explained here by Amigo-A (Andrew Ivanov). These are some examples?

.m9SRob
.ua2Id7
.JCuYqr
.353a66e3004269
m9SRob-README.txt
ua2Id7-README.txt
JCuYqr-README.txt
353a66e3004269-README.txt

HsHarada ransom notes are known to include a long string of alpha-numerical characters comprising a SPECIAL KEY (unique ID, custom ID) similar to N3ww4v3/Mimic but without an asterisk (*) and extension after the ID numbers.

YOUR SPECIAL KEY is F2nQOVOzOPeK853xvR3zo0PnSZd8cInPF9rWP9ydQTJzfMtJaZ
Your unique ID is  9eCTFzqgMRJ3AIlUbdOkNSEEk0YTHw9ek2ybsjskiSxiVjrsDl
YOUR ID is uudzWKLfmLzF9SRsHj5tiSKmYVbjFkmzMy8NdTjPyE4CppYmRZ
your exclusive ID: H4wSDVOzOPeK853xvR3zo0PnSZd8cInPF9rWP9ydQTJzaFxKB2
Your Crp ID is  1nFDQEUWZCOJeAEGNtsLyW8jaaTI2oHioJqDVY78Jy1qvGNBsK
Your custom ID : pgAeE4KO8PlaQ6XwLjjkRxyer2nl6_vAmc4aTg

Attackers Email provided by rivitna (Andrey Zhdanov)

hsharada@skiff.com
r.heisler@keemail.me
r.heisler@skiff.com
rainbowforever@skiff.com
rainbowforever@tutanota.com
ghostsbackup@skiff.com
summerkiller@tutanota.com
shadowghost@skiff.com
lastghost@skiff.com
Rsacrpthelp@skiff.com

crypto scheme: AES-256 CFB / RSA-2048

 
 
This morning I got m9SRob extension on my important files. Encrypted and cannot be used. I searched online and no result..please help me with this type and decryptor

Regards
Adha

3b7dd97e903b62c4fa28a148cb422139c1312bef

The .m9SRob extension may be a new variant of N3ww4v3/Mimic Ransomware which will have a random 5-15 character extension (.n3ww4v3, .3kfAp, .r0Qp@3M, .1cy931cn9v, .h777XRgNVM777xM) appended to the end of the encrypted data filename OR append a .crypt, .HONESTBITCOIN, .Fora, .Hairysquid, .PORTHUB, .QUIETPLACE, .bigspermhorseballs, .KASPERSKY, .shiverer, .darth, .Indianguy, .damarans, .dataland. 

N3ww4v3/Mimic is known to include a long string decryption ID (number, identifier, decrypt ID, unique ID, tox ID) in the ransom note as shown in these examples.

Your identifier (ID) ZeNL5bqnUMCrcKKK_jaHtrsyxuqzJUPU4-Rq6uMjpHM*w9lq64h4
Your decrypt ID is: lpQdH_qHD4LmEC7Hrrt208Pc5ce_aNHNF98mJEeDkwI*9niOpX
Your unique ID is: O28KRMGjKkx_zW7J2TdbdzDe7VluLemi5bv_C9vu7Ww*giapk33vw
Send your unique id crQ_J-dUfG54f2pRx1-mZmXZIJ9jWyGDr4SXALv3owA*KASPERSKY
In subject line please write your decryption ID: kV7sbyJMAseAKZH8JBYMLNQI4D36YWOYL0m2ZcCLMjg*Fora
Encryption Number  : 4L3hC49ng92fRIFuIipkrUXTTVy4v4J8rLPwCELRDlI*dataland

In your case...

YOUR SPECIAL KEY is F2nQOVOzOPeK853xvR3zo0PnSZd8cInPF9rWP9ydQTJzfMtJaZ

If this is N3ww4v3/Mimic Ransomware....it is not decryptable without paying the ransom (not advisable) and obtaining the private encryption keys from the criminals who created the ransomware unless they are leaked or seized & released by authorities.
 
Please attach several samples of encrypted files (different formats - doc, png, jpg) AND its original (unencrypted) file in a "zip file" for comparison so Amigo-A (Andrew Ivanov) can inspect them and possibly confirm the infection (and/or add to his database). 
 
To attach files....Click the More Reply Options button in the bottom right corner of the Board Editor, then click the Choose File button under Attach Files.
 
If you need individual assistance from our experts ONLY with removing the malware infection, (not decryption of your data), there are advanced tools which can be used to investigate but they are not permitted in this forum. Please follow the instructions in the Malware Removal and Log Section Preparation Guide. When you have done that, start a new topic and post your FRST logs in the Virus, Trojan, Spyware, and Malware Removal Logs Forum, NOT here, for assistance by the Malware Response Team.

If Adha didn't change anything in the ransom note, then it's not N3ww4v3/Mimic Ransomware.

Edited by Amigo-A, 06 April 2023 - 11:12 PM.

Adha

Is the word "hsharada" associated with you or a company you know?

5 files are needed for research: png, jpg, doc, pdf, txt

Edited by Amigo-A, 07 April 2023 - 01:22 PM.