eCh0raix Ransomware - QNAPCrypt/Synology NAS (.encrypt) Support Topic

hello,
 
I also have the same issue. Some of my files have been encrypted with the .encrypt extension.
 
Please how can i decrypt this?
 
Thank you

.

Note: ECh0raix is not related to Muhstik. As such, victims of ransomware with the .muhstik extension, please post in this Support Topic.
 

You can submit (upload) samples of encrypted files, ransom notes and any contact email addresses or hyperlinks provided by the malware developer to ID Ransomware (IDR) or Emsisoft Identify your ransomware for assistance with identification and confirmation of the infection. This is a service that helps identify what ransomware may have encrypted your files, whether it is decryptable and then attempts to direct you to an appropriate support topic where you can seek further assistance. ID Ransomware can identify ransomwares which adds a prefix instead of an extension and more accurately ransomwares by filemarkers if applicable. Uploading both encrypted files and ransom notes together along with any contact email addresses or hyperlinks provided by the criminals gives a more positive match with identification and helps to avoid false detections.

 

My file is encrypt by .encrypt extension but .....not alphaDecrypter

Could I have any chance to save ?

You have replied to a topic almost three years old.

The .encrypt extension is now more generic since it is used by several types of known and  unidentified ransomware.

The only way to identify the different ransomwares that use a "generic extension" is the ransom note (including it's name and contents), samples of the encrypted files, possible filemarkers, the malware file itself responsible for the infection and information related to any email addresses or hyperlinks provided by the cyber-criminals to request payment.

As I noted above, you can submit (upload) samples of encrypted files, ransom notes and any contact email addresses or hyperlinks provided by the malware developer to ID Ransomware (IDR) for assistance with identification and confirmation of the infection. Uploading both encrypted files, ransom notes and any contact email addresses or hyperlinks provided by the malware developer together provides a more positive match with identification and helps to avoid false detections. Submitting any email addresses or hyperlinks provided by the criminals may also be helpful with identification.

Please provide a link to the ID Ransomware results. If ID Ransomware cannot identify the infection, you can post the case SHA1 it gives you in your next reply for Demonslay335 (Michael Gillespie) to manually inspect the files and check for possible file markers.

Thank you quietman7

I Try to used ID Ransomware (IDR) And upload the text and encerpt file

The result is may be Alpha,Crypy,KeRanger

I will keep search more information ,thanks a lot

I try used README_FOR_DECRYPT tor hyperlink to IDR,it give me a sha

Please reference this case SHA1: 68164fa290904ac8236ea7a012eebb5b05bbf7dd

Edited by frankiewu61, 23 June 2019 - 02:34 AM.

Ok. Please be patient until Demonslay335 has a chance to review the case SHA1 you provided. He may be able to gather some information by manually inspecting the files. He is inundated with support requests and and it may take some time to get a reply.
 

Ok. Please be patient until Demonslay335 has a chance to review the case SHA1 you provided. He may be able to gather some information by manually inspecting the files. He is inundated with support requests and and it may take some time to get a reply.
 

-------------------------------------------------------------------------------------------------------------------------

OK Thanks a lot ~~~~have a nice day

 

Update 

May be not useful , i tried used GibonDecrypter , this tool say decrypt success , but no luck

 

 

Edited by frankiewu61, 23 June 2019 - 10:31 AM.

Looks like I am in the same situation. Uploaded to IDR and got the same results. Files attatched.

I'm suffered from the same symptoms, most of my clients are Mac OSX while the encrypted files are on a QNAP NAS, users had NOT isolate the NAS and clients, and was copying files on every clients. I've install Avast on most of the clients (2 are too old and OS cannot be upgraded, so Avast not supported). 

How bad can it be? 

How to stop further infection, identify and ease the malware?

How to prevent and avoid future infection?

How to recover?

The symptoms was first discovered on 21 Jun 2019 00:43 (GMT+8), I will try to upload the information and files. Thanks! 

Attaching the files for Demonslay335 please. I think we all get the same, and at the aliked time.

 for-ransomware-identification-eggxpert-20190625.zip   122.06KB   31 downloads

I'm suffered from the same symptoms, most of my clients are Mac OSX while the encrypted files are on a QNAP NAS, users had NOT isolate the NAS and clients, and was copying files on every clients. I've install Avast on most of the clients (2 are too old and OS cannot be upgraded, so Avast not supported). 

 

How bad can it be? 

How to stop further infection, identify and ease the malware?

How to prevent and avoid future infection?

How to recover?

 

The symptoms was first discovered on 21 Jun 2019 00:43 (GMT+8), I will try to upload the information and files. Thanks! 

 

m

I'm suffered from the same symptoms, most of my clients are Mac OSX while the encrypted files are on a QNAP NAS, users had NOT isolate the NAS and clients, and was copying files on every clients. I've install Avast on most of the clients (2 are too old and OS cannot be upgraded, so Avast not supported). 

 

How bad can it be? 

How to stop further infection, identify and ease the malware?

How to prevent and avoid future infection?

How to recover?

 

The symptoms was first discovered on 21 Jun 2019 00:43 (GMT+8), I will try to upload the information and files. Thanks! 

Me too , my clients are MAC OSX and encrypted files on a QNAP NAS

See my comments in this topic in regards to removing the malware responsible for the infection and saving your encrypted data.

The best defensive strategy to protect yourself from malware and ransomware (crypto malware) infections is a comprehensive approach to include prevention. Make sure you are running an updated anti-virus and anti-malware product, update all vulnerable software, use supplemental security tools with anti-exploitation features capable of stopping (preventing) infection before it can cause any damage, disable VSSAdmin, close Remote Desktop Protocol (RDP) if you do not need it and routinely backup your data.

For more suggestions to protect yourself from malware and ransomware (crypto malware) infection, see my comments (Post #14) in this topic...it includes a list of prevention tools.
 

Hello

There is another new topic here, which describes the case of encrypting files with the same .encrypt extension.

Perhaps, you can find similar details and tell us.

Edited by Amigo-A, 25 June 2019 - 02:35 PM.