LockBit 3.0 Black / CriptomanGizmo ([random 9 chars]; README.txt) Support Topic

 

 

Today get encrypted with extension .QeGsHp1or (LockBit 3 Black/CriptomanGizmo)

 

Was the ransomware file found?

 

 

 

You can download Pictures.7z

Password: 111

 

Yes, you are right,

with Lockbit v3 Black it is difficult to count on a successful solution with file decryption, with extremely rare exceptions.

The private key is needed for decryption. Without the criminal's master private key, decryption is impossible. That usually means the key is unique (specific) for each victim and generated in a secure way (RSA, AES, Salsa20, ChaCha20, EDA2, ECDH, ECC) that cannot be brute-forced...the public key alone that encrypted files is useless for decryption.

Hi I have an executable I would like analysed please.

Samples of any suspicious executable's (installer, malicious files) can be submitted (uploaded) to VirusTotal for analysis and provide a link here to the results...this is the safest way of sharing malware since only vetted researchers can access it.

Well, i believe this is what got me. Files in the attached zip are 2 encrypted files and original copies i have but sadly i last did a backup a year prior. Not super bummed, but sad nonetheless. I also have the exe but it was quarantined by malwarebytes and no idea how to safely upload that to virustotal.

Any files that are encrypted with LockBit 3.0 (Black) / CriptomanGizmo ransomware (used by affiliate or non-LockBit affiliates after its builder was leaked) will have a random 9 character alpha-numerical extension appended to the end of the encrypted data filename and typically will leave files (ransom notes) which include the same [random 9 character].README.txt as part of its name.
 
Your M1ktYGeoW.README.txt ransom notes contents

!!! ALL YOUR FILES ARE ENCRYPTED!!!
All your files, documents, photos, databases and other important files are encrypted.
The only way to recover your files is to use a decryptor.
To get the decryptor, write to us by mail or telegram, specify the ID of the encrypted files in the letter:
Email: decryptor@cyberfear.com
Telegram: https://t.me/bit_decryptor
Warning.
* Do not rename encrypted files.
* Do not attempt to decrypt data using third party software as this may result in permanent data loss.
* Do not contact other people, only we can help you and recover your data.
Your personal decryption ID: 434A6B162800792CE433148D14BEF6E4

 
Some LockBit 3 Black/CriptomanGizmo ransom notes are known to include a long string of hexadecimal characters comprising a Decryption ID similar to N3ww4v3/Mimic but without an asterisk (*) and extension after the ID numbers.

Your personal DECRYPTION ID: 495927C9CC58D8A36B47827EAE1AEA72
»» Your personal DECRYPTION ID: 9FE85D4F9C7EA210F904E9BC55F74ECA
>>>> Your personal DECRYPTION ID: 8F2AC6FD69FFFB2BEF710F5010CA2763
specify your ID - 6800F4848694EC5B39B3525AF9F34521
report your ID - C7EC9516C90F63DF285
YOU LOCK-ID: 7565BD6495000673051C5B6F24EE1B30

Your ransom note contents are similar to what we have seen with this ransomware and includes a personal Decryption ID like those listed above.

Your personal decryption ID: 434A6B162800792CE433148D14BEF6E4

Please check the following link:

https://www.virustotal.com/gui/file/be7b47e592afbb27fe862fdb64dcbd8dcbe8ad2a6a9202e585c729ec09d91fd0

Genealogy: LockBit > BlackMatter > LockBit 3.0 (LockBit Black)...they are closely related.

Hello.

I wanted to ask you for some help if you can.

I, who am writing to you, am a blind person/can't see.

In August last year, I formatted the PC.

when I was trying to put a crack in a software, a ransomware called flamingo was introduced and it encrypted almost all the necessary files, it also created a txt file in each folder.

in this txt file, when I open it, it instructs me to pay money.

Do you know any solution to recover the documents by removing the second suffix with a decryptor?

the second suffix placed on the file is: .lAeSUZDqb

I also reformatted it to remove the ransomware, but I saved the encrypted ones on another external ssd hoping that a decryptor will come out.

@Riki-alban
.
You participated in this topic discussion a few months ago and have asked the same questions in this and various other topics. There is nothing new to report.

LockBit 4.0: Rebooting a Ransomware Empire
LockBit-NG-Dev (LockBit 4.0)

While previous LockBit malware is built in C/C++, the latest sample is a work-in-progress written in .NET that appears to be compiled with CoreRT, and packed with MPRESS. Trend Micro says that the malware includes a configuration file in JSON format that outlines the execution parameters such as execution date range, ransom note details, unique IDs, RSA public key, and other operational flags.

Ransom note contents:

~~~ LockBit 4.0 Ransomware since 2024~~~
>>>> Your data are stolen and encrypted
Price = 1000 $
Bitcoin = 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2
Email = jimyjoy139@proton.me
>>>> What guarantees that we will not deceive you?
We are not a politically motivated group and we do not need anything other than your money.
If you pay, we will provide you the programs for decryption and we will delete your data.
Life is too short to be sad. Be not sad, money, it is only paper.
If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future.
Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment.
>>>> Your personal DECRYPTION ID: -
>>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
>>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!