id-7E8DD729.[newSanta@protonmail.com]

[vincentc]

Hi all,

Recently my company do have this kind of file  xxxxxx.png.id-7E8DD729.[newSanta@protonmail.com].java, I would this is Ransomware, but when I use Malwarebytes to scan, it doesn't detect anything.

[miekiemoes]

Hi,

These files are not malicious. They are the encrypted files. No other AV would detect these either.

Malwarebytes does detect the payload of this variant and our AntiRansomware also detects and blocks this.

[Aura]

On a side note, can you upload one of the encrypted file to ID-Ransomware, and copy/paste the results URL here?

https://id-ransomware.malwarehunterteam.com/

[vincentc]

Dharma (.cezar)

 This ransomware has no known way of decrypting data at this time.

It is recommended to backup your encrypted files, and hope for a solution in the future.

Identified by

• sample_extension: .id-<id>.[<email>].java
• ransomnote_email: newSanta@protonmail.com
• sample_bytes: [0xE2380 - 0xE23C0] 0x00000000020000000CFE7A410000000000000000000000002000000000000000
• custom_rule: Original filename "12.jpg" after filemarker

 

Click here for more information about Dharma (.cezar)

[ivanog]

Me too on server 2012 in 24/12/2017 discover it today !!
xxxxxx-xxxxxx.txt.id-14A1804E.[myr_cat@protonmail.com].java
All my files encrypted this is one file .txt  this is the added extension ".id-14A1804E.[myr_cat@protonmail.com].java"
How I can solve the problem ?
I have to pay ?
Same answer from https://id-ransomware.malwarehunterteam.com/index.php

Edited December 27, 2017 by ivanog

[Aura]

Hi guys,

Sadly, as stated by ID-Ransomware, there's no way to decrypt the files encrypted by the Ransomware you were hit it for free. Paying is the "only solution", though don't forget that you are dealing with cybercriminals here, and they might just rip you off. Your best bet is to restore your files from a recent backup (if you have one), or if you don't, back up the encrypted files somewhere safe and hope that a free decryption solution will be released in the future.

[Aura]

Do you guys need more assistance with this, or you're good?

[vincentc]

i just get this...

[Aura]

Yes, this is the ransom note from the ransomware you've been hit with. This is the email address of the crooks behind the ransomware. If you contact them, they'll give you further instructions on how to pay the ransom (which I advise you not to) to get your files back.

[Aura]

Anything else?

[Aura]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread.

Thanks