onphiya Posted November 4, 2018 ID:1279263 Share Posted November 4, 2018 I'm following this thread as i had someone reach out to me about this same ransomware. I am having them load the note/file to the site you listed above and waiting for the results they send back. Link to post Share on other sites More sharing options...
onphiya Posted November 4, 2018 Author ID:1279266 Share Posted November 4, 2018 see attached. TIA Link to post Share on other sites More sharing options...
Aura Posted November 4, 2018 ID:1279275 Share Posted November 4, 2018 Hi onphiya I split both of your posts in their own thread to make things easier. As stated by ID-Ransomware, further analysis of that Ransomware is required. Is your friend from Poland? Also, according to the article, the campaign died quickly, so I wonder if this is from a new one. https://www.bleepingcomputer.com/news/security/nozelesn-ransomware-reportedly-using-spam-to-target-poland/ Link to post Share on other sites More sharing options...
onphiya Posted November 4, 2018 Author ID:1279276 Share Posted November 4, 2018 Can anyone assist with decryption of the files and removing from device? Link to post Share on other sites More sharing options...
David H. Lipman Posted November 4, 2018 ID:1279278 Share Posted November 4, 2018 I see the word "device" and I see graphics from a Smart Phone. Since this is a MS Windows Malware Removal sub-forum, can you please elaborate and provide substantiating facts. Link to post Share on other sites More sharing options...
onphiya Posted November 4, 2018 Author ID:1279280 Share Posted November 4, 2018 (edited) Its a windows 10 computer and since it's infected i did it from my phone to not infect anything else. What else would you want to know about the machine to help assist in removing if possible Edited November 4, 2018 by onphiya typo Link to post Share on other sites More sharing options...
onphiya Posted November 4, 2018 Author ID:1279281 Share Posted November 4, 2018 41 minutes ago, Aura said: Hi onphiya I split both of your posts in their own thread to make things easier. As stated by ID-Ransomware, further analysis of that Ransomware is required. Is your friend from Poland? Also, according to the article, the campaign died quickly, so I wonder if this is from a new one. https://www.bleepingcomputer.com/news/security/nozelesn-ransomware-reportedly-using-spam-to-target-poland/ Okay sorry got confused sorry for the repost.. saw it gone and had no clue what happened. Link to post Share on other sites More sharing options...
David H. Lipman Posted November 4, 2018 ID:1279282 Share Posted November 4, 2018 Have you uploaded sample encrypted files to ID Ransomware ? Link to post Share on other sites More sharing options...
onphiya Posted November 4, 2018 Author ID:1279283 Share Posted November 4, 2018 Not in Poland.. Campaign died quickly means? Link to post Share on other sites More sharing options...
onphiya Posted November 4, 2018 Author ID:1279284 Share Posted November 4, 2018 2 minutes ago, David H. Lipman said: Have you uploaded sample encrypted files to ID Ransomware ? Uploaded the note and the screen shot is what came back do you want me to load a file and see what it says? Link to post Share on other sites More sharing options...
David H. Lipman Posted November 4, 2018 ID:1279285 Share Posted November 4, 2018 I mean a JPG, MP3, DOC, etc file that had been encrypted by the Ransomware and submit that encrypted file. Campaign dies quickly means the distribution of this malware had a relatively short life span. So Aura is thinking of whether this is Revision B of the July campaign. Link to post Share on other sites More sharing options...
onphiya Posted November 4, 2018 Author ID:1279288 Share Posted November 4, 2018 Oh okay gotcha.. Loading a file now give me a sec and ill report back Link to post Share on other sites More sharing options...
onphiya Posted November 4, 2018 Author ID:1279293 Share Posted November 4, 2018 Link to post Share on other sites More sharing options...
Aura Posted November 4, 2018 ID:1279295 Share Posted November 4, 2018 Here, you should reach out in the support thread for that Ransomware on BC, as if there are any updates regarding it, they'll be posted there. https://www.bleepingcomputer.com/forums/t/679953/nozelesn-ransomware-support-help-topic-nozelesn-how-fix-nozelesn-fileshtm/ Link to post Share on other sites More sharing options...
onphiya Posted November 4, 2018 Author ID:1279297 Share Posted November 4, 2018 3 minutes ago, Aura said: Here, you should reach out in the support thread for that Ransomware on BC, as if there are any updates regarding it, they'll be posted there. https://www.bleepingcomputer.com/forums/t/679953/nozelesn-ransomware-support-help-topic-nozelesn-how-fix-nozelesn-fileshtm/ Okay thanx Link to post Share on other sites More sharing options...
Aura Posted November 4, 2018 ID:1279299 Share Posted November 4, 2018 No problem. Anything else we can assist with, or that was it? Link to post Share on other sites More sharing options...
onphiya Posted November 5, 2018 Author ID:1279449 Share Posted November 5, 2018 Not at this moment on this topic. Will pace the other forum to see when a fix is out. Thank you for your quick replies and assistance. Really appreciated!!! Aura & David!!! Link to post Share on other sites More sharing options...
Aura Posted November 5, 2018 ID:1279491 Share Posted November 5, 2018 No problem onphiya, you're welcome! Stay safe Link to post Share on other sites More sharing options...
Aura Posted November 5, 2018 ID:1279492 Share Posted November 5, 2018 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts