Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Generic User Avatar

LockBit 3.0 Black / CriptomanGizmo ([random 9 chars]; README.txt) Support Topic


  • Please log in to reply
290 replies to this topic

#16 3mz

3mz

  •  Avatar image
  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 28 January 2023 - 04:39 PM

here is the archive

 

Attached Files



BC AdBot (Login to Remove)

 


#17 3mz

3mz

  •  Avatar image
  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 28 January 2023 - 04:42 PM

after the the first post i have received

also this from

HiAbhinavGupta

 

HiAbhinavGupta has sent you a new personal conversation entitled "About your virus file".

HiAbhinavGupta said:

You can contact with this cyber security expert team on Youtube . They solved our all infected files recently. I believe They can help you to get your files back
Their Youtube channel: https://youtu.be/G-xDxZUm6-g

PLEASE DO NOT REPLY DIRECTLY TO THIS EMAIL!
You can reply to this personal conversation by following the link below:

https://www.bleepingcomputer.com/forums/index.php?app=members&module=messaging&section=view&do=showConversation&topicID=196805#msg427134

 

---------------------

i think they should be banned



#18 quietman7

quietman7

    Bleepin' Gumshoe


  •  Avatar image
  • Global Moderator
  • 62,063 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:07 AM

Posted 28 January 2023 - 04:46 PM

HiAbhinavGupta has been banned.
 
Ransomware victims should IGNORE, (not reply back, deal with or negotiate payments with) anyone who may contact them via Private Message (PM) on this forum or by email making claims they can decrypt your data. Please read my comments in this topic for information as to what we know about those who claim they can decrypt data (including scammers, the criminals and data recovery services). 
 
Ransomware victims should also ignore all Google searches which which provide numerous links to bogus and untrustworthy ransomware (malware) removal guides, including Youtube videos, many of which falsely claim to have decryption solutions. After our experts tweet/write about a new ransomware or new variants, junk articles with misinformation are quickly written in order to scare and goad desperate victims into using or purchasing mostly sham removal and decryption software. Victims typically are directed to download a multitude of unnecessary and useless tools. In some cases, unsuspecting victims may actually be downloading a fake decryptor with more ransomware resulting in double-encryption that makes the situation even worst. Only use trusted sources when searching for information.


.
.
Microsoft MVP Alumni 2023Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif


#19 TwoPack

TwoPack

  •  Avatar image
  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 28 January 2023 - 05:23 PM

Hello... 

 

.......From what I have found it is an asymmetric cipher works with a pair of keys. A public key used to encrypt the data and a private key used to decrypt the data. The best-known asymmetric encryption algorithm is RSA. And according to an analysis of my infected files ... I discovered that the criminals use half of this key which is in the infected file itself and the other half is at home .... and that mean a lot of things....!


Edited by TwoPack, 28 January 2023 - 05:25 PM.


#20 Amigo-A

Amigo-A

    Security specialist and Ransomware expert


  •  Avatar image
  • Members
  • 3,072 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bering Strait
  • Local time:01:07 PM

Posted 29 January 2023 - 02:53 AM

 
The extortionists did not give their ransomware name. I gave him such a name, used the logins of his email from the first variant.
 
CriptomanGizmo Ransomware can spread worldwide.
 
Other than my Digest and this forum topic, there are no other sources of information on this ransomware group.
It is necessary to ignore all other sites that copy-paste information and offer fake decryption methods.
 
Only after a detailed research and cryptoanalysis by trusted companies, it will be known about the decryption method.
You must contact the CERT in your country to investigate incidents. The information will be aggregated.
 
Encrypted files and ransom notes must be saved in a safe place.

Edited by Amigo-A, 29 January 2023 - 04:32 AM.

My site: The Digest "Crypto-Ransomware"  + Google Translate 

 


#21 3mz

3mz

  •  Avatar image
  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 29 January 2023 - 04:17 AM

Thanks everyone for the time and research now that I've been hit, I'll go deeper thanks to the indications you've given me



#22 quietman7

quietman7

    Bleepin' Gumshoe


  •  Avatar image
  • Global Moderator
  • 62,063 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:07 AM

Posted 29 January 2023 - 06:45 AM

@3mz

 

I have merged your posting and related comments into the primary support topic for victims of this ransomware.


.
.
Microsoft MVP Alumni 2023Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif


#23 sfc_94

sfc_94

  •  Avatar image
  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 07 February 2023 - 03:55 PM

Hola, buenas tardes, todos los archivos de mi ordenador han sido encriptados y creo que es con CriptomanGizmo... Os dejo el mensaje de rescate aquí: iWtc0qQZ2.README
SUS ARCHIVOS ESTÁN CIFRADOS!!!
 
Para la recuperación de datos contáctenos tendrá que pagarnos:
fireco@onionmail.com
firecorecoverfiles@msgsafe.io
Telegrama: @firecorecoverfiles
1. ¡En la primera letra, indique su identificación personal!
2. En respuesta, le enviaremos instrucciones.
 
>>>> Su ID de descifrado personal: 5DD95B05B1A723EE5252535455555657
 
Creo que el ataque fue llevado a cabo por RPD ... Esperemos que se encuentre una solución... Adjunto dos archivos cifrados y los mismos sin cifrar.

Edited by sfc_94, 07 February 2023 - 05:10 PM.


#24 quietman7

quietman7

    Bleepin' Gumshoe


  •  Avatar image
  • Global Moderator
  • 62,063 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:07 AM

Posted 07 February 2023 - 04:01 PM

No conozco ningún método conocido para descifrar archivos cifrados por CryptomanGizmo Ransomware sin pagar el rescate (no recomendable) y obtener las claves de cifrado privadas de los delincuentes que crearon el ransomware a menos que las autoridades las filtren o las incauten y las liberen.


.
.
Microsoft MVP Alumni 2023Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif


#25 sfc_94

sfc_94

  •  Avatar image
  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 07 February 2023 - 05:03 PM

Sent the files in case they can help....



#26 quietman7

quietman7

    Bleepin' Gumshoe


  •  Avatar image
  • Global Moderator
  • 62,063 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:07 AM

Posted 07 February 2023 - 05:07 PM

There is no place to send the files. They are part of your attachment for anyone to download and inspect.


.
.
Microsoft MVP Alumni 2023Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif


#27 Amigo-A

Amigo-A

    Security specialist and Ransomware expert


  •  Avatar image
  • Members
  • 3,072 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bering Strait
  • Local time:01:07 PM

Posted 08 February 2023 - 02:23 AM

Yes, it's CriptomanGizmo Ransomware, that's what we call it, since the extortionists didn't come up with a name for their ransomware.

 

A decryption method does not yet exist. In addition, we do not have a sample of the malicious file to link to one of the known ransomware groups and try to conduct reverse engineering.


Edited by Amigo-A, 08 February 2023 - 02:24 AM.

My site: The Digest "Crypto-Ransomware"  + Google Translate 

 


#28 sfc_94

sfc_94

  •  Avatar image
  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 08 February 2023 - 03:07 AM

what file do you need? If you want I can send you some document.

#29 quietman7

quietman7

    Bleepin' Gumshoe


  •  Avatar image
  • Global Moderator
  • 62,063 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:07 AM

Posted 08 February 2023 - 06:53 AM

The document will not be helpful with decryption.


.
.
Microsoft MVP Alumni 2023Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif


#30 Amigo-A

Amigo-A

    Security specialist and Ransomware expert


  •  Avatar image
  • Members
  • 3,072 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bering Strait
  • Local time:01:07 PM

Posted 08 February 2023 - 11:19 AM

Immediately after attacking and encrypting files, you can search for malicious files.

Temporary files can be found, which will be a copy of the malicious files.

Once time has passed and the temporary folders have been cleared, it is difficult to find anything. 

 

Recently we collected temporary files and files from the anti-virus quarantine and replicated the encryption situation. But this other ransomware. 
Thus it is possible to recover malicious files in the any case. But 99% of those affected cannot do so. 

Edited by Amigo-A, 08 February 2023 - 11:23 AM.

My site: The Digest "Crypto-Ransomware"  + Google Translate 

 





4 user(s) are reading this topic

2 members, 2 guests, 0 anonymous users


    Azzie86, mkqqq