CriptomanGizmo Ransomware (random extension) Support Topic

Maybe someone can help with the decryption.
 
Ransom Note Contents:
 

        ~~~ https://t.me/decrutor the world's fastest ransomware since 2023~~~
 
>>>> Your data are stolen and encrypted
 
RECHECK WHETHER WE HAVE A DECODER, DO NOT SEND LEGI WITHOUT TEST FILES. BEWARE OF FAKE TELEGRAM ACCOUNTS
 
Links for Tor Browser:
https://t.me/decrutor
 
Links for the normal browser
https://t.me/decrutor
 
>>>> What guarantees that we will not deceive you? 
 
We are not a politically motivated group and we do not need anything other than your money. 
    
If you pay, we will provide you the programs for decryption and we will delete your data. 
Life is too short to be sad. Be not sad, money, it is only paper.
    
If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. 
Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment.
    
You can obtain information about us on twitter https://t.me/decrutor
    
>>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID
 
Download and install TOR Browser https://t.me/decrutor
Write to a chat and wait for the answer, we will always answer you. 
Sometimes you will need to wait for our answer because we attack many companies.
 
Links for Tor Browser:
https://t.me/decrutor
 
Link for the normal browser
https://t.me/decrutor
 
If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in Telegram or WebMail.
 
https://t.me/decrutor
 
>>>> Your personal DECRYPTION ID: 0D4726C60545E66F7A63330CE76CDAF9
 
>>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
 
>>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
 
Telegram ID TelegramSupp: @decrutor
Web (Mail) Support: https://t.me/decrutor
 
If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser 
 
Links for Tor Browser:
    https://t.me/decrutor
    https://t.me/decrutor
 
Links for the normal browser
https://t.me/decrutor

It's very similar to LockBit 3 (Black) ransomware (Salsa20 / RSA-1024)

In this case, you need the RSA private key to decrypt files.

Edited by rivitna, 13 September 2023 - 11:30 AM.

Maybe someone can help with the decryption.

Is this your topic on the Kaspersky forum?

https://forum.kasperskyclub.ru/topic/427521-shifrovalshhik-viyajqnrd

The extension looks random.
 
There are several different ransomware infections which append a random 3, 4, 5, 6, 7, 8, etc character extension to the end of encrypted data filenames to include Sodinokibi (REvil), Magniber (Magniber 2022), CriptomanGizmo Ransomware, N3ww4v3/Mimic, Zeppelin, NoEscape (No_Escape), AVADDON, Ako, BlackCat/ALPHV, Black Basta, RCRU64, LV Ransomware, 0kilobypt (Wiper/Eraser), GermanWiper, MrDec (Mr.Dec), Buran, Geneve, Maze (ChaCha), Hades, Mailto (Koko - Netwalker), Mailto-2 (Kazkavkovkiz), Nomikon, Paymen45, Conti, B2DR, Blitzkrieg, BitRansomare, Snatch, STOP (Djvu), Erika, Skull, SynAck, 05250lock, CTB-Locker, Crypt0L0cker, CryptON (aka Cry9, Cry36, Cry128, Nemesis), GandCrab V5.0.4+/v5+, Maktub Locker, Alma Locker, $$$ LokerAdmin, Princess Locker, Princess Evolution, Locked-In, Mischa, Goldeneye, Al-Namrood 2.0, Cerber v4x/v5x, some Xorist variants and many other unidentified ransomwares.
 
Is .ViyAJQnRd the full extension appended to the end of the encrypted data filenames?
 
Based on infection rates involving files encrypted with random 9 character alpha-numerical extensions and ransom notes named with the same [random 9 char extension].README.txt you most likely are dealing with a variant of CriptomanGizmo Ransomware. These are some examples.

<filename>.hZiV1YwzR
<filename>.3WbzmF0CC
<filename>.JxxLLpPns
hZiV1YwzR.README.txt
3WbzmF0CC.README.txt
JxxLLpPns.README.txt

 In your case if this is the extension

Some CriptomanGizmo ransom notes are known to include a long string personal Decryption ID (similar to N3ww4v3/Mimic Ransomware but without an asterisk (*) and extension after the ID numbers).

Your personal DECRYPTION ID: 495927C9CC58D8A36B47827EAE1AEA72
»» Your personal DECRYPTION ID: 9FE85D4F9C7EA210F904E9BC55F74ECA
>>>> Your personal DECRYPTION ID: 8F2AC6FD69FFFB2BEF710F5010CA2763
specify your ID - 6800F4848694EC5B39B3525AF9F34521
YOU LOCK-ID: 7565BD6495000673051C5B6F24EE1B30

Your ransom note contains: >>>> Your personal DECRYPTION ID: 0D4726C60545E66F7A63330CE76CDAF9

" Это ваша тема на форуме Kaspersky?

https://forum.kasperskyclub.ru/topic/427521-shifrovalshhik-viyajqnrd"

Yes, my topic.

Bleepin' Gumshoe

It turns out there is no way to decrypt the data yet?

Edited by evsev84, 14 September 2023 - 11:37 PM.