Magaskosh Ransomware (.magaskosh) Support Topic

i dont have the original files anymore but i sent the encrypted ones.

Edited by Amigo-A, 07 September 2023 - 07:59 AM.

i was able to find some original files and the encrypted ones . 

m0rpheus90

Your files also have:

At the beginning of each encrypted file there is a marker: rymozvpgflsstrhd

 

m0rpheus90 (upload) samples of encrypted files, ransom notes and any contact email addresses to ID Ransomware (IDR) so we get this in the system for Demonslay335.

i uploaded but it says this :

Please make sure you are uploading a ransom note and encrypted sample file from the same infection.

This can happen if this is a new ransomware, or one that cannot be currently identified automatically.

You may post a new topic in the Ransomware Tech Support and Help forums on BleepingComputer for further assistance and analysis.

Please reference this case SHA1: b80313b5e840eab8f783c22fd8b1c7d6d56ac6ba

That's a standard reply for new ransomware or one not currently identified. The point of the submission for now was to get samples into the system so Demonslay335 can manually inspect the files and compare with further submissions.

I sent the files 'original and encrypted files.zip' to an antivirus company DrWeb for analysis. And I want to find out more precisely why they consider the file harmless, although the files are encrypted. I'll let you know their answer.

Edited by Amigo-A, 10 September 2023 - 12:33 PM.

m0rpheus90

Do you have access to the infected PC?

Several manipulations need to be done.

yes

OK. Wait a while. 

Instructions sent to PM