Demonslay335

No, he simply has "File name extensions" hidden in Explorer (it is highly recommended to change that...). You can see the "Type" shows as "DRUME File". As for the 404 error, it's an anomaly based on the files that were listed there. When the decryptor sees the STOP Djvu filemarker ("{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}") in a file, it takes the extension and asks the server "hey, is this Old or New Djvu?" (if it hasn't already asked for that extension). Apparently, those files had the filemarker, but no appended extension. There seems to be a security thing with the server engine that instantly rejects image extensions such as ".gif" for that parameter instead of letting my code handle it. I'll look into it, but it may be out of my control for the time being. Either way, it doesn't affect you much since those files were just in your Recycle Bin. As the decryptor told you for your .drume files, it is Old Djvu, and you need to follow the instructions for uploading file pairs as Amigo-A said. You specifically need to upload an encrypted/original file pair for either a DOCX/XLSX/PPTX, or ZIP file, as those all start with the same first 5 bytes (which is why it is telling you what they are). Edit: the 404 error has been fixed.

It's actually GlobeImposter 2.0 (identification on ID Ransomware has been fixed). Same outcome though, only the criminals have the private key(s) to decrypt your files.

@jaffar Thank you, I was able to confirm the key works for your files with that ID. I have added it to the server for the .rote extension. You may simply re-run the decryptor, and it should be able to decrypt some of your files now.

The FAQ already explains this...

No. Dharma is not decryptable without the private RSA key only the criminals possess. Restore from backups and stop exposing RDP to the web.

They are the exact same malware, just different names; the only thing that changed was the extension. The reason we are able to decrypt MegaLocker at all is because we acquired keys from the criminal's servers. Period. They then changed servers and locked it down better, and continued attacking victims. We do not have keys for victims encrypted after that date, as only the criminals have those keys. The crypto itself is otherwise secure and cannot be broken any other way without the keys.

As the FAQ and all you've read will already tell you, there is nothing we can do. It is impossible to decrypt, as only the criminals have your private RSA key that is unique to your files. Period. This ransomware is exclusively spread via pirated programs, so...

The encrypted files themselves are not infectious or anything. It's always recommended to archive encrypted files in that case in hopes of something changing in the future; unfortunately with STOP Djvu and the new variants with online keys, your only chance will be if the criminals are caught and their private RSA keys seized by law enforcement.

No. If your files were encrypted by an online key, then only the criminals have your key.

@abdi Read the FAQ... it is impossible to decrypt. Period.

The files that were decrypted would have been encrypted by the offline ID... as explained in the FAQ, the malware sometimes encrypts some files with an online key, and others with an offline key. Those 3 files just got lucky. The decryptor would not show the ID if it decrypted them; only if it could not decrypt the files.

Are you sure the file pair you are providing is good? It has to be the exact same file before and after the encryption. Any modifications between that and when it was encrypted would result in a bad pair. You can zip the files together and post them here if the forum allows (use a third-party sharing site if it doesn't), and I can take a look.