jm.lora

recover crab encrypted files

Recommended Posts

I recommend uploading a copy of the ransom note along with an encrypted file to ID Ransomware so that you can verify which ransomware you are dealing with:
https://id-ransomware.malwarehunterteam.com/

You can paste a link to the results into a reply if you would like for me to review them.

Share this post


Link to post
Share on other sites

My PC got infected yesterday with a ransomware and it has encrypted my files with a .CRAB extension. The text has GANDCRAB V3 written at starting.

Please help me to decrypt my files.

Here is an encrypted file and the note along with it.

Android Image Kitchen.zip.CRAB


 

---= GANDCRAB V3 =---

Attention! 

All your files documents, photos, databases and other important files are encrypted and have the extension: .CRAB 

The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files. 

The server with your key is in a closed network TOR. You can get there by the following ways: 

0. Download Tor browser - https://www.torproject.org/

1. Install Tor browser 

2. Open Tor Browser 

3. Open link in TOR browser: http://gandcrab2pie73et.onion/b3fcdd2cb6106c52                        

4. Follow the instructions on this page 

On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. 



 

It has some more text written giving an alternative way to contact by Jabber Meassanger and has a username written asking to create a new account on a website and then to follow instruction bot.

 

 

 

 

 

 

Edited by GT500
Put ransom note in CODE block so that links aren't clickable.

Share this post


Link to post
Share on other sites
49 minutes ago, Divyansh said:

Please help me to decrypt my files.

What does ID Randomware say about the ransomware?

 

On 5/29/2018 at 6:43 PM, GT500 said:

I recommend uploading a copy of the ransom note along with an encrypted file to ID Ransomware so that you can verify which ransomware you are dealing with:
https://id-ransomware.malwarehunterteam.com/

You can paste a link to the results into a reply if you would like for me to review them.

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.