Jump to content

Recommended Posts

9 hours ago, GT500 said:

I recommend uploading a copy of the ransom note along with an encrypted file to ID Ransomware so that you can verify which ransomware you are dealing with:

You can paste a link to the results into a reply if you would like for me to review them.

1 Result


 This ransomware has no known way of decrypting data at this time.

It is recommended to backup your encrypted files, and hope for a solution in the future.

Identified by

  • ransomnote_filename: HOWTODECRYPTFILES.html
  • ransomnote_email: [email protected]
  • sample_bytes: [0x4CFFE - 0x4D021] 0x0000000000000000000000000000000000000000000000000000000000000071ABDBCD


Click here for more information about Cry36


 Would you like to be notified if there is any development regarding this ransomware? Click here.


Bro Please Decrypt solution and Decrypt Tool Name

Thank you For Your Response

Link to post
Share on other sites

Cry36 detection is fairly accurate when the sample bytes match, so this is almost certainly a variant of Cry36. ID Ransomare is correct that there is no known way to decrypt files that have been encrypted by this ransomware. It generates new public and private keys for every computer it infects, encrypts the files with the public key, and the only way to decrypt them is with the private key (which is kept safely on the servers of the criminals who made/distributed the ransomware). This means that a decryption tool made by these criminals will only work for a single computer, because the private key used for decryption is only for the files on that one computer, so even if another victim were to pay the ransom and share the decryption tool they were given there would be no way that tool could help anyone else.

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    No registered users viewing this page.

  • Create New...