.NBES extension ransomware

[Rohith 0]

Hi yesterday my laptop and external hard disk got infected my .nbes extension ransomware. All my backed up data in external drive has been encrypted. Could anyone please let me know what can be done and how to decrypt all my files and folders in my external hard disk drive ? please help.

[Amigo-A 64]

This is new variant of STOP Ransomware

Check your personal ID on the ransom note.

The signs "t1" at the end of the ID can indicate that in the future the files can be decrypted if the developers receive a decryption key. Today, this is the newest variant, and no one has yet announced that they bought the key from extortionists to pass it to the developers, so that they complement its in decryptor.

[Rohith 0]

On 12/17/2019 at 2:47 AM, Amigo-A said:

This is new variant of STOP Ransomware

Check your personal ID on the ransom note.

The signs "t1" at the end of the ID can indicate that in the future the files can be decrypted if the developers receive a decryption key. Today, this is the newest variant, and no one has yet announced that they bought the key from extortionists to pass it to the developers, so that they complement its in decryptor.

Hi Amigo

Any update on the decrypt tool ? Extension .nbes supported by the decrypt tool ?

[GT500 660]

3 hours ago, Rohith said:

Any update on the decrypt tool ? Extension .nbes supported by the decrypt tool ?

The decryption tool does not need to be updated to support new extensions.

[Rohith 0]

2 minutes ago, GT500 said:

The decryption tool does not need to be updated to support new extensions.

.nbes now supported by the tool ? 

[GT500 660]

1 minute ago, Rohith said:

.nbes now supported by the tool ? 

It always was. Nothing about the encryption format changes from extension to extension with STOP/Djvu, so the decrypter doesn't need updated.

The issue is the type of encrypting they've been using for the past few months is secure, meaning we can't break it. Without private keys, decryption is impossible.

[Rohith 0]

3 minutes ago, GT500 said:

It always was. Nothing about the encryption format changes from extension to extension with STOP/Djvu, so the decrypter doesn't need updated.

The issue is the type of encrypting they've been using for the past few months is secure, meaning we can't break it. Without private keys, decryption is impossible.

i hope the decrytor tool soon supports .nbes extension files encrypted with offline keys ending with "t1"

waiting for it..

[GT500 660]

Just now, Rohith said:

i hope the decrytor tool soon supports .nbes extension files encrypted with offline keys ending with "t1"

waiting for it..

I recommend running the tool once every week or two. We just need to find the private key for offline ID's for .nbes and add it to our database, and then the decrypter will be able to use it, so once that happens it will be able to decrypt your files.

[Rohith 0]

5 minutes ago, GT500 said:

I recommend running the tool once every week or two. We just need to find the private key for offline ID's for .nbes and add it to our database, and then the decrypter will be able to use it, so once that happens it will be able to decrypt your files.

Alright... Noted.

[Rohith 0]

any update on .nbes extension files decryption ?

[GT500 660]

5 hours ago, Rohith said:

any update on .nbes extension files decryption ?

No, newer variants with online ID's will remain undecryptable until the private keys kept by the criminals are made public.

[Rohith 0]

On 1/22/2020 at 4:13 PM, GT500 said:

No, newer variants with online ID's will remain undecryptable until the private keys kept by the criminals are made public.

my id is offline id.. it ends with "t1"

[Kevin Zoll 306]

@Rohith It's the same answer for offline IDs.  Until such time that we get a encryption key matching the offline ID for your files they will remain undecryptable.

[GT500 660]

On 1/31/2020 at 11:14 PM, Rohith said:

my id is offline id.. it ends with "t1"

The private key for the offline ID from .nbes has been added to our database, so if your files really do have an offline ID then the decrypter should be able to decrypt your files.

[Rohith 0]

21 minutes ago, GT500 said:

The private key for the offline ID from .nbes has been added to our database, so if your files really do have an offline ID then the decrypter should be able to decrypt your files.

Hi support team.. I was able to decrypt all my files almost 600 GB using the tool. I have successfully decrypted my external hard disk drive day before yesterday. Thank you so much for adding the private key for the offline ID for .nbes extension files.

[GT500 660]

22 hours ago, Rohith said:

Hi support team.. I was able to decrypt all my files almost 600 GB using the tool. I have successfully decrypted my external hard disk drive day before yesterday. Thank you so much for adding the private key for the offline ID for .nbes extension files.

That's great to hear. Thanks for letting us know.