Jump to content

all my files are encrypted with .omfl virus....


Recommended Posts

Hi. Check my result:

 

Result:
We have identified "STOP (Djvu)". This ransomware may be decryptable under certain circumstances.
Please refer to the appropriate guide for more information.

Identified by:

ransomnote_email: [email protected]
sample_extension: .omfl
sample_bytes: [0x1FA1 - 0x1FC7] 0x7B33364136393842392D443637432D344530372D424538322D3045433542313442344446357D
Click here for more information about STOP (Djvu).
Case number: 726d8b53b044eb07e9af232ab5373643a40bca9e1611006311

 

Removed ransomware virus on my computer. But i'm not sure. And not format yet.

Emsisoft stop/djvu decryptor tool doesn't decrpyt my files. How can i solve this problem?

Thanks.

 

My system: Win7 x64 with SSD (Intel system)

_readme.txt

Link to post
Share on other sites

This is a newer variant of STOP/Djvu. Fortunately your ID is an offline ID, however we don't yet have the private key for it. I recommend running the decrypter once every week or two so that you can see when we've been able to add the private key for your variant.

There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

  • Sad 1
Link to post
Share on other sites
  • 2 weeks later...
12 hours ago, stop said:

Why Emsisoft Decryptor Tool not updating? Still at 1.0.0.5.

It doesn't need to be updated.

 

12 hours ago, stop said:

This virus(.omfl) why not infected in some files(steam etc.)? Isn't 154kb and over ?

The ransomware will only encrypt certain types of files.

Link to post
Share on other sites
13 hours ago, GT500 said:

It doesn't need to be updated.

Why? Sorry, i don't understand what you mean.

Look at this man:

 

On 1/19/2021 at 9:24 AM, GT500 said:

This is a newer variant of STOP/Djvu. Fortunately your ID is an offline ID, however we don't yet have the private key for it. I recommend running the decrypter once every week or two so that you can see when we've been able to add the private key for your variant.

There is more information at the following link:
https://support.emsisoft.com/topic/32045-about-the-stopdjvu-decrypter/

"This is a newer variant of STOP/Djvu..." and "however we don't yet have the private key" you said.

If it's the new variant, why not update it to fix the new variant virus?

 

This is the _readme.txt file content:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-egvXx8HqOt
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.


To get this software you need write on our e-mail:
[email protected]

Reserve e-mail address to contact us:
[email protected]

Your personal ID:
0272omflAsdhkioO7OVYUyivYvPEI6nuQIcKXNx74ml0mkowpmDzt1

Link to post
Share on other sites
9 hours ago, stop said:

If it's the new variant, why not update it to fix the new variant virus?

Because the decrypter already supports it. The reason it can't decrypt files encrypted by this newer variant is due to the fact that we don't have the private key for it's offline ID. We have to wait for a victim with an offline ID who paid the ransom to donate their private key to us.

  • Like 1
  • Upvote 1
Link to post
Share on other sites
9 hours ago, stop said:

URL the virus came to me: ******************* (Please don't click this URL)

Please don't post malicious links on our forums.

If you would like for us to analyze a file, or a malicious URL (aka. link), then run it through VirusTotal and post the link to the analysis here for us to review. We can download files from VirusTotal, so anything you upload there we have access to.

  • Thanks 1
Link to post
Share on other sites
  • 2 months later...
On 1/30/2021 at 8:28 AM, GT500 said:

Because the decrypter already supports it. The reason it can't decrypt files encrypted by this newer variant is due to the fact that we don't have the private key for it's offline ID. We have to wait for a victim with an offline ID who paid the ransom to donate their private key to us.

I have the same problem too:(( Well this is the victim you're talking about so are you researching this? And when he informs you how will you inform us? Thanks

Link to post
Share on other sites
12 hours ago, Lara_H said:

I have the same problem too:(( Well this is the victim you're talking about so are you researching this? And when he informs you how will you inform us? Thanks

This ransomware hasn't changed much since it was first analyzed over 2 years ago. The only major change was when they switched to using RSA keys, which is what makes the ransomware non-decryptable. Right now there's no way to decrypt files that have been encrypted by the STOP/Djvu ransomware without having the private key for the ID embedded in the encrypted files.

  • Like 1
Link to post
Share on other sites
12 hours ago, GT500 said:

This ransomware hasn't changed much since it was first analyzed over 2 years ago. The only major change was when they switched to using RSA keys, which is what makes the ransomware non-decryptable. Right now there's no way to decrypt files that have been encrypted by the STOP/Djvu ransomware without having the private key for the ID embedded in the encrypted files.

Now there's no way but maybe in the future isn't it:(  So please let me know then, ok? Thank you very much for your reply..

Link to post
Share on other sites
11 hours ago, Lara_H said:

Now there's no way but maybe in the future isn't it:(  So please let me know then, ok? Thank you very much for your reply..

If law enforcement is able to catch the criminals or otherwise gain access to their servers and release their private keys for use in decrypters, then we can add them to our database so that everyone can get their files back.

Our recommendation is to save a backup of your encrypted files and keep it in a safe place in case decryption is possible at some point in the future.

We also recommend keeping an eye on BleepingComputer's newsfeed, as they will usually report on new developments with ransomware decrypters:
https://www.bleepingcomputer.com/

If you have an RSS feed reader, then they also have an RSS feed so that you don't have to manually check for news:
https://www.bleepingcomputer.com/feed/

  • Like 1
Link to post
Share on other sites
12 hours ago, GT500 said:

If law enforcement is able to catch the criminals or otherwise gain access to their servers and release their private keys for use in decrypters, then we can add them to our database so that everyone can get their files back.

Our recommendation is to save a backup of your encrypted files and keep it in a safe place in case decryption is possible at some point in the future.

We also recommend keeping an eye on BleepingComputer's newsfeed, as they will usually report on new developments with ransomware decrypters:
https://www.bleepingcomputer.com/

If you have an RSS feed reader, then they also have an RSS feed so that you don't have to manually check for news:
https://www.bleepingcomputer.com/feed/

Thank you very much for your reply, again.. I have already backed up my encrypted files. I'm just waiting for the time.. Will the site www.bleepingcomputer.com you say will publish the solution about OMFL decryptor? Ok, i will follow.. Thanks again:)

Link to post
Share on other sites
11 hours ago, Lara_H said:

Will the site www.bleepingcomputer.com you say will publish the solution about OMFL decryptor?

They'll usually publish a news article when a new decrypter is released, or when there's major news about an older decrypter being updated to decrypt more victims' files. They also have a help and support topic on their forums for STOP/Djvu, which you can monitor if you'd like:
https://www.bleepingcomputer.com/forums/t/671473/stop-ransomware-stop-puma-djvu-promo-drume-help-support-topic/

Link to post
Share on other sites

By the way, i will ask something:
When i enter this site: https://decrypter.emsisoft.com/submit/stopdjvu and when i click browse take in "Encrypted file" OK. but second part it wants "Original file" so which file is? (If the original file does not exist anyway, i could open that file anyway)..

Is the "Original file" is it Randome Note i take in but doesn't accept so announcing ""Invalid file pair; each file must be
larger than 150KB"" so what does this mean or what file is this file if not?

 

xx.JPG

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   1 member

×
×
  • Create New...