Jump to content

Please help with decrypting .t1000 files


NMZ
 Share

Recommended Posts

Can someone please point me to the right tool to decrypt the .t1000 extension files? All my files in C:\ and E:\ drives were encrypted and .t1000 extensions were added to those files. The ransomware left a file called CRYPTiNFO in each drive with information on how to pay using bitcoin. Below is the snippet of the file. Please help!

################################################################################# 
############## You became victim of the .T1000 Ransomware-Virus C&C ############# 
################################################################################# 
The harddisks of your computer have been encrypted with an military grade 
encryption algorithm TermCryptS7+RSA4096. There is no way to restore your data without a special 
key. To get RSA private key you have to contact us via the link below, located in the TOR private network

Link to comment
Share on other sites

Hello

This is BigLock Ransomware
This variant has been known since autumn, but a newer one, which also attacked your files, has been known since the beginning of December.
It is still being studied, so there are no public tools for decrypting the files.

You can leave a request to Emsisoft specialists, they will contact you and carry out an investigation of an individual case.

Link to comment
Share on other sites

Hello @NMZ,

Welcome to the Emsisoft Support Forums.

If you are a business or contacting us on behalf of a business, please contact our Ransomware Recovery team using the web form at https://www.emsisoft.com/en/tools/ransomware-recovery/inquire/ Someone from our Ransomware Recovery team will contact you by email.

 

We will follow up with you via email within the next 12-24 hours.

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...