Repair file

[sempre]

Helo!!

Please help!

Repair one file is [buydecrypt@qq.com].bip

??

[colanco]

Unfortunately, the encryption of the new variants of Dharma ransomware ([buydecrypt@qq.com].bip) is currently completely secure and can only be decrypted using the RSA private keys of the criminals.

[sempre]

Ok thanks reply!

I am view file in editor hexa.

[sempre]

Ok thanks reply!

I am view file in editor hexa.

[H13]

Hi, if your files are important and your client will pay for the Data we can help

regards

[hdd_sand]

Hi, if your files are important and your client will pay for the Data we can help

regards

Just wondering how? Do you have a solution for this variant?

[pcimage]

Hi, if your files are important and your client will pay for the Data we can help

regards

Just wondering how? Do you have a solution for this variant?

Contact the crooks and pay the ransom

[H13]

Hi, if your files are important and your client will pay for the Data we can help

regards

Just wondering how? Do you have a solution for this variant?

Contact the crooks and pay the ransom

Do you think they are pay the ransom ?
http://www.rm-ransomwarerecovery.com/

[H13]

Hi, if your files are important and your client will pay for the Data we can help

regards

Just wondering how? Do you have a solution for this variant?

3200$ if the client need the Data

i just resale the the service

Regards

[sempre]

Hi!

Thanks reply!

They pay for the hackers! Only that!

[pcimage]

Hi, if your files are important and your client will pay for the Data we can help

regards

Just wondering how? Do you have a solution for this variant?

Contact the crooks and pay the ransom

Do you think they are pay the ransom ?
http://www.rm-ransomwarerecovery.com/

From what I’ve been told by clients, yes I think they do.

I have no evidence to the contrary.

[northwind]

It looks like the developers of Dharma have been active in comms with lots of people offering discounts to resellers.

We have been REing Ransomware strains since their very beginning and we have decrypted hundreds of cases, sometimes with homebrewed tools. And we've been contacted 3 times already by different people, offering us solution for Dharma, for a fee little smaller than the crooks' ransom.
Of course we have reported them to the police.

Listen, Dharma always has been a very well coded and very sophisticated strain.
IT HAS NO WEAKNESSES.
If someone is offering decryption services for Dharma, he's either in contact with the crooks and has a discounted flat price (and pockets the difference), or he is the developer himself and has the master key.
Period.

[pcimage]

It looks like the developers of Dharma have been active in comms with lots of people offering discounts to resellers.

We have been REing Ransomware strains since their very beginning and we have decrypted hundreds of cases, sometimes with homebrewed tools. And we've been contacted 3 times already by different people, offering us solution for Dharma, for a fee little smaller than the crooks' ransom.
Of course we have reported them to the police.

Listen, Dharma always has been a very well coded and very sophisticated strain.
IT HAS NO WEAKNESSES.
If someone is offering decryption services for Dharma, he's either in contact with the crooks and has a discounted flat price (and pockets the difference), or he is the developer himself and has the master key.
Period.

Now, that does make perfect sense. Explains a lot!

[colanco]

If someone is offering decryption services for Dharma, he's either in contact with the crooks and has a discounted flat price (and pockets the difference), or he is the developer himself and has the master key.
Period.

+1

[northwind]

As a matter of fact...
This is #4.

Attachments

[northwind]

and it gets better.

Attachments

[northwind]

...and better...

Attachments

[pcimage]

As a matter of fact...
This is #4.

I got this email too!

[zebong]

Guys, what you think

Code:

Good day,

i have a recovery solution for New Dharma Ransomware (arrow, java, cesar, arena, bip, combo or cmb extensions), if you have any case please send me 3-4 sample files to analysis, thanks in advance.


send 4 files and he decripit it, payment is in " x.xxx USD "

THe conversion was like this:

ME -> how this works ?


are you asking decryption procedure ?


ME -> yes payment and procedures ?


payment in advance

afterthat i will need to connect your infected computer two times, firstly to run a tool (scan and decryptor software) to collect public keys which are required to create your private key that can decrypt all your files (VERY IMPORTANT: DURING SCAN FOR PUBLIC KEYS ALL ENCRYPTED FILES CAN BE IN THAT COMPUTER, OTHERWISE WE MAY NOT ABLE TO DECRYPT ALL YOUR FILES !!!), few hours later from this action i will connect your computer again to perform fully decryption with Private Key, decyption can take few hours depending on total size of your encrypted files.



ME -> why do you need the key if you have decrypted the samples ?


public keys are required for complete and healthy decryption



ME -> how could you decrypt the samples ?



pls do not ask me more quesitons
i m very busy
if you need my service
just let me know