勒索恢复 – 第4页

.Globeimposter-Beta666qqz扩展名数据库加密恢复

又接一医院客户请求,多套win系统被勒索病毒加密,其中有几套是oracle数据库,请求我们进行分析,确认是否可以恢复.
HOW TO BACK YOUR FILES.txt文件信息

                   YOUR FILES ARE ENCRYPTED !!!

TO DECRYPT, FOLLOW THE INSTRUCTIONS:

To recover data you need decrypt tool.

To get the decrypt tool you should:

1.In the letter include your personal ID! Send me this ID in your first email to me!
2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files!
3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 
4.We can decrypt few files in quality the evidence that we have the decoder.


 DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US:

China.Helper@aol.com

                   ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER:

Tq rx zo f3 B1 Eg S/ m1 SI Yw KS av ip Js /5 oU
uk FL LY Wa pF P1 Dc ss 8l dU cl pE xe Sa Gw oC
Fq /+ rF dz D3 DU Pz S6 6e uB M5 Wx zD 3C DW EC
nk 1I V1 rf zK R4 36 tq 7o bJ rK Rq 81 ib hf lh
+8 Oz rR 4g VM rz FH ST rJ ve 1S K2 PN FL 7I Gg
yp Wq vv 1j V8 Fz vN 0x y9 l2 Ig Ql fD lK MJ +H
Vw WV 80 FY /s OE oG 9V nC TY Ys Zd nQ is T2 Bw
U4 cK yM km OB Ko 8p Yg g/ DA 5N S+ DX e5 /v 0s
A9 Ae B6 Q1 aO Q9 gN 5/ pg HA LS jD 50 1K p6 Jn
T0 g4 MR Gp 3L l4 GM Fv rD Pq gC pp Tf kz 4k vh
ZG rz SB CD 1f lh M5 UA QI mn ky CG es re GI qc
7s 7h aZ /B sR 6V yn /I xC h7 Xc oR 4G uQ ZC DU
Bs Ij AI 1f 0c w0 Y7 Vd xy FI R2 lz L1 8r dK lF
zS SM CK Mb Rm wo EQ ht ht zj 1m R0 NM 0W 0T lA
9A AP vl dA dB XA Fx cH iR ux C8 Hn uv B9 H0 tk
0J Ph Cn VZ S+ 6b NT BT YZ jC Wf ah Ml N5 q6 FS
uZ Tk 5o 0+ Sq 3c lZ 0a SH LR nW jn 1f A2 rg k6
jx qq eD T1 GT 6w cC 6C TP 3j 6Z KV 6D 1N tS Jo
p/ Sl DB J2 yD Q1 u5 Y7 GS E9 /c kh U6 r8 QP wy
jU Fa +Y Um TZ Mo PY gQ /L pj 5d QD EK A8 g2 qY
8Z 1d Np 3M qm Ri Sf Nc IT cN 2O Uj Ou Gw DZ H3
Wb Lo BV mE wZ 4=

被加密文件类似

通过底层分析,只是小部分数据被加密破坏

这个客户相对比较幸运,他们有3月19日的备份,通过结合备份,实现比较好的效果数据恢复
如果此类的数据库文件(oracle,mysql,sql server)等被加密,需要专业恢复技术支持，请联系我们:
电话/微信:17813235971 Q Q:107644445 E-Mail:dba@xifenfei.com

.makop病毒加密数据库恢复

联系：手机/微信(+86 17813235971) QQ(107644445)

标题：.makop病毒加密数据库恢复

最近接到客户几套oracle数据库所在的机器文件被加密,readme-warning.txt内容如下

::: Greetings :::


Little FAQ:
.1. 
Q: Whats Happen?
A: Your files have been encrypted and now have the "makop" extension. The file structure was not damaged, we did everything possible so that this could not happen.

.2. 
Q: How to recover files?
A: If you wish to decrypt your files you will need to pay in bitcoins.

.3. 
Q: What about guarantees?
A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests.
To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.

.4.
Q: How to contact with you?
A: You can write us to our mailbox: Evilminded@privatemail.com

.5.
Q: How will the decryption process proceed after payment?
A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.

.6.
Q: If I don抰 want to pay bad people like you?
A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money.



:::BEWARE:::
DON'T try to change encrypted files by yourself! 
If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files!
Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

通过对数据库文件进行分析,可以恢复

通过恢复工具进行处理,直接open数据库,并导入新库

如果此类的数据库文件(oracle,mysql,sql server)等被加密,需要专业恢复技术支持，请联系我们:
电话/微信:17813235971 Q Q:107644445 E-Mail:dba@xifenfei.com

.eking扩展名数据库恢复

联系：手机/微信(+86 17813235971) QQ(107644445)

标题：.eking扩展名数据库恢复

又一个朋友数据库文件被加密

通过底层分析发现损坏较少

通过自研的oracle数据库比特币加密文件恢复工具处理

实现数据库顺利open,并使用expdp导出数据

如果此类的数据库文件(oracle,mysql,sql server)等被加密,需要专业恢复技术支持，请联系我们:
电话/微信:17813235971 Q Q:107644445 E-Mail:dba@xifenfei.com

[star-new@email.tg].Devos加密数据库恢复

联系：手机/微信(+86 17813235971) QQ(107644445)

标题：[star-new@email.tg].Devos加密数据库恢复

有客户咨询win服务器数据库被文件系统加密病毒加密,有oracle数据库文件也被加密,请求我们给予恢复支持,加密结果如下：

显示勒索信息

我们通过专业工具分析,确认每个文件破坏192个block(分多段破坏),整体数据都还存在

通过自研工具对其数据文件进行恢复

然后通过技术手段,顺利open数据库,确认含xml字段表正常

导入数据到新库,完成本次数据库恢复工作,实现数据最大程度恢复,而且客户那边直接可以使用,有此类勒索病毒加密的数据库(sql,mysql,oracle)我们可以提供数据库级别恢复服务

.IQ0003后缀名勒索恢复

联系：手机/微信(+86 17813235971) QQ(107644445)

标题：.IQ0003后缀名勒索恢复

接到客户请求,数据库文件被加密成扩展名为:.IQ0003

对应的HOW_TO_RECOVERY_FILES.txt文件内容为:

It's your IDENTIFER:
2EF9BE910E1AEBFF7FBD25107D5A10AAE4339771AD674E1A1F0046028B621009
FAA9B630BA4BB061874575AC0E0D42E2FCE86925E163A4005F43175D667E3846
47841028CC302707874E00127D3BC85E9FCE8AD523CD6B68CF3DCFB3FF6875EB
732842733231AA908EC047A68F658D14D4C3DE2C7C4E78846335367544DCC10F
FD770BD8F1D29868067FE46DB43480CCEABCE012D9F1D4C1904AC8C86779DF4D
E28E2EB268835AD5845FAE6EA1C679838E2FAC8F705FFDCBA891147F997F171B
6760E46E68CFBE9E511416CCBBBA46B57A20AEE1BEE1B15DF03178BD7B0A40B8
3D12424209E78ED267CAF1C6C594C8B5EF95FC239C532FEE75A4E430C642AB50
B942EA04068A2FDF6D6B67BB5C5697B0B5678449D1FB7A2464E0F2C307577E97
E1D21799C64BF9762187930BE2D10F4408DD4258255313E880724FC07A173EFE
E17E75E542AA1BB83C9500DE6829EC00BF90578A2D781740D1C173BCF0BF656F
51260E94D2398FE5ADD316C52D82F63A0B7FA00F9812911E32C412AC788D4AE1
9DBEE9EA9B398C0307F4C3326E07712162DCC0EF7EA7CCEB77246F718721EE89
837F4E36BB987094507E3FF5E7C1ABECBA764BDAE1B4BCF337B09413CABE5621
875E72CF70A1B70F48185A121E75E44B29CF0E211E76BC3CE41E9097200B2D97
E62ABF49B37832003D78DC3DD482DE62FDA4EEBA445AF323846C530A29FEC09D
7E63543CF2ED96AD0A076AB578C6450B2EFF5D4663B9F9C546B40605ED801218
CBB2B3B641120216F2E94EE6A4B04E115341897323E160316A9BE35FF6B75D4A
9487EF923E0575DB34A85241888FB507A25BA1FE26ACEB81579796F8B5BEE818
C3D3548EACF82D80B002ACFA5C7B0B08042B5DDDE764473628057D97EC3584A3
DFC33147A973EC7FD81051F0AA741E2C79BDC7EC28B0774A00A4E74A3F1AFB76
B6DFDDB6B956896094267F52BC661806159757A0485157A5E61D9AF45532CED9
21D99EA1DBB27C15DE8547E7A9E06A7B2708251740246DA07BD9E33F513F2165
D935C7B7597B347C41CDBCF6275E2365639C10BB9A0C84F178B258B8BCC33F86
C46A5E431267C27141BA27A53BBBB57000B230D35CE1889E3E790A8072BE8E93
9F721DFBD6D26C000B

HELLO

All YOU FILES ENCRYPTED

If you need recover your files:
1)send message with your personal IDENTIFER to helpyouhelpyou@cock.li and add 1 infected files from your server!
2)speak only by ENGLISH!
3)doesn't use free decryption tools, you can damage your files!

ONLY helpyouhelpyou@cock.li can HELP YOU!
helpyouhelpyou@cock.li
helpyouhelpyou@cock.li
helpyouhelpyou@cock.li

通过对数据块检查分析确认绝大部分block都是好的

通过底层技术处理,实现绝大部分数据恢复

如果此类的数据库文件(oracle,mysql,sql server)等被加密,需要专业恢复技术支持，请联系我们:
电话/微信:17813235971 Q Q:107644445 E-Mail:dba@xifenfei.com

.Globeimposter-Alpha666qqz加密恢复

联系：手机/微信(+86 17813235971) QQ(107644445)

标题：.Globeimposter-Alpha666qqz加密恢复

接到一个文件系统被勒索病毒加密的sql server数据库恢复请求

通过分析该文件

其中大部分block都是好的,通过sql server底层处理实现绝大部分数据恢复

如果此类的数据库文件(oracle,mysql,sql server)等被加密,需要专业恢复技术支持，请联系我们:
电话/微信:17813235971 Q Q:107644445 E-Mail:dba@xifenfei.com

.sql文件被加密恢复

联系：手机/微信(+86 17813235971) QQ(107644445)

标题：.sql文件被加密恢复

接到客户请求,有win系统文件被加密勒索,其中有一个mysql的.sql备份最为重要,咨询我们是否可以恢复.通过底层技术分析,确认该文件绝大部分数据可以恢复.

通过winhex分析,发现该文件主要对部分数据进行了加密

通过底层技术处理,可以实现绝大部分数据恢复

如果此类的Sql文件被加密,需要专业恢复技术支持，请联系我们:
电话/微信:17813235971 Q Q:107644445 E-Mail:dba@xifenfei.com

Alpha865qqz.id 加密数据库恢复

联系：手机/微信(+86 17813235971) QQ(107644445)

标题：Alpha865qqz.id 加密数据库恢复

接到一网友新的加密勒索文件恢复请求,加密文件类似:

对应的!!! HOW TO BACK YOUR FILES !!!.TXT文件说明

                   YOUR FILES ARE ENCRYPTED !!!

TO DECRYPT, FOLLOW THE INSTRUCTIONS:

To recover data you need decrypt tool.

To get the decrypt tool you should:

1.In the letter include your personal ID! Send me this ID in your first email to me!
2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files!
3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 
4.We can decrypt few files in quality the evidence that we have the decoder.


 DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU!CONTACT US:

China.Helper@aol.com

                   ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER:

Your personal ID: 5CF-DFF-C78

Attention!
 * Do not rename encrypted files.
 * Do not try to decrypt your data using third party software, it may cause permanent data loss.
 * Decryption of your files with the help of third parties may cause increased price (they add their fee to our)
 or you can become a victim of a scam.

通过winhex分析文件损坏情况,确认绝大部分数据是ok的