Home Malware Programs Ransomware crab7765@gmx.de' Ransomware

crab7765@gmx.de' Ransomware

Posted: October 9, 2018

The 'crab7765@gmx.de' Ransomware is a slightly modified version of the infamous Scarab Ransomware project. Unfortunately, this variant also is impossible to decrypt for free just like the original, and this means that its victims may need to look into alternative file recovery techniques, which are not always guaranteed to work successfully. It is likely that the payload of the 'crab7765@gmx.de' Ransomware is being distributed via fraudulent e-mail messages and attacks on vulnerable or unprotected remote desktop software – make sure to stay away from dodgy emails, as well as keep your favorite remote desktop software updated and protected by a strong password.

A Hefty Ransom Payment may Buy You a Decryptor

Failing to stop the 'crab7765@gmx.de' Ransomware is guaranteed to result in the immediate encryption of documents, images, spreadsheets, archives, videos and other common file formats. Whenever the 'crab7765@gmx.de' Ransomware takes a file hostage, it will add either the '[crab7765@gmx.de].crab' or .qweuirtksd’ extension to its names. The ransom note is found in either ‘!!!ReadMeToDecrypt.txt’ or ‘HOW TO RECOVER ENCRYPTED FILES.txt,’ and it is usually dropped on the desktop when the final stage of the attack comes to an end. Naturally, the ransom messages contain the demands of the attackers, which are not surprising – the criminals behind the 'crab7765@gmx.de' Ransomware demand to receive payment via cryptocurrency in exchange for a working decryptor that can unlock the encrypted files. The e-mails to contact the attackers are 'crab7765@protonmail.com,' 'crab7765@gmx.de' and 'kathi.bell.1997@outlook.com.’

Trusting the promises of the 'crab7765@gmx.de' Ransomware’s authors is a bad idea because they are anonymous hackers who will not hesitate to trick you out of your money. Even if you fulfill their demands, they might end up ceasing all communication with you, and you will be left with no money and no decryptor.

’Attention, all your files are encrypted with the AES cbc-128 algorithm!

It's not a virus like WannaCry and others, I hacked your computer,
The encryption key and bitcoin wallet are unique to your computer,
so you are guaranteed to be able to return your files.

But before you pay, you can make sure that I can really decrypt any of your files.

To do this, send me several encrypted files to kathi.bell.1997@outlook.com, a maximum of 5 megabytes each, I will decrypt them
and I will send you back. No more than 5 files. Do not forget to send in the letter bitcoin address 1Ne5yGtfycobLgXZn5WSN5jmGbVRyTUf48 from this file.

After that, pay the decryption in the amount of 500$ to the bitcoin address: 1Ne5yGtfycobLgXZn5WSN5jmGbVRyTUf48
After payment, send me a letter to kathi.bell.1997@outlook.com with payment notification.
Once payment is confirmed, I will send you a decryption program.

You can pay bitcoins online in many ways:
https://buy.blockexplorer.com/ - payment by bank card
https://www.buybitcoinworldwide.com/
https://localbitcoins.net

About Bitcoins:
https://en.wikipedia.org/wiki/Bitcoin

If you have any questions, write to me at kathi.bell.1997@outlook.com

As a bonus, I will tell you how hacked your computer is and how to protect it in the future.’

The recommended course of action to undertake when attacked by the 'crab7765@gmx.de' Ransomware is to use a trustworthy anti-virus scanner to get rid of the corrupted files responsible for the encryption of your files. When this is done, you should try using 3rd-party file recovery software, which might help undo some of the damage that the 'crab7765@gmx.de' Ransomware did to your data.

Loading...