SensorsTechForum - How to Technology and PC Security Forum

PC Security and Protection => Malware Removal Questions and Guides => Topic started by: Gheto on March 31, 2019, 10:20:38 am

Title: .Horse4444 ransomware
Post by: Gheto on March 31, 2019, 10:20:38 am
Does anyone know about this ransomware...? it's said the family of .ox4444 and the other (globeimposter) but i can't find any decryptor for my file up until now... i give up... any help?

this is the ransomware massage :
HOW_TO_BACK_FILES.TXT

YOUR FILES ARE ENCRYPTED !!!

TO DECRYPT, FOLLOW THE INSTRUCTIONS:

To recover data you need decrypt tool.

To get the decrypt tool you should:

1.In the letter include your personal ID! Send me this ID in your first email to me!
2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files!
3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool!
4.We can decrypt few files in quality the evidence that we have the decoder.


DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US:

China.helper@aol.com
China.helper@india.com

ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER:

   my number id (can't be copied)
Title: Re: .Horse4444 ransomware
Post by: Execute on April 04, 2019, 04:10:23 pm
@Gheto

Hello, apologies for the late reply.
Horse4444 is indeed another version of .ox4444 (GlobeImposter) ransomware.
The ransom note is absolutely the same, including the emails, too.

Unfortunately there is still no decryption tool for both of them as far as we know.

Did you try the older GlobeImposter Decryptor developed by EMSIsoft?
You can download it from the GlobeImposter Decryptor (https://decrypter.emsisoft.com/download/globeimposter) link here or from the official EMSIsoft website.

It was made for a previous version and the prerequisites needed (taken from the EMSIsoft site):

"The decrypter requires access to a file pair consisting of one encrypted file and the original, unencrypted version of the encrypted file to reconstruct the encryption keys needed to decrypt the rest of your data."

Would you mind sharing how did you get your system infected?

And also good luck with the decryptor, although it is very old and I kind of doubt that it will work. It even might mess with your files, so do a backup (if you already haven't) just in case.

Do backups from now on - they are the most reliable thing for recovery from ransomware attacks.

Kind Regards,
Execute
Title: Re: .Horse4444 ransomware
Post by: floater on April 04, 2019, 08:41:14 pm
Seems like you'll have to install fresh windows