JSWorm Ransomware (.JSWORM, .JURASIK; JSWORM-DECRYPT.txt) Support

my system is showing files with extension .JURASIK

all files changed. ransom note in JURASIK-DECRYPT

what to do.

You can submit (upload) samples of encrypted files, ransom notes and any contact email addresses or hyperlinks provided by the cyber-criminals to ID Ransomware (IDR) for assistance with identification and confirmation of the infection. This is a service that helps identify what ransomware may have encrypted your files, whether it is decryptable and then attempts to direct you to an appropriate support topic where you can seek further assistance. ID Ransomware can identify ransomwares which adds a prefix instead of an extension and more accurately identifies ransomwares by filemarkers if applicable. Uploading both encrypted files and ransom notes together along with any contact email addresses or hyperlinks provided by the criminals provides a more positive match with identification and helps to avoid false detections.

It's JSWorm 2.0, I updated the decrypter for this variant yesterday.

https://emsisoft.com/decrypter/jsworm-20

int80

Attach to your new post an original ransom note or upload to the service www.sendspace.com and give us a download link.

More about JSWORM Ransomware by Amigo-A (Andrew Ivanov).
 

Hello, this version of decryptor JSWorm 2.0, can't decrypt my files

@snoop

Can you provide an encrypted file and its original? Also, if you have the malware executable, that would be the most useful thing.

@Demonslay335

Thanks for answering!

Here I have some originals and encrypted. Unfortunately I don't have infected executables as source computer which was infected already formatted.

https://www.sendspace.com/file/5083lu

I'm not sure I'll be able to do anything further without the malware itself.

On another note though, I'm concerned they may have broken something and are corrupting the data. All of the encrypted files you sent me are basically the exact same file, just more zeros at the end based on the filesize.