C77L/X77C Ransomware (.[<email>].[random 8]; .[ID-random 8][<email>]) Support

Yes, this is C77L Ransomware.

You will need AES session keys to decrypt your files.

Those files are encrypted with two AES keys

@Olli325
 
I have merged your topic into the primary support topic for victims of this ransomware.

@chzaza

I have merged your topic into the primary support topic for victims of this ransomware.
 
The contents of your ransom note are similar to what we have seen with other variants of this ransomware
 
C77L ransom notes are known to use a Decryption ID which is the same as the [random 8] (volume C serial number) included to the encrypted data file name.

\\\\ Your ID :  {8AA60918}
Your Decryption ID: CE744A63
Your Decryption ID: BAE12624
Your Decryption ID: 80587FD8

Your ransom note includes a Decryption ID like those listed above.

\\\\ Your ID :  {40D5BF0A}

mrdarkness@onionmail.org is on the C77L/X77C Ransomware Attackers Email List 
 
The encryption is secure and the criminal's master private key is needed for decryption. Without the criminal's master private key, decryption is impossible. For now all you can do is backup/save your encrypted data as is and wait for a possible solution at a later time.

You're welcome.
 
When or if a free (or legitimate paid for) decryption solution is found, that information will be provided in this support topic and victims will receive notification,

New variant reported with .3yk extension (#Restore-My-Files.txt)

.[ID-80587FD8][Dm_for_decrypt@protonmail.com].3yk

New variant reported with .BAK extension (#Restore-My-Files.txt)

.109SetupeduBSEntMultanCBk.BAK

Looks like I have been gotten. Not sure how it got in but it did a number on my system.

I think its Proton and the hacker did send back 3 files that they decrypted. Now my system has had all of the exe's changed and I have to totally wipe and bring back up. I have lost some stuff but have a good amount of backup so, I am comfortable with that. If I understand correctly, there is no tool to handle decryption yet?

ransom note contents:

>>> ALL YOUR IMPORTANT FILES ARE STOLEN AND ENCRYPTED <<<

Important:
- We have downloaded your files. Your data will be leaked within the next 72 hours.
- Contact us immediately to prevent data leakage and recover your files.

Your Decryption ID: 9A7BE444

Contact:
- Email-1: Decryptorkrypt@gmail.com
- Email-2: Saveyourdata@tutamail.com

Warning:
- Tampering with files or using third-party tools WILL cause permanent damage.
- Act fast! The price will increase if you delay.

Free Decryption:
- Send 3 small files (max 1MB) for free decryption.
<The test file is your right. And never pay without it because you must first make sure the tool works.>

@tcv212121

You are not dealing with Proton/Shinra.

Your screenshot shows the below extension. 

.[ID-9A7BE444][Decryptorkrypt@gmail.com].nb0

The file format looks like a new variant of C77L/X77C Ransomware most of which will have an .[<email>].[random 8 hex char] or .[ID-random 8 hex char][<email>].[random 3 char] extension appended to the end of the encrypted data filename

.[ID-BAE12624][recovery-data09@protonmail.com].mz4
.[ID-80587FD8][Dm_for_decrypt@protonmail.com].3yk

C77L leave files (ransom notes) named #Recover-Files.txt, #Restore-My-Files.txt, READ-ME.txt, READ-ME-Nullhexxx.txt. The contents of your ransom note are similar to what we have seen with other variants of this ransomware

However, these two emails are on both the C77L/X77C Ransomware Attackers Email List and Proton/Shinra Attackers Email List

- Email-1: Decryptorkrypt@gmail.com
- Email-2: Saveyourdata@tutamail.com

Thank you so very much. Do you know if there is a tool to help get these back?

@tcv212121
I have split away (merged) your posting and related comments into the primary support topic for victims of this ransomware.
 
The encryption is secure and the criminal's master private keys (AES session key) are needed for decryption. Without the criminal's master private key (session key)s, decryption is impossible. That usually means the key is unique (specific) for each victim and generated in a secure way (e.g. RSA, AES, Salsa20, ChaCha20, EDA2, ECDH, ECC, ECIES or combination of encryptions) that cannot be brute-forced...the public key alone that encrypted files is useless for decryption. In your case, the criminal's AES session keys are needed to decrypt files.

For now all you can do is backup/save your encrypted data as is and wait for a possible solution at a later time.

Need Help. ID Ransomware can not identify. All files jn NAS dont open.

C77L ransomware uses this email address

 SHA1: a07f5a1a4af5cd8f9dea5aed7015ab3c378cfff0