Ransomware negotiation(s) with  darkside



Avatar

How to buy Bitcoin for this amount?

9 days ago

Hello!

9 days ago
Avatar

Moment please, let me prepare a manual for you.

9 days ago
Avatar

are you sure that you want to pay in bitcoin? maybe you prefer monero? cause in case you want to pay in bitcoin, you have to pay in 20% more because of service fees.

9 days ago
Avatar
Avatar

how monero works?

9 days ago

process is literally the same

9 days ago
Avatar

give me a moment i provide a monero tutorial

9 days ago
Avatar
Avatar

ok good for monero

9 days ago

monero manual here is the fastest and safest service to buy monero in your country https://localmonero.co/ alternative way is to buy bitcoin via next manual and change it to monero here https://changelly.com/ bitcoin manual here are some services where you can safely buy and send bitcoin https://localcryptos.com/ manual how to buy and send is placed on the main page, this is the simplest and fastest way, no any verification required/////// https://paxful.com/ here is the short manual how to buy and send https://www.youtube.com/watch?v=EjB5qFW0bJ8 profile verification may be required//////// https://www.coinbase.com/ here is the short manual how to buy and send https://www.youtube.com/watch?v=Neph3rjv0Co profile verification may be required/// chose which one you like more, and buy bitcoin. hen text in chat and we provide the wallet for transfer

9 days ago
Avatar
Avatar

ok. I'm working on it

9 days ago
Avatar

ok. I'm working on it

9 days ago
Avatar

Hi. The price is too high

9 days ago
Avatar

could we find a mediation?

9 days ago
Avatar

we do not have that amount of money. We are a little company

9 days ago
Avatar

5.000€?

9 days ago

We do not make such big discounts.

9 days ago
Avatar

Read about us on the Internet.

9 days ago
Avatar

5000 euro is impossible. you are not a small company, we've been working on your network, we have encryped 200tb of data, you can not be a small company, you have a whole data center.

9 days ago
Avatar
Avatar

please give us a sustainable amount we are 80 people that works from [redacted location]

9 days ago
Avatar

[redacted location]

9 days ago
Avatar

we work for non profit organization like [redacted]

9 days ago

before the attack we checked info about your company, so it's absolutely useless to prove us anything. discount is possible, but not in the amount you want. you can try to take a loan and find any cryptobrocker who will resolve all the cryptocurrency exchange.

9 days ago
Avatar
Avatar

10.000€

9 days ago

You are wasting our time. Write when you have serious offers.

9 days ago
Avatar

discount x100 from first amount is impossible. we can reduce the price by 50 000. so you have to pay 950 000 $

9 days ago
Avatar
Avatar

we do not have that amount. Is out of our business

9 days ago

take a loan

9 days ago
Avatar
Avatar

I can make you an offer compatible with my availability and comparable to the time it would take if I had to restore from backups

9 days ago

we know everything about your backups, if you could restore, you wouldn't text us at all. so please stop wasting our time and yours, you know, that the only way to restore your business is to make the payment requested

9 days ago
Avatar

are we talking with recovery company right now? cause few hours ago this conversation had a bit another vector.

9 days ago
Avatar
Avatar

no I move from home to office

9 days ago

go back home, you were much more pliable from there.

9 days ago
Avatar
Avatar

I'm talking to the CEO to unadestand how much can we pay

9 days ago

ok we are waiting

9 days ago
Avatar
Avatar

I talked with my CEO we want to solve the issue. We can offer 75.000€ to start the decryption process and 75.000 at the end of the decryption. (in total 150.000€)

8 days ago

This amount is not enough. Raise the price and we will give you an additional discount. We can refuse payment and not give you a decryptor. Can you afford it? What will you tell your clients? We understand you and are ready to give you a decryptor right now. Give us a good offer.

8 days ago
Avatar

Any phased payment options are not possible. You pay first, then we give you decryptors. If you are not sure, you can give us test files and we will decrypt them for you.

8 days ago
Avatar

In Linux, we specially encrypt log files, they are small in size and you can upload them to chat.

8 days ago
Avatar
Avatar

In you site you declare that you do not attack no.profit organization. We host the site of a lot of no profit organization that currently has the service down. Please accept our offer 150.000 all in one

8 days ago

Look, if you were a non-profit organization, you wouldn't be attacked by anyone. Everyone can say that they are helping someone. In the current case, your offer does not meet our expectations. It will get you nowhere and you are wasting your time. Give us a better price and we will give you a discount.

8 days ago
Avatar

I want you to understand one thing, it doesn't matter to me how long it takes to discuss the price. This is important for you. The faster you get decryptors, the faster you will continue to make money.

8 days ago
Avatar
Avatar

I sent you a small files [redacted].txt.[redacted] 8.95 kB

8 days ago

File [redacted].txt 8.81 kB

8 days ago
Avatar
Avatar

Hi, we had a crisis committee meeting. We evaluated your proposal. I know that you don't want waste time but trust me we are not so big as you think. We need time to get a reasonable amount of MONERO or BITCOIN. We try deliver an extra special effort and we can raise to 250.000€. We hope that this offers meet your expectation

8 days ago
Avatar

i'm moving to home becouse of lock down and we had to go home at 10pm

8 days ago

We are ready to accept 700k dollars. We will give you a discount of $ 300k.

8 days ago
Avatar
Avatar

We want to pay but we do not have 700k. We did the best effort to offer you 250.000

8 days ago
Avatar

here is midnigth, i need to sleep and I hope to found some good news.

8 days ago

Let's get back to this question in the morning! you need to rest, you are right! Goodnight!

8 days ago
Avatar
Avatar

good moring......I hope

8 days ago

We've made you a 30% discount. Give us a better price and we will try to give you an additional discount.

8 days ago
Avatar
Avatar

Trust me. We host site for no-profit organization that do not have a lot of money. You found a lot of data but this are our kind of customer. We made the best 250.000€ is a very high amount for us. We had also a problem to find this amount in a few days. The site that you suggested offer MONERO at block of 5000 or 10.000€

8 days ago
Avatar

We are 60 employee and only 6 on IT....we are working on this problem 24 hours....we need your help

8 days ago

I spoke to my boss and explained your situation to him. He approved a payment of 350k dollars. There will be no more discounts. Now you are offering 300k dollars, raise your price by 50k and we will close this deal now.

8 days ago
Avatar
Avatar

do you have a quick way to get that amount of MONERO?

8 days ago
Avatar

we accept your proposal

8 days ago

Price updated. Reload the page.

8 days ago
Avatar
Avatar

ok. Give us a reference to get that amount of monero

8 days ago

Yes, have you considered buying through the exchange? Or are you having trouble with it?

8 days ago
Avatar

If you find it difficult to get Monero - buy Bitcoin first. Then change it to Monero.

8 days ago
Avatar
Avatar

We want to buy through the exchange. But they exchange at block of 10.000€.

8 days ago

I think it is not difficult to buy bitcoin in your country. Use exchangers or crypto exchanges (binance, et al.).

8 days ago
Avatar
Avatar

ok. I will update you

8 days ago
Avatar

we have to do change € on our wallet or directly charge on your wallet

8 days ago

Change money on your wallet and then send us cryptocurrency

8 days ago
Avatar
Avatar

Hi, just to tell you that we are working to get cryptocurrency

7 days ago

OK, we wait.

7 days ago
Avatar
Avatar

Good moring. Very difficult to move on BTC that amount on one wallet. You need transaction from one wallet alone?

7 days ago
Avatar

can we make in more transcation?

7 days ago
Avatar

could you Decrypt some server?

7 days ago

We are waiting for xmr from you, not btc. If you decided to pay with btc, you have to pay additional 20%.

7 days ago
Avatar

And you can use several transaction

7 days ago
Avatar

After payment you will receive decryptor for all your network.

7 days ago
Avatar
Avatar

several transaction from same wallet or we could use different wallet?

7 days ago

You can use different wallet

7 days ago
Avatar
Avatar

How many BTC we had to pay? Yesterday i saw 25.18, now I see 23.3

6 days ago

Pay the amount that you see now

6 days ago
Avatar

Btc rate is not stable, so don't wait and pay quickly

6 days ago
Avatar
Avatar

do not change anymore because we had a lot o difficult to get crypto BTC

6 days ago

i can fixed the rate, but you have to pay for 6 hours

6 days ago
Avatar

will pay for this time?

6 days ago
Avatar
Avatar

we'll try in 12 hours , but i'm not sure, maybe 24.

6 days ago

i have fixed your btc amount, for the next 24 hours it doesn't depend from btc rate

6 days ago
Avatar

but you must pay as soon as possible

6 days ago
Avatar
Avatar

ok

6 days ago
Avatar

help us as soon as possible. We are very little to pay that amount but we do....and also we had to work a lot of other days....give an hand as soon as you can....trust us

6 days ago

After payment I will immediately give you decryptors.

6 days ago
Avatar
Avatar

Hi. Why the rate changed again?

6 days ago
Avatar

you promise me to block the rate of BTC to 23.3

6 days ago
Avatar

we already had a trade for that amount and we need to fix it

6 days ago
Avatar

Are you there?

6 days ago

Hello

6 days ago
Avatar

Rate was changed yesterday, before i fixed it

6 days ago
Avatar

You actual amount for the next 12 hours 23.61 BTC

6 days ago
Avatar
Avatar

we bought yesterday 23.3 by an exchanger and we are waiting for the transaction. We cannot change the amount now

6 days ago
Avatar

the payment is in process

6 days ago

okay, waiting for 23.3 BTC from you in next several hours

6 days ago
Avatar
Avatar

ok. May I ask a partial decrypion of one server?

6 days ago

After payment you'll immediately receive decryptor for all network

6 days ago
Avatar

You have the last 3 hours to pay the fixed btc amount after that time the rate will be float again.

5 days ago
Avatar
Avatar

be patient

5 days ago
Avatar

the transaction is in progress with our exchanger

5 days ago
Avatar

technical time

5 days ago

Our btc wallet is always actual and the same, so send as quickly as it possible.

5 days ago
Avatar
Avatar

what do you mean?

5 days ago

The wallet that you see on your page is always relevant

5 days ago
Avatar
Avatar

i'm here

5 days ago
Avatar

operation is in progress

5 days ago

ok

5 days ago
Avatar
Avatar

be patient operation with exchanger is taking too long time

5 days ago
Avatar

please

5 days ago

How many time you need?

5 days ago
Avatar
Avatar

The exchanger told me that operation should be in the morning. Now here are 20:47

5 days ago

Take in mind, that after 35 hours your price will be doubled and this action cannot be undone.

5 days ago
Avatar
Avatar

we know. My mind now is about 23.3 BTC becouse operation is for that amount

5 days ago

If you don't pay tomorrow, i'll enable float rate again and don't fixed it anymore.

5 days ago
Avatar

So, hurry up your exchanger.

5 days ago
Avatar

Good morning! Any updates?

5 days ago
Avatar
Avatar

I had a meeting scheduled with exchanger at 1PM

5 days ago
Avatar

i don't know why he 's taking time. We yesterday moved € to exchanger

5 days ago

Well, if anything, do not hesitate to write about the results

5 days ago
Avatar
Avatar

we need cryptocurrency to close the deal with you and my family will be happy becouse I have to work all weekend

5 days ago

I understand you, as far as I know in Europe there are bitcoin ATMs for a long time

5 days ago
Avatar
Avatar

never seen

5 days ago

https://coinatmradar.com/country/[redacted]/

5 days ago
Avatar

We won't give you extra time, after 16 hours you price will be doubled, make payment faster.

4 days ago
Avatar
Avatar

Hi, i'm in call with exchanger

4 days ago
Avatar

we had to wait for the transfer of the amount

4 days ago
Avatar

technica time between bank

4 days ago
Avatar

I have the document that prove that we are moving money

4 days ago
Avatar

but we need more time

4 days ago
Avatar

till monday

4 days ago
Avatar

in the week end bank do not operate

4 days ago

Send the documents.

4 days ago
Avatar
Avatar

upload in progress IMG_20201120_152201.jpg 5.4 MB

4 days ago
Avatar

3 pages IMG_20201120_152152.jpg 4.8 MB

4 days ago
Avatar

last page IMG_20201120_152145__02__01.jpg 5.06 MB

4 days ago

Ok, added time.

4 days ago
Avatar
Avatar

da you update the countdown on this page

4 days ago
Avatar

?

4 days ago
Avatar

Time ends on 23 Nov 2020, 09:51

4 days ago
Avatar

in the morning is too eearly

4 days ago
Avatar

the bank open in the morning

4 days ago
Avatar

please set the deadline to 24 November 9 AM

4 days ago
Avatar

so we are sure than on monday close the transaction

4 days ago

Refresh the page

4 days ago
Avatar
Avatar

Ok thanks

4 days ago
Avatar

Hi, we are at work.

2 days ago

Hello! We, too, how is the exchange process going?

2 days ago
Avatar
Avatar

only the bank does not work on the week end

2 days ago
Avatar

the decryption tool work per single file?

2 days ago

You will receive a master (universal) decryptor for your Linux and Windows network after payment

2 days ago
Avatar
Avatar

it runs recursively o per file?

2 days ago

the process works as when encrypting only in the opposite direction, we will also send all instructions, and provide support until you decrypt the all network

2 days ago
Avatar
Avatar

see you tomorrow

2 days ago

Ok! Have a nice day!

2 days ago
Avatar

After 17 hours your price will be doubled and we won't change it.

1 day ago
Avatar
Avatar

i'm here

1 day ago
Avatar

good morning

1 day ago
Avatar

we are almost ready

1 day ago
Avatar

i'm worried about decryption process

1 day ago
Avatar

there are a lot of file on a lot of volume

1 day ago

Hello! the process of decryption is similar to the encryption process, you do not need to worry, maximum 4-5 hours and your files will be decrypted

1 day ago
Avatar
Avatar

on vmware do i need to execute decryption on one host esx that is connected to all volume or do I have to execute on every single host?

1 day ago

You should upload decryptor to each esxi, set 777 permissions and run. That's all you need, after small time your esxis will be ready for work.

1 day ago
Avatar
Avatar

can we test the decryption process on one single vmdk file?

1 day ago

We will send decryptor after payment and help with all. Don't worry, it's too easy.

1 day ago
Avatar
Avatar

we are doing the first transaction

1 day ago
Avatar

what description in the transaction?

1 day ago
Avatar

we sent the first little amount in order to test the correct transaction

1 day ago
Avatar

it is ok?

1 day ago

we can see your transaction

1 day ago
Avatar

you can send all amount

1 day ago
Avatar
Avatar

ok

1 day ago
Avatar

we proceed

1 day ago

and after 3 confirmation of bitcoin network we will send you decryptors and instruction

1 day ago
Avatar
Avatar

with the next trance

1 day ago
Avatar

we sent half amount

1 day ago
Avatar

please give us linux or windows decryptor now

1 day ago

we will send your decryptors only after you send us full amount.

1 day ago
Avatar

we are waiting for next part

1 day ago
Avatar
Avatar

one moment

1 day ago
Avatar

sent

1 day ago

ok, we can see your transaction

1 day ago
Avatar

waiting for 3 confirmation and then send you decryptors

1 day ago
Avatar
Avatar

we are waiting for decryptor

1 day ago

Windows: The decryptor works in 2 modes: 1. GUI 2. Console Three functions are available in GUI mode: 1. "DECRYPT ALL" - search and decrypt ALL encrypted files on the local PC and on network resources (Shares), where this PC has access. 2. "DECRYPT FOLDER" - decrypts files in the specified folder, which you can select in the "Browse for folders" window or drag and drop the folder into the decryptor window. 3. "DECRYPT ONE FILE" - decrypts a single file, which you can open in the "Open" window or drag and drop the encrypted file into the decryptor window. IMPORTANT! Extension of encrypted files may not coincide with the extension of files, which the decryptor suggests to open! To open encrypted files with other extensions, in the "Open" window select, in the lower right corner of "All Files (*. *)" or just drag and drop the given file into the decryptor window. File extension does not affect the decryption of file! Console mode has two parameters: 1. "-all" - search and decrypt ALL encrypted files on the local PC and on network resources (Shares), where this PC has access. You can also use Group Policy to quickly decrypt your entire network. 2. "-path" - decrypts files in the specified folder or a single file. 3. Dragging and dropping an encrypted file or folder with encrypted files onto the decryptor file. In this mode, the console window will open automatically, which will display the decryption process. Command line examples: decryptor.exe -all decryptor.exe -path C:\Folder decryptor.exe -path C:\Folder\file.txt.[redacted] win_decryptor.exe 76.5 kB

1 day ago
Avatar
Avatar

linux decryptor works alsa per files?

1 day ago
Avatar

also

1 day ago

linux decryptor decrypts all system, it cant decrypt certain files

1 day ago
Avatar
Avatar

may I ran on host that see all encrypted volume?

1 day ago

just run the decryptor on each esxi, that's all, you don't need to do anything anymore

1 day ago
Avatar

after decryption you can use your vms as before that

1 day ago
Avatar
Avatar

we are at work

1 day ago

Linux decryption instruction: 1. Upload decryptor to esxi. 2. Set run permissions: chmod 777 decryptor 3. Run decryptor: ./decryptor jump_decryptor.out 2.38 MB

1 day ago
Avatar

Use this one decryptor for you esxi

1 day ago
Avatar
Avatar

what is the difference?

1 day ago
Avatar

the decryptor did not decrypt some file

1 day ago
Avatar

on esx

1 day ago

Try the last decryptor.

1 day ago
Avatar

Which file was not decrypted? Give more information.

1 day ago
Avatar
Avatar

/vmfs/volumes/[redacted]/[redacted]_RM_03/[redacted]_RM_03_1-flat.vmdk.darkside /vmfs/volumes/[redacted]/WD_[redacted]/WD_[redacted]-flat.vmdk.darkside /vmfs/volumes/[redacted]/V185E016/V185E016-flat.vmdk.darkside /vmfs/volumes/[redacted]/V157E016/V157E016_1-flat.vmdk.darkside /vmfs/volumes/[redacted]/V066E016 - [redacted]/V066E016 - [redacted]_1-flat.vmdk.darkside /vmfs/volumes/[redacted]/V079E016 - [redacted]/V079E016 - [redacted]-flat.vmdk.darkside /vmfs/volumes/[redacted]/V195E016/V195E016_1-flat.vmdk.darkside /vmfs/volumes/[redacted]/V000REPP/V000REPP_1-flat.vmdk.darkside /vmfs/volumes/[redacted]/V000PAS2/V000PAS2_1-flat.vmdk.darkside /vmfs/volumes/[redacted]/V060E016/V060E016-flat.vmdk.darkside /vmfs/volumes/[redacted]/V000TS1P_2012/V000TS1P_2012-flat.vmdk.darkside /vmfs/volumes/[redacted]/V144E016/V144E016-flat.vmdk.darkside /vmfs/volumes/[redacted]/V189E016/V189E016-flat.vmdk.darkside /vmfs/volumes/[redacted]/V067E016/V067E016-flat.vmdk.darkside /vmfs/volumes/[redacted]/V000AMQP/V000AMQP-flat.vmdk.darkside /vmfs/volumes/[redacted]/V000AMMP/V000AMMP_3-flat.vmdk.darkside /vmfs/volumes/[redacted]/[redacted] - ArcGis DataStore/[redacted] - ArcGis DataStore-flat.vmdk.darkside

1 day ago

have other files been decrypted? Are virtual machines working?

1 day ago
Avatar

Use the last decryptor. He will decrypt them.

1 day ago
Avatar
Avatar

i will try the other decryptor becouse when i try to start [redacted] seems that a disk is missing

1 day ago

Try the last one and write to me.

1 day ago
Avatar
Avatar

[START #11] File Path.........../vmfs/volumes/[redacted]/[redacted]_RM_03/[redacted]_RM_03_1-flat.vmdk.darkside [INFO] File Size................0mb (4096 Bytes) [ERROR] File Too Small, Ignored

1 day ago

What is the size of this file? Problem with one file or multiple?

1 day ago
Avatar
Avatar

42

1 day ago
Avatar

seems that some filese were modified and disk size of the VM was set to 0

1 day ago
Avatar

so the VM does not start

1 day ago

what 42?

1 day ago
Avatar
Avatar

42 useful file was not decrypted

1 day ago

and how much was decrypted?

1 day ago
Avatar
Avatar

a lot

1 day ago

If the reason for the non-decryption is that there is 0 size, then I cannot help you. The decryptor cannot decrypt what is not. Check all file sizes and tell me them. When you tried to start virtual machines, the hypervisor could damage the encrypted files. I mean before you got the decryptor.

1 day ago
Avatar

Are you having a problem with virtual machines on the same hypervisor? or at all?

1 day ago
Avatar
Avatar

we are having some problem

1 day ago

answer the questions so that I could understand what to tell you.

1 day ago
Avatar
Avatar

the probelm is on esx

1 day ago
Avatar

Task name Power On virtual machine Target WD_[redacted] Status File /vmfs/volumes/[redacted]/WD_[redacted]/WD_[redacted].vmdk was not found

1 day ago

Look through ssh. Do you have a file?

1 day ago
Avatar
Avatar

have a file of 4K with .darkside extension

1 day ago
Avatar

we lost some vm

1 day ago
Avatar

sigh!

1 day ago

The decryptor checks all checksums, it could not damage virtual machines. This is the first time that a client talks about problems. Did you check the sized before decryption?

1 day ago
Avatar

How many virtual machines have you failed to recover? Were they on the same esxi?

1 day ago
Avatar

You showed me a log in which the decryptor is trying to decrypt empty files. So the problem arose before decryption. Why so, I can not answer you, there can be a lot of reasons.

1 day ago
Avatar

If you have any other problems with decryption - I will help you, just give me not empty files.

1 day ago
Avatar
Avatar

the empty file has data of creation on 15Nov in the night

1 day ago
Avatar

i don't know why

1 day ago
Avatar

there is a format job runnin

1 day ago
Avatar

I need your little but useful help. On veem the volume where we have the backup , this morning was accessible but now the volume is RAW.

1 day ago

I don't quite understand what you mean

23 hours ago
Avatar
Avatar

the tool that you used to encrypt our backup. At the end of encrypion does it do disprutive action?

22 hours ago

No, it doesn't. If backups are on Windows - use the Windows decryptor.

22 hours ago
Avatar

Never interrupt the decryption process by closing the program manually. The program may freeze during decryption, this is normal.

22 hours ago
Avatar
Avatar

Hi.

19 hours ago
Avatar

we trusted in you

19 hours ago
Avatar

but we need some files that miss

19 hours ago

We gave you decryptors and they work, if you have problems with them, I will help you.

17 hours ago
Avatar

Before buying decryptors, you saw that some files were empty and you could not pay.

17 hours ago
Avatar

We fulfilled our part of the deal, I don't know why you have empty files. You didn't even tell me how many there are.

17 hours ago
Avatar

This information is provided by Valéry Marchive & Julien Mousqueton