Eccrypt file _extension: .lockbit

[Robin Maan]

i think some attack virus form our machines this virus is ransomnote_url: http://lockbitksa.onion/
sample_extension: .lockbit
our system data is encrypt and extension is change example ( om.pdf.lockbit.Xopi )

Please help how to resolve

 

[struppigel]

Hello Robin Maan,

I am Karsten and will gladly help you with any malware-related problems.

Please familiarize yourself with the following ground rules before you start.

• Read my instructions thoroughly, carry out each step in the given order.
• Do not make any changes to your system, or run any tools other than those I provided. Do not delete, fix, uninstall, or install anything unless I tell you to.
• If you are unsure about anything or if you encounter any problems, please stop and inform me about it.
• Stick with me until I tell you that your computer is clean. Absence of symptoms does not mean that your computer is free of malware.
• Back up important files before we start.

-------------------------------------------------------
The encrypted file you mention has a triple-extension. It indicates that two different ransomware families might have encrypted your system.
One of them seems to be Lockbit ransomware which is not decryptable by anyone without the key. Only the criminals have the key.

• Please go to https://filebin.net/
• Click on the button Upload files
• Hold the CTRL key and click on an encrypted file and on a ransom note. Then click Open.
• In your browser click on the URL and copy it. Paste the URL here, please.

I would like to verify the ransomware that caused this and estimate your options.