llmxpyc -- ransomware effects 

system · 2015-06-08T16:10:50.000Z

Greetings !!

I have a customer with all the files (xls/pdf/doc/etc…) crypted by a ransomware that changed the extensions to llmxpyc.

Anyone have an idea from which malware this come from ?

The crypted datas may be cracked if I knew the algorithm family it is declined from.

Pondus · 2015-06-08T16:28:22.000Z

i think newer ransomware versions encrypt with randome file extension

Essexboy may have some info when online

essexboy · 2015-06-08T16:55:09.000Z

You could try this http://www.bleepingcomputer.com/forums/t/577953/locker-developer-releases-private-key-database-and-3rd-party-decrypter-released/

Eddy · 2015-06-08T17:03:41.000Z

It is mainly spread through the web by showing the user something like “It is recommended to update your video player”.

Here are three decryption tools you could try:
https://noransom.kaspersky.com/
http://blogs.cisco.com/security/talos/teslacrypt
http://tinyurl.com/oxtlmvv

system · 2015-06-09T21:14:50.000Z

thx, I will try something…

system · 2015-06-16T16:40:29.000Z

Still not have news about SERIOUS unlocker… it’s a shame that some idiots are refering to things like Stellar … WDR or SpyHUNTER to DECRYPT llmxpyc crypted files…

I got two key.dat files… if I could help people who try to fight this crypting algo… lemme know.

Eddy · 2015-06-16T17:04:05.000Z

Only/best thing you can do is send all info you have to companies like avast, Kaspersky, Avira and such as well as sending it to cybercrime devisions of police worldwide.

Here is the contact form for Interpol:
http://www.interpol.int/Forms/Contact_INTERPOL

Announcements