TerraMaster Forum

JackFrost wrote: ↑27 Apr 2024, 07:40

Did you get the .exe file to work? We received email with a key and the file but cannot get it to work.

JackFrost wrote: ↑27 Apr 2024, 07:40

Hello,

May I please get the decrypt executable. I got with this last night and I'm scrambling to recover my family treasured photos and other files I had stored on my NAS.

Thank you kindly.

Badwolfaz wrote: ↑29 May 2024, 07:28

JackFrost wrote: ↑27 Apr 2024, 07:40

Did you get the .exe file to work? We received email with a key and the file but cannot get it to work.

Would you mind sharing the file you received to decrypt? I got hit with this a few days ago, and before I pay the ransom would like to see if this works. you can email me at:
sigallai @ gmail.com

Badwolfaz wrote: ↑29 May 2024, 07:28

I begrudgingly paid the ransom and a few days later received an email back with an executable and key, it actually did work for me!

If you're struggling to get it to work you need to run it in command prompt. You need to supply the path to the file you want to decrypt and the key these a-holes sent you in the email. The command looks like this:

The zip file they sent me with the executable is called t7xvdd.zip

C:\Temp\t7xvdd>d_nas_win.exe
d_nas_win.exe [path to be decrypted] [personal key]

EXAMPLE:
C:\Temp\t7xvdd>d_nas_win.exe C:\Temp\banner1.png.lvt [My Personal Key From The Email Goes Here]
Decrypt: C:\Temp\banner1.png.lvt

It removed the extension, decrypted the file and now I can view it again.

You need to run it on each and every file you want to decrypt. I'm going to write a PowerShell script to parse through the file system and decrypt everything at once. If you'd like I can share that to you once I have it. Please send me a DM or respond here and I'll share it.

JackFrost wrote: ↑27 Apr 2024, 07:40

I begrudgingly paid the ransom as well and a few days later received an email back with an executable and key, it actually did work for me!

If you're struggling to get it to work you need to run it in command prompt. You need to supply the path to the file you want to decrypt and the key these a-holes sent you in the email. The command looks like this:

The zip file they sent me with the executable is called t7xvdd.zip

C:\Temp\t7xvdd>d_nas_win.exe
d_nas_win.exe [path to be decrypted] [personal key]

EXAMPLE:
C:\Temp\t7xvdd>d_nas_win.exe C:\Temp\banner1.png.lvt [My Personal Key From The Email Goes Here]
Decrypt: C:\Temp\banner1.png.lvt

It removed the extension, decrypted the file and now I can view it again.

You need to run it on each and every file you want to decrypt. I'm going to write a PowerShell script to parse through the file system and decrypt everything at once. If you'd like I can share that to you once I have it. Please send me a DM or respond here and I'll share it.

Here is the link to the decrypt software they sent me:

https://files.catbox.moe/t7xvdd.zip

They send you a unique personal key to use to decrypt, so not sure if this will be useful to anyone else, but here it is.

Can you send your key? I got affected by the ransomware too and I would like to use the decrypter

arnau97 wrote: ↑25 Jun 2024, 17:36

Hello, I sent you a private message with the key they sent me.

Please let me know if it works for you, I'm curious to know.

Hello!

I tried it. The decrypter removed the extension but the file was not able to be read. I think each one has a diferent personal code

Anyways, thanks a lot for this.

If you find and other solution, please contact me

arnau97 wrote: ↑26 Jun 2024, 18:33

Interesting. Yes, I believe they send a different key based off the original personal key text file they leave behind unfortunately.

However. After going through and decrypting several files I found that a lot of them became corrupted. Some files I can open again after decrypting and a majority of them I can't. Really annoying . So in the end I did end up losing a lot of my data .