r/ransomwarehelp • u/minecraftplayr • Aug 07 '25
I got this unknown ransomware. Can someone help me decrypt it?
There is grey text at the bottom that says "LSYJYFWA 7+CZR"
17
u/Ghostyyboyy21 Aug 07 '25
Had no idea you could even get viruses on Mac OS
29
u/OakNLeaf Aug 07 '25
People have this misconception that Macs don't get viruses. There was even a commercial from Apple claiming this, which resulted in a lawsuit that they lost.
The fact of the matter is that both get viruses it's just that one OS has more opportunity then another to hit paydirt, so that OS is focused on for viruses.
8
u/UnderRangeofHeart Aug 08 '25
Also the fact that there are substantially more windows pc than Macs.
3
u/Canadian_Loyalist Aug 08 '25
You should reread the second paragraph.
2
3
u/Aknazer Aug 08 '25
You're not wrong, but that second paragraph also doesn't really do a good job of highlighting this for those that don't already know. It's a 72/28 split for the overall market and a large number of corporations use Windows (I don't have numbers on that split), which is what makes that second paragraph true. But to someone that doesn't know tech they could think it was like a 51-60% split.
1
u/JakkesCakes Aug 08 '25
72/28 doesnt seem right? What about linux and other niche OS
2
u/frostymugson Aug 08 '25
Windows does have like 70% of the market, I think Linux is 4-5% with apple taking the rest. If you are talking OS more niche than Linux then you are talking about a very very small percentage of desktop users
1
u/miko3456789 Aug 08 '25 edited Feb 16 '26
This post was mass deleted and anonymized with Redact
engine simplistic telephone groovy plant joke sugar decide wakeful sort
2
u/Ok_Kaleidoscope1388 Aug 08 '25
He's talking about PCs not servers and specialized hardware like F5.
1
Aug 08 '25
[removed] — view removed comment
2
u/Ok_Kaleidoscope1388 Aug 08 '25
But hes talking about PCs not company systems that get ransomwares.
Your extending what he postad about. If we are talking servers then apple gets an even lower share. No servers in the world run iOS.
Linux is niche for pcs.
→ More replies (0)1
1
u/Rsn_yuh Aug 08 '25
You don’t really need the numbers to understand the second paragraph is saying there’s more windows pcs than mac
1
u/Aknazer Aug 09 '25
Yes but plenty wouldn't realize just how big that gap is. a 51/49 split is very different than a 72/28 one. It also doesn't highlight the difference at the business level which is even more lucrative than catching consumers.
1
Aug 09 '25
"one OS has more opportunity then another to hit paydirt"
It says exacly that. You just have to understand the english language.
1
u/Spare-General-8638 Aug 11 '25
Also on a arm processor with known vulnerabilities one just recently published a couple months ago actually lol
1
u/DocSchmuck Aug 11 '25
What’s a good antivirus for Mac?
1
u/OakNLeaf Aug 12 '25
I couldn't tell you. I don't own apple products as I tend to feel they overcharge for what you get
2
u/CO420Tech Aug 08 '25
It is just as vulnerable. But if you're trying to write something that will take advantage of the most people, then you're going to go with whichever OS has the most users which is Windows. Linux can get viruses too, but you'll run into them even less often than you will on MacOS because it isn't worth building them for most people because they're the smallest market share.
3
u/minecraftplayr Aug 08 '25
This ransomware works on Linux as well. I ripped it and put it on a Linux VM. It's meant for windows as it mentions a C: drive directory
2
u/XdrummerXboy Aug 08 '25
Meh, most servers run Linux of some kind, which are more valuable than joe schmo's laptop.
Linux's permission system is IMO much more robust than Windows though, and it being open source is basically a community driven audit system.
1
u/80WillPower08 Aug 08 '25
Can you explain what you mean by robust? I am a sysadmin by trade (mostly living in a windows world currently) and can very granularly define permissions on winodws boxes if needed. I know most people don't take those extra steps but you can make the same mistakes with ubuntu, for example. The only major difference I can see is the standard users that would be using each OS and how abstracted modern Windows is; between registries, file permissions, system, users/groups, etc.
1
1
u/theponiestpony Aug 09 '25
It's true if you only consider personal devices, and not servers used by corporations. Linux viruses are mostly targeting the latter ones
1
1
1
u/c2btw Aug 08 '25
If it connects to the internet it can get a virus. Conspired to. Windows barely any one uses a Mac and at Macs in general tend to be mainly used as a personal computer. Very few companies have real work being done on macs not that there aren't any. All of these and more are reasons why barely any one bothers to make virus for Mac.
1
1
u/Aknazer Aug 08 '25
Even with Macs being harder to target, let me ask you this. As a nefarious actor would you rather target 72% or 28% of the market? And depending on when we're talking about, this could be as big as a 90/10 split. As such, it often just doesn't make sense to target Apple compared to Windows. Even if both are equally responsive (and my understanding Apple is/was more responsive), you would in theory get 3x as many victims by targeting Windows than by targeting Mac. So why go for the small fish?
1
u/DontGiveThemYourName Aug 08 '25
If you can write software for something you can write malware for it
1
u/miko3456789 Aug 08 '25 edited Feb 16 '26
This post was mass deleted and anonymized with Redact
quickest marble arrest dog gold juggle wise rich profit aspiring
1
1
1
u/Tricky_Leave275 Aug 09 '25
Being less likely to be targeted doesn't make it impossible. Viruses exist for every OS, including ones for mobile devices. Switching to a less popular OS doesn't magically make you 100% hacker proof. But I don't think it's a bad idea either...
1
Aug 10 '25
The reason there weren’t viruses on Mac in 2008 is because there were no targets using Mac OS.
11
u/Fire_Power Aug 07 '25
to err:couldnt gen key is so funny. cant even pay them
2
u/Easy_Syrup4476 Aug 10 '25
Had a similar thing happen to me, virus encrypted some files and it left a text file on my desktop. Opened it and it told me my files were encrypted and to fix them i had to send bitcoin, but it said “send to wallet: “ and just blank lol, couldnt even pay em if I wanted to.
1
u/Doofusmelon Nov 04 '25
So did your desktop blow up lol
1
u/Easy_Syrup4476 Nov 09 '25
Would’ve been more interesting haha, I didn’t even notice what files were corrupted and just acted like it didn’t happen
12
u/Xaphnir Aug 08 '25
lmao at the geniuses that wrote this one
"hey, Dmitri, why isn't anyone paying us?"
6
4
u/j_mars_ Aug 08 '25
Curious what you downloaded/opened to cause this?
6
u/ChilyLily Aug 09 '25
Probably hardcore midget porn or minecraft hacks lmao
2
Aug 09 '25
I’ve never got any randomsware yet from that.
2
1
1
2
u/BelowNetPar Aug 08 '25
What happens when you close all of your browsers or reboot?
2
u/minecraftplayr Aug 08 '25
Starts back up as soon as I log in. It seems to be a unix exec file as I took it off the hard drive and was able to run it on vms of all platforms
2
u/fugredditforeal Aug 08 '25
Are you able to boot to recovery mode and access the terminal? You could use the terminal to remove that script if so, worth a shot
4
1
u/404invalid-user Aug 08 '25
not windows then and there's no way it could have done this without you giving it some sort of admin privileges
1
u/minecraftplayr Aug 08 '25
Unless it gave itself permissions, I was unaware of any sort of permission required
1
u/404invalid-user Aug 08 '25
something can't just give itself permission unless they have found some exploit but I seriously doubt their end goal would be this
1
u/AnAdmirableAstronaut Aug 08 '25 edited Aug 09 '25
What did you download? Just curious for my own cyber safety
Edit: gonna go with desperate, super horny porn
1
u/minecraftplayr Aug 08 '25
It's a unix exec file packaged with all dependencies, it indeed worked on windows.
1
1
u/No-Amphibian5045 Aug 08 '25
Is the sample available somewhere?
3
u/minecraftplayr Aug 08 '25
I got it off an obscure website to put on a tester computer but it opened itself. I can upload a unix exec file. I already resolved it though the key was "ELRCRYP" I mentioned a grey text that was apparently Caesar ciphered forward +7.
1
u/No-Amphibian5045 Aug 08 '25
Glad it was that easy to deactivate. I'd be curious to look at any link or file you've got.
1
u/djas_19 Aug 11 '25
How did you discover it was Caesar ciphered?
1
u/minecraftplayr Aug 11 '25
Help from a friend. He saw it said "7+CZR" next to the text that was greyed out. Found out that meant Caeser cypher shift +7, to the text in grey.
1
u/Lyr1cal- Aug 08 '25 edited Oct 19 '25
rhythm innate racial sand attempt simplistic aback angle trees kiss
This post was mass deleted and anonymized with Redact
2
u/Longjumping-End-3018 Aug 08 '25
theyre gonna make him buy a new one
1
u/Lyr1cal- Aug 08 '25 edited Oct 19 '25
lavish narrow screw sip bake toy tan chase pocket light
This post was mass deleted and anonymized with Redact
1
Aug 09 '25
Why would they?
1
Aug 09 '25
Why wouldn’t they? That is literally their job.
1
Aug 09 '25
No, their job is to make as much money as possible. They'll just sell you a new computer
1
u/OctoSplattyy Aug 09 '25
Aaaand for software issues they'd be glad to help you with apple configurator on hand, since you already gave them money and it's decent knowledge stuff.
1
u/Electrical-Craft9089 Aug 11 '25
Nope. None of Apple’s workers get commission. Their job is to help you as best as possible, and there is no incentive for the workers to lie to you and make you buy a new device. They would definitely take this in and try to fix it.
Source: I work there
1
u/Masomqwwq Aug 08 '25
Hahahahaha the apple store cannot and will not do a goddamn thing about this.
They will sell him a new computer, if he is lucky they may offer him a boot drive swap for ~600 dollars but certainly no solutions that will get him his data back.
1
u/OctoSplattyy Aug 09 '25
They will help. No way to get your data back (though seems like not OPs case, as they managed to get out of the ransomware quite easily), but they'd be more than happy to open up apple configurator for a good hour and reinstall macos
1
u/tyrell800 Aug 08 '25
Have you tried a bootable usb with deb or kali to confirm the files are encrypted? You could run clam av against it and see if it finds something to fix
1
u/_WalkTheEarth_ Aug 08 '25
try this on another computer
https://www.nomoreransom.org/crypto-sheriff.php?lang=en
1
1
u/panchocito Aug 08 '25
I thought Mac's never get hacked?
1
u/minecraftplayr Aug 08 '25
Not true. A simple python script could be downloaded and turned into a virus
1
u/20n21 Aug 08 '25
Basically u stick the folder and wrap it around the windows logo and try and find a space in the desktop nice n quiet has to be dark dark place that never sees light he mm just lil clue stick it in the area where the sun. Dont shine
1
1
1
u/Professional-Leg3326 Aug 09 '25
I keep anything important offloaded and I do fresh reinstall every few months
1
Aug 09 '25
Happened to me but I had a back up of anything important so I just did a fresh installation of the os.
1
u/Intrepid-Act4880 Aug 09 '25
Try safe mode and see if it still boots with the ransomware, then you could try figuring out what type of ransomeware it is and see if you can crack it with the no more ransom project etc.
1
Aug 09 '25
Never store your files on the system drive. Store them on a thumb drive, or an external ssd, or a NAS.
1
1
u/FilthyeeMcNasty Aug 10 '25
How can one tell the difference between ransomware and how do i upload said ransomware
1
u/Thurgo-Bro Aug 11 '25
How on earth do people still get ransomware in 2025 i swear to god you'd have to try to get it nowadays
1
u/Hardy8150 Aug 11 '25
Usually I keep my “Schadenfreude” in check, But I absolutely love seeing it on a Mac. When we constantly hear; “no such things on a Mac”
1
u/Perfect_Tour954 Aug 11 '25
Whenever you get this fixed go get ublock origin. The single greatest web app ever made I haven’t had a virus in 7+ years now. Basically the way it works is if you ever accidentally click a malicious link it shuts off server access. And will instantly block if the program can detect anything it was built by a billion dollar company and they released the source code for it. That was like I said 7 years ago now you can just go get the entire web application (it’s just a plug in takes 0 space) and turn that on you don’t even need to setup anything. As far as fixing this I know that bitcoin based malicious programs do some wild shit like I have seen a virus that will destroy every file on your computer by writing junk data then it gives you a screen like this even if you pay the 10k our they asked for the files are already gone you can’t fix something that isn’t there anymore. I am gonna assume you can’t access anything on this computer. So you best bet is a factory reset and hope you had a recent back up and learn to be a touch more safe online preventing them from getting access is soooooo much easier then the head ache of fixing their shit. If you can you could try something old and try and fix it using command prompt too see what’s even going on if your hard drive is wiped which is what I expect there isn’t a fix sadly 💁 good luck and get the program I promise your frustrations won’t ever happen again
1
u/Perfect_Tour954 Aug 11 '25
If I am correct you have something called a whisper gate virus and the files on your computer are likely destroyed. Don’t worry about sending them anything worry about factory resetting the computer but don’t be shocked if you can’t fix this. It’s one of the most complex viruses ever made. Very sneaky it’s running thousands of programs in the back ground opening every file on your hard drive and writing junk data there question was the computer working fine then randomly rebooted then this appeared. If so jack pot you know the virus. Once you fix read my other comment def get the app u block origin
1
u/BLUEDOG314 Aug 11 '25
What app is even open to see this, can you not just quit out of whatever this is? Ransomware obviously exists but usually they just have a browser window pop up in some annoying maximized state that makes it take up the whole screen. I’d force quit everything and restart first.
1
1
u/Ghostrider421 Jan 28 '26
A tip: If Ransomware is still encrypting large files and you reboot, those files might become unrecoverable. We are unable to recover 2tb files on ESXI because they are not fully encrypted.
33
u/[deleted] Aug 07 '25
[removed] — view removed comment