Ranzy — 20201015

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Ranzy Actor / other Date 15 Oct, 16:27

   Hello, you heed help?

2. Message 002 From Victim Victim Date 16 Oct, 16:04

   how much

3. Message 003 From Victim Victim Date 16 Oct, 16:05

   how much

4. Message 004 From Ranzy Actor / other Date 16 Oct, 16:06

   Hi, please wait 5 min.

5. Message 005 From Victim Victim Date 16 Oct, 16:06

   hello?

6. Message 006 From Ranzy Actor / other Date 16 Oct, 16:06

   Hello.

7. Message 007 From Ranzy Actor / other Date 16 Oct, 16:09

   Price for your case is $7,000. If you can pay this amount we send you all instructions

8. Message 008 From Ranzy Actor / other Date 16 Oct, 16:33

   Hello?

9. Message 009 From Victim Victim Date 17 Oct, 03:29

   Your note says all of our sensitive data was downloaded to your servers. Does that mean you took our data? We read an article that says you like to take data. We want our data decrypted. So, if we pay we get a decryptor and all of our files back? Is that how this works?

10. Message 010 From Ranzy Actor / other Date 17 Oct, 03:33

    Yes.

11. Message 011 From Victim Victim Date 17 Oct, 21:48

    Ok. We are going to have a meeting to discuss this situation. Can you send us a file or two from the data you took?

12. Message 012 From Victim Victim Date 19 Oct, 14:35

    Ok. We had our meeting and agree that we need the decryption program. Can you fix a file to prove your ability to decrypt?

13. Message 013 From Ranzy Actor / other Date 19 Oct, 16:05

    yes, upload file on https://ufile.io < 3mb

14. Message 014 From Victim Victim Date 19 Oct, 16:24

    Here is the link it gave me. https://ufile.io/[redacted]

15. Message 015 From Ranzy Actor / other Date 19 Oct, 17:40

    Hello, can you send me teamviewer access on your infected server?

16. Message 016 From Victim Victim Date 19 Oct, 19:29

    We can't provide you access, but if you tell us what you need to look at, we can provide information to you. Do you need more sample files, or something else?

17. Message 017 From Ranzy Actor / other Date 19 Oct, 19:31

    Yes, more sample files (from any servers and in share folders and local folders). Also tell me this information: Your OS, how to you shutdown our ransomware, and how much share folders in your local network. Thanks.

18. Message 018 From Victim Victim Date 20 Oct, 02:41

    Win Server 2008 R2 The Anti Virus caught the malware We only have 1 server.

19. Message 019 From Victim Victim Date 20 Oct, 02:42

    https://ufile.io/[redacted]

20. Message 020 From Victim Victim Date 20 Oct, 21:25

    Any update on our encrypted file?

21. Message 021 From Victim Victim Date 21 Oct, 14:00

    Hello. Have you decrypted our file?

22. Message 022 From Ranzy Actor / other Date 21 Oct, 14:23

    Hello

23. Message 023 From Ranzy Actor / other Date 21 Oct, 14:24

    We have another messages from recovery company

24. Message 024 From Victim Victim Date 21 Oct, 15:57

    What do you mean?

25. Message 025 From Victim Victim Date 21 Oct, 22:10

    In the beginning we asked another recovery company to help us. Do you know the name of the recovery company that is communicating with you still? Their website said they could decrypt our files, but it was a lie and I think they contacted you instead. Did they pay you? Please ignore them and communicate here with us and we will get this sorted out.

26. Message 026 From Ranzy Actor / other Date 21 Oct, 22:13

    All recovery company is scam and just write us for buy decrypt.

27. Message 027 From Victim Victim Date 22 Oct, 15:58

    Have you made any progress on decrypting our test file?

28. Message 028 From Ranzy Actor / other Date 22 Oct, 16:05

    Hello yes we have progress but we dont understand which version our software you are encrypted, can you send me time when you encrypted?

29. Message 029 From Victim Victim Date 22 Oct, 18:26

    It looks like it happened on 10/11/2020.

30. Message 030 From Ranzy Actor / other Date 22 Oct, 19:52

    So, your files encrypted tested version our software and we must scan all your system for find keys for decrypt, and also my boss up price for you so final amount is 30,000$

31. Message 031 From Victim Victim Date 22 Oct, 22:08

    Can you give us the scan tool?

32. Message 032 From Ranzy Actor / other Date 22 Oct, 22:10

    Scan with private global decryption key and when scanned collect all keys and decrypted it in real time, we can connect to teamviewer and scan it or send it you after payment

33. Message 033 From Victim Victim Date 23 Oct, 01:49

    There is no way we are letting you back into the server. We also can't afford anywhere close to the amount you are asking at $30,000. We could barely even afford $7,000. We are just a few person company. If you can't prove you can decrypt, we can't pay you anything. The price needs to go back to $7,000 because I don't know if we can even afford that. How can you decrypt the data without getting into our server?

34. Message 034 From Ranzy Actor / other Date 23 Oct, 01:53

    In any case need teamviewer.

35. Message 035 From Victim Victim Date 23 Oct, 14:02

    Why can’t we just run whatever key find program you need us to run for you? We will not give you Teamviewer access, especially not if you want a price that we can’t possibly afford. Can you send us the program that you need to run to find the keys, then decrypt a sample file, then we can pay $7000 for decryption?

36. Message 036 From Ranzy Actor / other Date 23 Oct, 14:03

    Im already repeat you - your network encrypted with tested versions our software so for finding keys need scan your system, our scanner with private key and we do not provide it just like "download this and run". If you cant provide teamviewer and pay $30,000 - goodbye