Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Generic User Avatar

My files were encrypted with .zpsc extension ransomware


  • Please log in to reply
2 replies to this topic

#1 Borghol

Borghol

  •  Avatar image
  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:06:31 AM

Posted 04 July 2025 - 04:13 PM

Hello,
 
My computer has been infected with ransomware and all my files were encrypted with the `.zpsc` extension. A ransom note named `_readme_you_ws_hacked_.txt` was left in most folders.
 
I used ID Ransomware to try to identify the ransomware, but it could not detect it. This is the case SHA1 hash I received:
`4665fca194f5586afcb96130aa67d01382508863`
 
Here are some details:
 
- Encrypted file name example: `Document.xlsx.zpsc`
- Ransom note name: `_readme_you_ws_hacked_.txt`
- Note message mentions over 1 TB of data and provides a TOR address
- I have not paid the ransom and don’t plan to
 
I’ve attached both the ransom note and a sample encrypted file to this post.
 
Please let me know if you can help identify the ransomware or if a decryptor might be available (even in the future). Any assistance is greatly appreciated.
 
Thank you!


BC AdBot (Login to Remove)

 


#2 rivitna

rivitna

  •  Avatar image
  • Security Colleague
  • 540 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:31 AM

Posted 04 July 2025 - 04:47 PM

I think it's Kraken ransomware



#3 quietman7

quietman7

    Bleepin' Gumshoe


  •  Avatar image
  • Global Moderator
  • 64,270 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:31 PM

Posted 04 July 2025 - 04:58 PM

....I’ve attached both the ransom note and a sample encrypted file to this post.

There are no attachments.

 

To attach sample encrypted files (size no more than 10 MB), they must be submitted in a "zip file" format. Ransom notes can be attached separately. After that, click the More Reply Options button in the bottom right corner of the Board Editor, then click the Choose File button under Attach Files, browse to the location of the file and choose Open.


.
.
Microsoft MVP Alumni 2023Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users