Contact us Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Negotiation Chat — Akira

Negotiation chats provided by Valéry Marchive and Julien Mousqueton.

Chat ID: 20240531

Victim
Hello
Victim
hello
Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get your reply you will be provided with all the details.
Gang
Victim
Hello
Do you see our messages?
Gang
Victim
hello
Please refresh this chat periodically.
Gang
Victim
Hi
Victim
What are the steps to recovery?
Do you have a permission to conduct a negotiation on behalf of your organization? Once we get your reply you will be provided with all the details.
Gang
Victim
yes
Victim
any update?
Please confirm you have a permission to conduct a negotiation on behalf of your organization and we will proceed with the details.
Gang
Victim
yes, i have permission
Victim
do you need any information?
Victim
hello?
Victim
?
Victim
hi?
The longer you ignore our question, the longer you remain non-operational.
Gang
Victim
i have permission to negotiation
Victim
you need a proof?
Victim
I need information on how recovery works
I need you confirmation that you have a permission to conduct a negotiation on behalf of your company and make financial decisions.
Gang
Victim
yes, i have permission to negotiation
Victim
what information do you need?
Victim
I'm ready to negotiate. How much?
Are you kidding us? Please answer our question and we will proceed.
Gang
Victim
Maybe I didn't understand your question. You questioned whether I am allowed to negotiate. The answer is yes, I have permission. Do you need any additional information that I didn't send? It's confusing. What question do I need to answer? I am the owner of the company, and I need to negotiate.
list.rar // 848 KB
Gang
These files were taken from your network prior to encryption. You can pick 2-3 random files up to 10 MB each from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
Gang
Victim
show me these files, please: E:\[redacted].doc E:\[redacted].doc
Victim
[redacted].ini.akira // 1.35 KB
Victim
and decrypt this .ini, please
files.rar // 145 KB
Gang
Victim
ok, and can you decrypt the .ini too?
Victim
?
Victim
Do you have access to just the documents on the list, or are there more documents?
Victim
If you choose partial, is it done per server, or per file?
We will decrypt every file that we encrypted. The list reflects everything we took. We do not decrypt per file.
Gang
The price for the whole deal is $690,000. You can send us encrypted files for test.
Gang
Victim
I will send the file for testing
Victim
[redacted].ini.akira // 1.35 KB
Victim
You did it?
What do you mean? Will you send encrypted files?
Gang
Victim
I will send the file for testing
Victim
[redacted].ini.akira // 1.35 KB
Wait a bit.
Gang
decrypted.7z // 494 Bytes
Gang
You can review. Ready to move to payment? Once you confirm I will give you our BTC wallet.
Gang
We are waiting for your decision regarding the deal within a few hours.
Gang
We see no decisions from you. Are you going to work with us?
Gang
Victim
We are assessing your proposal. It’s a tough financial decision. Please give us more time.
Hope 24 hours will be enough.
Gang
Have you decided something? We are going to announce the leak today.
Gang
You can find your company name in our news column: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion If you want this post to be removed, we have to agree on something.
Gang