Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Negotiation Chat – lockbit3.0

Chat ID: Leaked2025-ClientID-124

You can attach a few files for test decryption by packing them into an archive with zip, rar, tar, 7zip, 7z, tar.gz extensions of no more than 10 megabytes using the attach button directly in the chat.

If your archive weighs more than 10 megabytes, please use our file sharing service.
http://lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion
http://lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion
http://lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion
For security reasons we do not click on other links you send in chat.
Please wait for a reply, sometimes it takes several hours due to possible time zone differences.
2025-01-24 16:37:40
Gang Avatar
hi
2025-01-24 16:37:51
Gang Avatar
Victim Avatar
hi, I\'m here
2025-01-24 16:38:46
The previous public chat has been blocked. Now we can communicate with you privately.
2025-01-24 16:38:48
Gang Avatar
We know about the TOX conversation and that you have already agreed to a price of $50,000.

When will you be ready to pay? How much time do you need?
2025-01-24 16:39:42
Gang Avatar
Victim Avatar
50,000 is really difficult for me. What is the lowest price you can give me?
2025-01-24 16:41:17
So in the last chat you agreed to the amount of 40,000 dollars.

We do not agree with this price.
But we agree to give you a discount of 5,000 dollars, and the final price will be 45,000 dollars, but on one condition: that you make the payment within 24 hours.
Do you agree?
2025-01-24 16:45:03
Gang Avatar
Victim Avatar
I can get 30,000 today. The 40,000 would be for Monday. Also, in a few hours the banks close until Monday. I don\'t think I can make any payment in 24 hours.
2025-01-24 16:49:31
We offer you the following options:

Main Option:
The main payment is due on Tuesday. Find an additional $5,000 to bring the total payment to $45,000.

We are willing to offer you an alternate option:
If you make a $5,000 deposit today, we will give you a $5,000 discount and you can pay the balance of $35,000 on Monday or Tuesday.

Which option do you choose?
2025-01-24 17:01:20
Gang Avatar
Victim Avatar
Ok I would accept the second option. Today I could transfer the 5000, I need the instructions. On the other hand, I would appreciate it if you could send me some other file, of your choice, so that I know that I am not spending the money uselessly.
2025-01-24 17:13:10
We always focus on the time zone UTC+0, so you have approximately 6.5 hours.
2025-01-24 17:24:17
Gang Avatar
Victim Avatar
Perfect. I\'m getting everything ready. I\'m waiting for the address.
2025-01-24 17:33:02
This is bitcoin wallet address for payment:
[redacted]
2025-01-24 17:55:12
Gang Avatar
We are currently preparing a partial file tree for you. This will take some time.
2025-01-24 17:56:15
Gang Avatar
Victim Avatar
Good
2025-01-24 18:41:30
2025-01-24 19:17:23
Gang Avatar
Please select a file and we will send you the original file.
2025-01-24 19:17:45
Gang Avatar
Victim Avatar
.\\Datos\\[redacted].txt
2025-01-24 19:30:44
Victim Avatar
Please, could you also confirm that you have the original .mfd files and show me their names?
2025-01-24 19:32:03
2025-01-24 20:19:13
Gang Avatar
Perhaps you are not talking about \"mfd\" files, but about \"mdf\" database files?
2025-01-24 20:20:20
Gang Avatar
All the files we downloaded from you are in perfect order, and they are whole and functioning.
We sent you a list of files, a partial file tree, which contains about 5% of all the files we downloaded. The full file tree + full logs of deleting these files from our servers you can get only after payment.
2025-01-24 20:24:32
Gang Avatar
Victim Avatar
Yes, sorry I mean MDF
2025-01-24 20:46:57
I see that these files are not in the partial file tree. They may be in the general list, but you will be able to see it only after payment. In any case, if these files are there, they are in perfect order. But you should not worry about this, because after payment you will also receive the decryption keys for the files, and you will be able to decrypt your files if they are encrypted and do not function for now.

When will you make the payment? We have fulfilled the conditions on our side. You have about 3 hours left.
2025-01-24 20:52:32
Gang Avatar
Victim Avatar
Well, we trust you.
Payment will be made today. We are working on it.
2025-01-24 20:55:42
Ok, we are waiting.
2025-01-24 21:45:43
Gang Avatar
Victim Avatar
Ok, I\'m waiting for the dollar transaction to the wallet
2025-01-24 21:50:54
ok
2025-01-24 22:08:59
Gang Avatar
Victim Avatar
Done
2025-01-24 22:45:13
Victim Avatar
you need the id?
2025-01-24 22:46:24
Everything is fine. We have received your advance payment. We will wait for the rest of the money from you, Monday or Tuesday. $35,000.
2025-01-24 23:00:37
Gang Avatar
Victim Avatar
thanks
2025-01-24 23:01:22
Hello. We are expecting payment from you today, right?
2025-01-28 14:32:28
Gang Avatar
Victim Avatar
Good morning. Yes, I am waiting for the last loan I requested to be credited. I estimate that it will be resolved in 1 hour.
2025-01-28 14:50:16
Victim Avatar
Good afternoon. The bank tells me that the process has been accepted but the accreditation may take a while. In the meantime, I can transfer what I already have, which is 27,000.
2025-01-28 18:07:49
Victim Avatar
Hi, I already have the total. Should I send the 35,000 to the same wallet?
2025-01-28 19:27:59
Hello! Please wait, we will answer you soon
2025-01-28 20:10:03
Gang Avatar
Yes, that\'s right, you can send money to the same wallet.
2025-01-28 21:14:19
Gang Avatar
Victim Avatar
Payment has already been sent, it is pending
2025-01-28 21:37:13
Victim Avatar
The order was processed
2025-01-28 21:52:40
We confirm receipt of funds. We will soon give you the decryption keys for the files, in this chat. We are also ready to begin the process of deleting all your files and creating deletion logs for you. Please let us know if you need a full file tree before we begin the process of deleting files. You will also see all these files in the deletion logs.
2025-01-28 22:17:50
Gang Avatar
Victim Avatar
Ok, I need the MDF files with the decryption key.
I have to be away for a few minutes. How long will it take you?
2025-01-28 22:29:10
It may not be fast, it is already late today. It may be tomorrow. I cannot give a time frame yet.
2025-01-28 22:30:07
Gang Avatar
Victim Avatar
Ok, I\'ll be back in an hour too. If you have the key for later that would be great.
2025-01-28 22:31:56
2025-01-29 03:36:20
Gang Avatar
2025-01-29 03:36:27
Gang Avatar
Victim Avatar
Thank you, what is the procedure?
2025-01-29 04:59:01
The deletion process is in progress. Once completed, we will give you full logs of deleting all your files. Regarding the file decryption keys, have you figured it out yet?
2025-01-29 21:02:03
Gang Avatar
Victim Avatar
Yes, perfect. Thank you. I was able to recover the most important things. Could you give me some recommendations so that this doesn\'t happen again?
2025-01-30 02:05:24
Yes, of course, we will prepare it for you.
2025-01-30 13:11:25
Gang Avatar
Victim Avatar
Thank you.
Is there any way I can download the MDF files you have without encryption? The system provider tells me that they may be corrupted. Thank you.
2025-01-30 16:35:25
I not understand you
2025-01-30 21:45:25
Gang Avatar
We checked the file tree, unfortunately there are no mdf files among them. But our encryption does not damage files, check everything carefully.
2025-01-31 02:44:13
Gang Avatar
Hello
Your deletion files log:
2025-02-03 19:49:02
Gang Avatar
2025-02-03 19:49:08
Gang Avatar