// Context
About This Negotiation
This transcript documents a trinity ransomware negotiation with 0003.
The negotiation consisted of 298 messages exchanged over Unknown.
The initial ransom demand was $2,000. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[0003] — — Message 1/298
hello
[0003] — — Message 2/298
hello
[0003] — — Message 3/298
hello
[trinity] — — Message 4/298
hello
[0003] — — Message 5/298
how do i get key?
[trinity] — — Message 6/298
you need to pay the
ransom in bitcoins to a wallet
[redacted] amount 0.7 bitcoin after
payment you will receive the decryption program
[0003] — — Message 7/298
Sir, respectfully, that is like $50000 dollars. I barely have money to feed my kids.
[trinity] — — Message 8/298
0.7 btc = 33000$
[0003] — — Message 9/298
That is still a very large sum. I can offer $2000 dollars 0.04btc
[trinity] — — Message 10/298
if you're willing to pay, we can bargain.
[trinity] — — Message 11/298
$2,000 is very little
[0003] — — Message 12/298
Sir I am not microsoft or visa. I'm one person working hard to feed my family
[trinity] — — Message 13/298
Okay, we're in a good mood. And we'll settle for a minimum of $12,000. Don't ask for less, respect our labor.
[0003] — — Message 14/298
I do not have that much money sir.
[trinity] — — Message 15/298
Pino, offer a sum, but not $2,000.
[trinity] — — Message 16/298
[0003] — — Message 17/298
Okay I can offer $2500
[trinity] — — Message 18/298
it's a very small amount
[0003] — — Message 19/298
It is all I have. As I said, I am one person trying to feed my family
[trinity] — — Message 20/298
$5,000 last offer from us
[0003] — — Message 21/298
ok how much is that in bitcoin?
[trinity] — — Message 22/298
0.12 bitcoin
[0003] — — Message 23/298
Ok. I have to buy that much. Please wait.
[trinity] — — Message 24/298
ok
[0003] — — Message 25/298
Ok. my son is buying now.
[trinity] — — Message 26/298
ok
[0003] — — Message 27/298
ction
[0003] — — Message 28/298
Please can you send me proof that I will be ok after transaction? what if you take my money and run away?
[trinity] — — Message 29/298
yes send 1 encrypted file not more than 2 mb we will make a free decryption for proof.
[trinity] — — Message 30/298
[REDACTED URL]
[0003] — — Message 31/298
How do I send?
[trinity] — — Message 32/298
upload it here
[trinity] — — Message 33/298
[REDACTED URL]
[0003] — — Message 34/298
Not working.
[0003] — — Message 35/298
[trinity] — — Message 36/298
[REDACTED URL]
[trinity] — — Message 37/298
try
[0003] — — Message 38/298
Its saying file not found
[0003] — — Message 39/298
Can you please send me a decrypted file? Is that possible?
[trinity] — — Message 40/298
send us the file and we'll decrypt it.
[0003] — — Message 41/298
It wont let me. Please send me from your side.
[trinity] — — Message 42/298
sendspace.com
[trinity] — — Message 43/298
try
[trinity] — — Message 44/298
[REDACTED URL]
[0003] — — Message 45/298
What email address?
[trinity] — — Message 46/298
[redacted]@onionmail.org
[0003] — — Message 47/298
file upload error on sendspace trying the next one
[trinity] — — Message 48/298
send the file to the e-mail above
[0003] — — Message 49/298
[0003] — — Message 50/298
dll error on filetransfer.io
[0003] — — Message 51/298
my pc is not working right. can you please upload from your side? please? Im desperate
[trinity] — — Message 52/298
We need you to send
us a file and we will do a test, how big do you send the file? Try to
send it to us by e-mail or put the file in an archive and send it
through exchangers.
[0003] — — Message 53/298
It is small pdf.
[trinity] — — Message 54/298
or give me access to your computer
[trinity] — — Message 55/298
[redacted]:4000;[redacted]\[redacted]
[0003] — — Message 56/298
my pc isn't working right. all files has 2023lock
[0003] — — Message 57/298
please send me clean file from your side. that will be proof enough from me
[trinity] — — Message 58/298
delete 2023lock from the filename and try to upload it to a file-sharing service or zip it.
[trinity] — — Message 59/298
for us to send you a file you have to send it to us first.
[trinity] — — Message 60/298
we value our reputation, we won't cheat.
[0003] — — Message 61/298
Not working. I cannot do anything on this pc.
[0003] — — Message 62/298
You have my files you said. Please upload to me
[trinity] — — Message 63/298
then pay up and take my word for it we will send you the program with a link, you just need to run it and wait for it
[0003] — — Message 64/298
Can you not just upload 1 file? Please? 1 file will not hurt you? I have thousands of files locked
[trinity] — — Message 65/298
since you're not a company we didn't upload your files We only upload company files
[trinity] — — Message 66/298
we will give you a test if you upload us the file for the test.
[0003] — — Message 67/298
but my pc is broken, i cannot upload
[trinity] — — Message 68/298
download google browser and install it. download through it, tor browser can cause errors.
[trinity] — — Message 69/298
and upload the file to us through the file exchanges we provided above.
[0003] — — Message 70/298
install fails
[0003] — — Message 71/298
says not recognised application
[trinity] — — Message 72/298
[REDACTED URL]
[trinity] — — Message 73/298
[REDACTED URL]
[trinity] — — Message 74/298
[REDACTED URL]
[trinity] — — Message 75/298
how did you download the tor browser?
[trinity] — — Message 76/298
through the iexlorer?
[0003] — — Message 77/298
yes
[trinity] — — Message 78/298
[REDACTED URL]
[trinity] — — Message 79/298
download and run you give us remote access and we'll do a test.
[trinity] — — Message 80/298
[REDACTED URL]
[0003] — — Message 81/298
says application not 32bit
[trinity] — — Message 82/298
download anydesk and give us an ID
[0003] — — Message 83/298
ok
[trinity] — — Message 84/298
[0003] — — Message 85/298
failed to launch dll
[0003] — — Message 86/298
[redacted]:4000;[redacted]\[redacted]
[0003] — — Message 87/298
what is this above?
[trinity] — — Message 88/298
Are you kidding us? This is access to your computer.
[0003] — — Message 89/298
yes the anydesk says dll error
[0003] — — Message 90/298
but what is 99.247? what does that do?
[trinity] — — Message 91/298
for us to do the test, you need to upload the file to us. e-mail
[trinity] — — Message 92/298
rdp access
[0003] — — Message 93/298
what is rdp access? what is all this....?[redacted]?
[trinity] — — Message 94/298
[REDACTED URL]
[trinity] — — Message 95/298
download run
[0003] — — Message 96/298
cannot run
[trinity] — — Message 97/298
you're the owner of the computer? or are you playing a joke on us?
[trinity] — — Message 98/298
you're asking the strangest questions
[0003] — — Message 99/298
[0003] — — Message 100/298
yes i own the computer
[0003] — — Message 101/298
im not joking
[0003] — — Message 102/298
my life is in your hands
[0003] — — Message 103/298
i'm trying everything you tell me
[0003] — — Message 104/298
Im such a loser
[0003] — — Message 105/298
my wife will leave me. she will take my children
[trinity] — — Message 106/298
for the test, send the file to us by e-mail or pay on your word and we will give you a decryption program.
[0003] — — Message 107/298
i will pay. my son is getting btc
[0003] — — Message 108/298
i need your help please.
[0003] — — Message 109/298
how do i stop being hacked?
[trinity] — — Message 110/298
run iexlorer
[trinity] — — Message 111/298
use [REDACTED URL] helper: [REDACTED URL] helper: [REDACTED URL]
[0003] — — Message 112/298
iexlorer not found
[trinity] — — Message 113/298
like this you said
you downloaded tor You're kidding. this conversation will now be over
and the price will return to 0.7 bitcoin.
[0003] — — Message 114/298
do you mean internet explorer?
[0003] — — Message 115/298
i can start that
[trinity] — — Message 116/298
if you downloaded the tor you should be good to go.
[0003] — — Message 117/298
ok but it wont let me upload
[trinity] — — Message 118/298
for the test we are
waiting for the file, the price of 0.12 btc will be valid during the
day. you can send the file in the ways described above
[0003] — — Message 119/298
Ok. i will try.
[trinity] — — Message 120/298
send email
[0003] — — Message 121/298
[0003] — — Message 122/298
what does during the day mean?
[0003] — — Message 123/298
how many hours?
[0003] — — Message 124/298
what time?
[trinity] — — Message 125/298
if you don't pay today. tomorrow we will refund the original price of 0.7 bitcoin.
[trinity] — — Message 126/298
24 hours
[0003] — — Message 127/298
ok but what does today mean? what time? since i think you might be in another country
[trinity] — — Message 128/298
24 hours
[0003] — — Message 129/298
can you give me 48? I
might be able to get a little more bitcoin. I need you to help me stop
being hacked. I will pay extra for that
[trinity] — — Message 130/298
we said it all,you
have 24 hours to pay 0.12 bitcoin,after that time the price will be 0.7
bitcoin,after payment we will give you a couple of cyber security tips
[trinity] — — Message 131/298
If you don't pay, we'll delete your encryption keys and you'll never get your files back.
[0003] — — Message 132/298
Ok. I can understand you cant upload files. Can you show me how you got the 99.247 thing please?
[trinity] — — Message 133/298
you can't download the file for the test, all questions after payment.
[0003] — — Message 134/298
As a show of good faith please? you have the upper hand. I am sunk without these files
[trinity] — — Message 135/298
pay, and you'll have all the answers.
[0003] — — Message 136/298
ok please wait
[trinity] — — Message 137/298
ok
[0003] — — Message 138/298
josi
[trinity] — — Message 139/298
?
[0003] — — Message 140/298
Ok 0.12 bitcoin is sent
[trinity] — — Message 141/298
we can't see your payment.
[trinity] — — Message 142/298
[REDACTED URL]
[0003] — — Message 143/298
my son sent it to this address [redacted]
[trinity] — — Message 144/298
[REDACTED URL]
[trinity] — — Message 145/298
blockchain open network 0 bitcoin on our wallet
[0003] — — Message 146/298
Please check again. We sent it
[trinity] — — Message 147/298
[REDACTED URL]
[trinity] — — Message 148/298
you can see for yourself
[0003] — — Message 149/298
i dont know what this means. please i paid you now help me
[trinity] — — Message 150/298
Anyway, when you're done making jokes, text me.
[trinity] — — Message 151/298
you haven't paid anything and pissed us off the price is back to 0.7 bitcoin
[0003] — — Message 152/298
im not joking please.
[trinity] — — Message 153/298
you haven't paid anything and pissed us off the price is back to 0.7 bitcoin
[trinity] — — Message 154/298
don't distract us from our work, pay up or goodbye.
[0003] — — Message 155/298
Sir please. this is not funny
[0003] — — Message 156/298
Hello
[0003] — — Message 157/298
Ok I have a better
offer. I know of a way to make $15750 US dollars every 12 hours. I
cannot do it as I would be caught. You look like you have skills.
[trinity] — — Message 158/298
the dialog will continue after payment
[trinity] — — Message 159/298
dialog is over
[0003] — — Message 160/298
[0003] — — Message 161/298
You will make more in 1 week.
[0003] — — Message 162/298
than .7btc
[0003] — — Message 163/298
easy money
[trinity] — — Message 164/298
We're not interested. we make millions of dollars dialog is over
[0003] — — Message 165/298
then why is your btc address empty?
[trinity] — — Message 166/298
because you didn't send the money there.)
[trinity] — — Message 167/298
[0003] — — Message 168/298
But if you have millions shouldn't there be some btc there
[0003] — — Message 169/298
But if you have millions shouldn't there be some btc there
[trinity] — — Message 170/298
we keep everything in a different wallet [REDACTED URL]
[0003] — — Message 171/298
You know that's a random address you found online. This your first scam?
[trinity] — — Message 172/298
this is our address
[0003] — — Message 173/298
[REDACTED URL]
[trinity] — — Message 174/298
?
[trinity] — — Message 175/298
I love talking to people like you.)
[0003] — — Message 176/298
you love causing grief? what would your mother think?
[trinity] — — Message 177/298
what's your name? agent smith?
[trinity] — — Message 178/298
you've lifted our spirits.
[trinity] — — Message 179/298
I don't have a mother. I'm from an orphanage.
[0003] — — Message 180/298
im not as cool as agent smith
[0003] — — Message 181/298
im sorry to hear that.
[0003] — — Message 182/298
are all of you from an orphanage?
[trinity] — — Message 183/298
Yes, from India, sir.
[0003] — — Message 184/298
From India? I don't believe you. You are too polite to be Indian
[trinity] — — Message 185/298
I like Canadian law enforcement, but fbi is more interesting, no offense.
[0003] — — Message 186/298
They both suck. They are only for the rich
[trinity] — — Message 187/298
Every nation has good people and bad people.
[0003] — — Message 188/298
Most people are good. Most elite suck
[trinity] — — Message 189/298
Elon Musk? Sucks?
[0003] — — Message 190/298
He has billions. He could singlehandedly fix most of society's problems but he is greedy.
[0003] — — Message 191/298
I work day and night for my children
[trinity] — — Message 192/298
he's my friend.
[0003] — — Message 193/298
He is no one's friend
[trinity] — — Message 194/298
and we don't have kids. We're kids ourselves. We're 18 years old.
[trinity] — — Message 195/298
our friend
[0003] — — Message 196/298
My son is 17. I see no future for him
[0003] — — Message 197/298
And now you have taken away even a small bit of hope.
[trinity] — — Message 198/298
put him in hacker school.
[trinity] — — Message 199/298
how we robbed him of his future?
[0003] — — Message 200/298
You took my work. I will lose the very little I have. How will I send him to any school?
[trinity] — — Message 201/298
you can pay and get the data back.
[0003] — — Message 202/298
I already sent .12 btc I know you were just scamming me
[0003] — — Message 203/298
That money was for my son's medical bills
[0003] — — Message 204/298
He said, it's ok papa i will send it
[trinity] — — Message 205/298
you can look it up yourself on the blockchain You didn't send us anything.
[trinity] — — Message 206/298
but he didn't send it
[0003] — — Message 207/298
ou
[0003] — — Message 208/298
i have no reason to lie to you
[0003] — — Message 209/298
you have every reason to lie to me
[0003] — — Message 210/298
i don't have anymore money. what do I do now?
[0003] — — Message 211/298
no money, broken computer.
[0003] — — Message 212/298
sick son
[0003] — — Message 213/298
tell me where is the positive?
[0003] — — Message 214/298
tell me where is the positive?
[0003] — — Message 215/298
i should just end it
[trinity] — — Message 216/298
[0003] — — Message 217/298
it would be easy
[trinity] — — Message 218/298
you've already proven you can look at wallet balances. and you say it's empty) where is 0.12 btc where is the logic?
[0003] — — Message 219/298
i'm distraught. i dont have logic anymore
[0003] — — Message 220/298
i hope it was worth it to you
[0003] — — Message 221/298
destroying a poor man's life
[trinity] — — Message 222/298
you can pay and be done with it.)
[0003] — — Message 223/298
i already did.
[0003] — — Message 224/298
i keep telling you this and you don't believe me
[trinity] — — Message 225/298
everyone has a job to do. and $5,000 is not money in Canada.
[0003] — — Message 226/298
$5000 is not money? You are joking.
[trinity] — — Message 227/298
the balance of the wallet we created for you is 0 bitcoins.
[0003] — — Message 228/298
well you have millions as you say
[0003] — — Message 229/298
ok so where did the .12 go then?
[0003] — — Message 230/298
It takes me 6 weeks to make 5000
[0003] — — Message 231/298
and the goverment takes a lot taxes
[trinity] — — Message 232/298
Well, it's not bad. We've been studying for years, too.
[0003] — — Message 233/298
You are 18. you have no responsibilities
[0003] — — Message 234/298
I have kids
[0003] — — Message 235/298
You can just help me please?
[trinity] — — Message 236/298
we've been learning to hack since we were 12 years old.
[0003] — — Message 237/298
ok why don't you hack the big banks then?
[trinity] — — Message 238/298
Respect our labor, we made you an extremely low price of 5000$ pay and get all the files back.
[0003] — — Message 239/298
I did
[0003] — — Message 240/298
I did
[0003] — — Message 241/298
I did
[trinity] — — Message 242/298
We break everything in a row, and you're an accident, so the price is $5,000.
[trinity] — — Message 243/298
[REDACTED URL]
[0003] — — Message 244/298
how am i an accident?
[0003] — — Message 245/298
can you explain please?
[0003] — — Message 246/298
and i paid more than 5000 for that btc
[trinity] — — Message 247/298
It doesn't look like you transferred bitcoin.
[0003] — — Message 248/298
I dont know what my son did. He took the last of our money to send it and now i have nothing?
[trinity] — — Message 249/298
Consider this a cyber literacy lesson for you. for only $5,000
[0003] — — Message 250/298
[0003] — — Message 251/298
please take pity on me and help me
[trinity] — — Message 252/298
so ask your son
[trinity] — — Message 253/298
respect our work
[0003] — — Message 254/298
I dont have 5000 more
[trinity] — — Message 255/298
pay us.
[0003] — — Message 256/298
you were paid
[trinity] — — Message 257/298
we're not asking for more We only want 5,000.
[trinity] — — Message 258/298
we didn't get paid.
[0003] — — Message 259/298
[trinity] — — Message 260/298
[REDACTED URL]
[0003] — — Message 261/298
You got paid now you want more
[0003] — — Message 262/298
You are just greedy
[0003] — — Message 263/298
taking from the poor
[0003] — — Message 264/298
you cant hack banks?
[trinity] — — Message 265/298
[REDACTED URL] 0 bitcoin
[trinity] — — Message 266/298
we hack a lot of things)
[0003] — — Message 267/298
so why me
[trinity] — — Message 268/298
that you'd pay us 5,000 for ice cream.
[0003] — — Message 269/298
please. no jokes
[0003] — — Message 270/298
you have enough money. just help me out please
[trinity] — — Message 271/298
pay and we'll help you. Once again, we say respect our work.
[0003] — — Message 272/298
You have enough to give me a pass. I just want my files back. 5000 to you is peanuts. 5000 to me is life chaning
[trinity] — — Message 273/298
then why are you playing dumb?
[trinity] — — Message 274/298
5,000 and you'll get it all back.
[0003] — — Message 275/298
give it all back and I send you another 4000
[0003] — — Message 276/298
you already have 5000
[trinity] — — Message 277/298
it's a lie show us the money in our wallet balance.
[trinity] — — Message 278/298
[trinity] — — Message 279/298
[REDACTED URL]
[0003] — — Message 280/298
this is what you do to make money
[0003] — — Message 281/298
who has lying reputation
[0003] — — Message 282/298
me or you
[trinity] — — Message 283/298
we have a crystal clear reputation, if we get paid we always return the data to the client
[0003] — — Message 284/298
where is this reputation? show me please
[0003] — — Message 285/298
well i can't say it's been nice chatting with you. have a nice life
[trinity] — — Message 286/298
can you find a
single mention on the Internet that we screwed anyone over. and didn't
return the data after payment You won't find
[trinity] — — Message 287/298
if you think about paying, come back and we'll return the data. have a nice day
[0003] — — Message 288/298
i paid already and you have no reputation
[0003] — — Message 289/298
you ruined my life for some money
[0003] — — Message 290/298
i hope your god can forgive you cuz i wont
[trinity] — — Message 291/298
Show me your wallet where you paid? What are you playing dumb for?
[trinity] — — Message 292/298
I'll let you in on a little secret, there is no God.
[0003] — — Message 293/298
He will smite you
[0003] — — Message 294/298
trc comp load mtdata
[trinity] — — Message 295/298
We're all going to
die someday. Some sooner, some later. If you want your data back, pay
us. We won't delete your key. You made us smile
[0003] — — Message 296/298
There more to this than meets the eye
[0003] — — Message 297/298
Good luck :)
[trinity] — — Message 298/298
u2