ODCODC Ransomware (.odcodc) It is decryptable

safety

BloodDolly после успеха по TeslaCrypt выполнил новую работу по расшифровке ODCODC Ransomware.

ODCODC Decoder 0.0.1
http://download.bleepingcomputer.com/BloodDolly/ODCODCDecoder.zip

If you are a victim of ODCODC Ransomware the pair of encrypted/original file from each infected drive is needed or encrypted doc, xls, ppt (not docx, xlsx, pptx) from each infected drive if the key was downloaded from the server. (Your ID doesn't contain X, for example PC ID:: COMPUTER1416156778)


The encrypted files look like %drive%-email-%email_address%-<original name>.odcodc.

=========================================================================================

ODCODC Decoder - 0.0.1
Custom priviledges: 1
Admininsrator's rights: 1
Debug mode: 0
Key version:

Decryption started.

---

DECRYPTED: E:\deshifr\encode_files\XOR\ODCODC\1\doc\15092014 16_55_03.xls
DECRYPTED: E:\deshifr\encode_files\XOR\ODCODC\1\doc\inf.txt
DECRYPTED: E:\deshifr\encode_files\XOR\ODCODC\1\doc\keygpg.rar
DECRYPTED: E:\deshifr\encode_files\XOR\ODCODC\1\doc\readme.txt
DECRYPTED: E:\deshifr\encode_files\XOR\ODCODC\1\doc\акт.pdf
DECRYPTED: E:\deshifr\encode_files\XOR\ODCODC\1\doc\Концепт uvs.txt
DECRYPTED: E:\deshifr\encode_files\XOR\ODCODC\1\doc\Правила поведения вахтеров.jpg
DECRYPTED: E:\deshifr\encode_files\XOR\ODCODC\1\uvs_doc\AHCI.txt
DECRYPTED: E:\deshifr\encode_files\XOR\ODCODC\1\uvs_doc\WhatsNew.txt
.....
Decryption finished. (25 files decrypted, 0 files skipped, 0 warnings)

safety

Looks like odcodc ransomware is being spread again. New samples from 17th. Uses HOW_TO_RESTORE_FILES.txt and .odcodc.

https://twitter.com/PolarToffee/status/813762510302183424

safety

BloodDolly обновил дешифратор, добавил функцию расшифровки ODCODC v2

******************
* ODCODC Decoder *
******************
=========
= 0.1.0 =
=========
- Added support for new version (version 2) of encrypted files

==========================================================================================

ODCODC Decoder - 0.1.0
Custom priviledges: 1
Admininstrator's rights: 1
Debug mode: 0

Decryption started.

---

DECRYPTED: E:\deshifr\encode_files\ODCODC\v2\1\DOC\CapturaHaberesDiarios.doc
DECRYPTED: E:\deshifr\encode_files\ODCODC\v2\1\DOC\CapturaTrabajadoresDiarios.doc
DECRYPTED: E:\deshifr\encode_files\ODCODC\v2\1\DOC\TrasCont.DOC
DECRYPTED: E:\deshifr\encode_files\ODCODC\v2\1\DOC\TrasHist.DOC
DECRYPTED: E:\deshifr\encode_files\ODCODC\v2\1\DOC\TRASPASO.TXT

Decryption finished. (5 files decrypted, 0 files skipped, 0 warnings)