0

I received a decrypted file back from the hacker as proof that he could decrypt my files affected by his DjVU ransomware. Is it possible to find out which key he used to decrypt the encrypted file?

3

1 Answer 1

1

No.

Imagine you have a text file with some content M. The attacker then encrypts M with a key K, resulting in an encrypted file C.

By sending you back M, they don't directly prove that they have K, but since M is really what you are after anyways, that's alright.

The reason why it's not possible to tell anything about K is because M was created before K even existed. As such, it cannot possibly contain any information about K.

What you can do now

If you have a backup

Completely nuke your PC, re-install your OS from scratch and load your data from your backup. It might take a while, but it's better than paying ransom.

If you don't have a backup

The site No More Ransom might be able to help identify whether or not the particular ransomware used has flaws that can help recover the encryption key.

If you're lucky, then make a backup of your data now and then re-install your OS. That ransomware could have left behind some backdoors for future infections. Since you already paid once, you might pay again.

If you're not lucky, either pay the ransom or live with the fact that your data is gone. And even if you pay, you might be out of luck. Let that be a lesson to you to make proper backups.

2
  • Yeah, some of the ransom is purely written that it can't decrypt the data even if you have a key, but it is not like you can ask for refund.
    – nethero
    Oct 27, 2020 at 20:34
  • If the attacker demonstrates they can decrypt arbitrary files, then it should be fine.
    – user163495
    Oct 28, 2020 at 10:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .