1

This question already has an answer here:

A while back my computer was encrypted by the cryptolocker virus. I ended up taking an image of the encrypted drive and then formatting it and installing a new operating system. Since I have the encrypted drive and unencrypted copies of some of the files that were encrypted, is it possible for me to decrypt the drive by deducing the encryption keys?

I have searched online, and found that for a period of time there was a site to which you can upload a file and it could attempt to decrypt it and give you the key, but it has since been taken down. Is there any way to get a list of the recovered keys so that I could do this process myself?

Edit: It has been pointed out to me that this is basically a duplicate of another question about Cryptowall ransomware. I apologize for this duplication and would like to thank everyone who answered anyway.

marked as duplicate by WhiteWinterWolf, Neil Smithline, Bob Brown, Ohnana, LvB Jul 4 '16 at 8:08

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 2
    These days cryptolocker can mean one of several clones or copies, did you manage to identify exactly which version you were a victim of? The site you mention was taken down because they did not have the keys for the newer variants / imitators. – GreatSeaSpider Jul 1 '16 at 8:23
  • 1
    @WhiteWinterWolf That question is about Cryptowall, not Cryptolocker. It could be that Locker has some kind of weakness that Wall doesn't, so I think separate questions are legitimate. But I agree it's an edge case. – Anders Jul 1 '16 at 9:16
  • 1
    @Anders: Thanks, you're right :). For now yet, Kung's answer here seems to closely follow Polynomial's answer in the possible duplicate though (with a potential technical ambiguity whether the AES is generated on a per-infection or per-file basis) and the same link to FireEye website is mentioned. Nevertheless I fear that both will end-up with the same lack of solution... But's let's see! – WhiteWinterWolf Jul 1 '16 at 9:33
1

Most ransomware use strong encryption algorithms, which means that you will have a hard time trying to decrypt the encrypted files without the corresponding decryption key.

The malware uses an AES key to encrypt files. The AES key for decryption is written in the files encrypted by the malware. However, this key is encrypted with an RSA public key embedded in the malware, which means that a private key is needed to decrypt it.

Read more at: https://www.secureworks.com/research/cryptolocker-ransomware

  • Just to be clear, are you saying that this is how ransomware in general work, or how CryptoLocker in particular works? – Anders Jul 1 '16 at 8:24
  • 1
    Both, a ransomware using broken crypto seems kind of dumb. So any encrypted files by the ransomware will most likely stay encrypted, and a third party will have a hard time decrypting it without the corresponding key. A security firm found that this particular malware used AES + RSA. – kung Jul 1 '16 at 9:23
  • If you happens to have the source on that nearby it would be great if you could add it to your answer. If not, it's still a good answer. Thanks! – Anders Jul 1 '16 at 9:41
  • @kung Thank you for your answer. So what you are saying is if I could get the RSA key and factor into the private keys, I coud decrypt the AES key and decrypt the file? And yes, I know that would take a long time. – theJack Jul 1 '16 at 19:13
0

As an FYI, if it is Cryptowall and not a variant, you could use most "unerase" like tools to recover your data if you perform the unerase as soon as possible. (This does not apply to anything outside of Cryptowall). The good, bad, and ugliness of determining what you have lies in the methods that AV companies use in their naming conventions. Too often something labeled as X is actually Y and vice versa. So while you mention cryptowall, you may have a variant of it, meaning you could have had a particular version that may be able to have data recovered, or you could have a newer version that you may NOT be able to recover data. tl;dr version: "You may be able to recover data by doing on unerase"

Not the answer you're looking for? Browse other questions tagged or ask your own question.