Can I decrypt files encrypted by Odin ransomware?

Question

My system, excel, rar and zip files are encrypted by Odin ransomware and my ethics never allow me to pay ransom to thieves.

1. I tried recovery softwares but only recovered old deleted files - no solution to encrypted file.
2. Restore points are also deleted by ransomeware and I have no system image to recover system restore points.
3. I tried to create a decryption key but language in encryption is a mixture of Korean, Japnees & Chinees. So I failed to create a decryption key.
4. Another solution is to wait for any antivirus organization to find a solution and provide decryption to Odin but I am not sure when that solution will be in the market.

Is there any solution to decrypt or recover my files?

Answer 1

You won't be able to get your files back by any trivial means, sadly. You may be able to remove the ransomware itself, but you will not be able to retrieve your files without paying the ransom, for now, regardless of the language it was written in. The method used to encrypt these files makes them effectively useless unless you have the private keys, which they definitely won't give you, and you definitely won't guess. For anyone who is curious, Odin uses RSA-2048 bit and AES-128 bit ciphers.

Eventually, as you mentioned, there may be some sort of decryption tool for this strain of ransomware. Companies like Kaspersky and Sophos have already released tools for older varieties of ransomware. But until the time when a tool exists for this version of Odin specifically, you do not have many options.

Cold storage/offline backups are the best method for dealing with ransomware right now after the fact. Not to kick you while you're down, but avoiding malicious links, untrusted websites and downloads is the best way to avoid ransomware. Although I'm sure you've learned this lesson by now.

If you are on windows you could always try something like ShadowExplorer, you may have file backups you weren't aware of (hopefully).

The long and short of it is, your files are stuck in limbo until you pay for the decryption key, magically locate backups, or a method for decrypting this strain of ransomware becomes available, if it ever becomes available.

Answer 2

https://www.nomoreransom.org/index.html

This is from Dutch Police and Europol, try them and hope you can recover your files.

Answer 3

First of all you need to be sure what virus you have and it's version. Go to - id-ransomware.malwarehunterteam.com and upload your files.

Once you have an answer, go to Bleeping Computer forum's section dedicated to your specific ransomware - http://www.bleepingcomputer.com/forums/f/239/ransomware-help-tech-support/

There are a lot of malware experts that are on the edge of recent ransomware news.

If decryptor is available - they will help you (free of charge) If decryptor is not available - you just have to wait and be sure - they will notify you of the progress.

There are lot of sites with removal guides like - http://myspybot.com/odin-virus/ they often promise gerat results but those tips don't work.

There are even cases when solid tech support companies that say they can help with ransomware - they charge you 1000 usd for help and go pay 500 usd to hackers for decrypting files and then have 500 in profit :)

Answer 4

You CAN try several methods to recover your files without paying a ransom. The first one is related to Windows Previous Versions feature that allows recovering separate files. However, this thing works only if you had System Restore activated on your computer. Next, you can use Shadow Explorer that recovers files with the help of volume shadow copies or Data Recovery Pro that is the paid one but will cost you 20 euros or less. All these options are clearly explained in this guide: http://www.2-spyware.com/remove-odin-ransomware-virus.html If you decide to use any of them, make sure you follow every step in an exact order!!