0

My friend got infected by "Marlboro" Ransomware (description of the nasty thing: http://sensorstechforum.com/marlboro-ransomware-remove-restore-oops-files/).

I have researched online, and a way to clean the ransomware is to have a thorough scan with any Anti Malware software (I am currently doing that with Malware Bytes) and restore / decrypt the files. Since there were no restore points, hence no history, I have to use the decryptor.

I have found that Kaspersky has a list of usable programs, but I couldn't find the one matching the "Marlboro" ransomware: https://noransom.kaspersky.com/

Would any of these decryptors help me recover my files?

This one has this kind of encryption: RSA-2048 combined with AES-128.

5

You can use the decrypter available here:

https://decrypter.emsisoft.com/marlboro

I am the author of said tool. Yes, I did see the answer above. However, I can't comment because of lack of reputation. To address what has been said:

The decrypter doesn't need an internet connection or the infected machine. So feel free to run it in a VM with no internet access or disconnect the network cable. If for some reason it doesn't work, please let me know.

Also due to a bug inside the malware, it will truncate up to 7 bytes from the files. There is no way for me to restore those. So some files may not work, depending on how sensitive the file format is to having some bytes missing at the end.

Regarding our reputation:

The decrypter is EV signed. Meaning, we went through the extended verification of the CA so the identity of the company has been thoroughly verified. Whether you want to trust that, is up to you. We have released a tonne of decrypters (as can be seen on https://decrypter.emsisoft.com), cooperate with law enforcement agencies in the No More Ransom project, take part in various reputable AV comparison tests (AV Test, AV Comparatives) and are a Microsoft anti-virus partner.

If you run into any issues, feel free to let me know or shoot me a message :)

  • Thanks man for taking the time to answer and make this tool! :) I have one question - how can I make a pair of original and encrypted files for the decryptor? I have to have the one that is encrypted matching the original that is not encrypted? – Marko Jovanov Jan 12 '17 at 20:51
  • 1
    You don't make one, you have to have one. I am sure you will find at least one file where you can get the original. Maybe one of your downloads was encrypted (just download the file again) or a document that was shared or emailed so you can get it from your Sent Mails folder or even the sample pictures and default wallpapers shipping with Windows. I am sure you can find a file pair :) – Fabian Wosar Jan 12 '17 at 21:25
  • Yeah, we just managed to find one, thanks for the help once again! :) – Marko Jovanov Jan 12 '17 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.