- Members239
- DrDamnit (DrDamnit)
- Created2014-11-12
- AccessPublic
- TypeTechnology
Location
- Atlanta,
- GA,
- United States
Top Contributors
Cryptographic ransomware
I am writing an article on ransomware such as crtolocker/cryptowall/CTB-
I will, of course, credit any input I receive.
I will, of course, credit any input I receive.
Rank: Savant
Expert Comment
thought this may be of interest as well though it can be "noisy" and very manual, the thoughts of monitoring the handle counts may help
http://digital-forensics.sans.org/blog/2015/04/03/identifying-and-disrupting-crypto-ransomware-and-destructive-malware
http://digital-forensics.sans.org/blog/2015/04/03/identifying-and-disrupting-crypto-ransomware-and-destructive-malware
Rank: Savant
Expert Comment
To further share talos released a tool for Teslacrypt ransomware
The Talos TeslaCrypt Decryption Toolhttp://blogs.cisco.com/security/talos/teslacrypt
Our decryption utility is a command line utility. It needs the “key.dat” file to properly recover the master key used for file encryption. Before it begins execution, it searches for “key.dat” in its original location (the user’s Application Data directory), or in the current directory. If it isn’t able to find and correctly parse the “key.dat” file, it will return an error and exit.
Rank: Savant
Expert Comment
recent compilation that is handy
a helpful "Ransomware Removal Kit" which contains decryption tools for CryptoLocker, CoinVault, TeslaCrypt and FBIRansomWare, along with instructions on how to use themhttps://bitbucket.org/jadacyrus/ransomwareremovalkit/src/8adea2b03cd0?at=master
Rank: Savant
Expert Comment
one "repentant" ransomware whom posted (http://pastebin.com/1WZGqrUH) the private keys used by "locker". a tool called unlocker is available
This Decrypter version will only work for victims who know their BitCoin Address that the infection gave them. A update will be coming soon which will allow victims without this address to decrypt their files. Please be patient.http://www.bleepingcomputer.com/forums/t/577246/locker-ransomware-support-topic/page-32#entry3721545
Expert Comment