Solved

Crypto wall tools to try and brute force decryption

Posted on 2014-11-17
6
1,599 Views
Last Modified: 2014-12-02
Ok have a friend who's pics have been encrypted by crypto wall. Anyone know of a utility I can run on the files to try brute force decryption? I am attempting a disk recovery hoping the original felted files may still be on the drive somewhere!
0
Comment
Question by:georgopanos
  • 2
  • 2
  • 2
6 Comments
 
LVL 61

Expert Comment

by:btan
ID: 40447343
Quite a guide information update in BleedingComputer worth checking out for recovery that may help but do verify that the file are indeed encrypted.  Actually brute forcing the decryption key is not pragmatic as strong crypto key is already employed. Do assess if recovery is possible and not succumb to payment ... but if data are indeed lost the only practical means to get back is the ransom which i do discourage as the attacker may play foul too...it is catch-22

http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information

Just for info, in the case for Cryptolocker early genre, there is online service (e.g. FireEye shared the online mechanism) though it is not warrant to decrypt all as they have only limited decryption key archived from their research..
0
 

Author Comment

by:georgopanos
ID: 40447907
I already uploaded the file to Fireeye and it is not a file done by cryptolocker. It is done by Cryptowall. So they cannot do anything! They don';t have a backup and Shadow was not enabled.

I was hoping there would be a tool to at least let it run for a few days a give it a shot to try and decrypt. If there is anything let me know so I can give it a try,
0
 
LVL 53

Expert Comment

by:McKnife
ID: 40448319
Unless you think the encryption is faked, it is useless to try it. The key in use is too strong to be brute-forced in reasonable time.
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 

Author Comment

by:georgopanos
ID: 40448529
Ok, I understand that may be so, but as a learning experience can you humor me and point me in a direction for what tool I could use to attempt it! I would greatly appreciate it! The data is not needed tomorrow so this is a learning experience!
0
 
LVL 53

Accepted Solution

by:
McKnife earned 250 total points
ID: 40448548
You cannot use a generic tool but you would have to Google for a reverse engineered version of their Virus (which is not only an encryptor but a decryptor). I am not sure such a thing even exists.
0
 
LVL 61

Assisted Solution

by:btan
btan earned 250 total points
ID: 40448791
no open tool to break RSA keys, you need great horsepower which for learning is not worth and none (except researcher) has ventured into that. The online service from security folks also is not really doing the brute forcing except they are trying out with a bunch of key list they gotten. there are other brute force tools like hashcat and like but they are based on dictionary or even some using rainbow table. But all these is out of the Cryptowall context.
0

Featured Post

Complete Microsoft Windows PC® & Mac Backup

Backup and recovery solutions to protect all your PCs & Mac– on-premises or in remote locations. Acronis backs up entire PC or Mac with patented reliable disk imaging technology and you will be able to restore workstations to a new, dissimilar hardware in minutes.

Join & Write a Comment

Many companies are looking to get out of the datacenter business and to services like Microsoft Azure to provide Infrastructure as a Service (IaaS) solutions for legacy client server workloads, rather than continuing to make capital investments in h…
If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…
Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now