Demonslay335

@jaffar Thank you, I was able to confirm the key works for your files with that ID. I have added it to the server for the .rote extension. You may simply re-run the decryptor, and it should be able to decrypt some of your files now.

The FAQ already explains this...

No. Dharma is not decryptable without the private RSA key only the criminals possess. Restore from backups and stop exposing RDP to the web.

They are the exact same malware, just different names; the only thing that changed was the extension. The reason we are able to decrypt MegaLocker at all is because we acquired keys from the criminal's servers. Period. They then changed servers and locked it down better, and continued attacking victims. We do not have keys for victims encrypted after that date, as only the criminals have those keys. The crypto itself is otherwise secure and cannot be broken any other way without the keys.

As the FAQ and all you've read will already tell you, there is nothing we can do. It is impossible to decrypt, as only the criminals have your private RSA key that is unique to your files. Period. This ransomware is exclusively spread via pirated programs, so...

The encrypted files themselves are not infectious or anything. It's always recommended to archive encrypted files in that case in hopes of something changing in the future; unfortunately with STOP Djvu and the new variants with online keys, your only chance will be if the criminals are caught and their private RSA keys seized by law enforcement.

No. If your files were encrypted by an online key, then only the criminals have your key.

@abdi Read the FAQ... it is impossible to decrypt. Period.

The files that were decrypted would have been encrypted by the offline ID... as explained in the FAQ, the malware sometimes encrypts some files with an online key, and others with an offline key. Those 3 files just got lucky. The decryptor would not show the ID if it decrypted them; only if it could not decrypt the files.

Are you sure the file pair you are providing is good? It has to be the exact same file before and after the encryption. Any modifications between that and when it was encrypted would result in a bad pair. You can zip the files together and post them here if the forum allows (use a third-party sharing site if it doesn't), and I can take a look.

We will need the malware executable that encrypted the files in order to update our decryptor.

TXT files will not be possible with this method. The keystream generation depends on the first 5 bytes of the file - TXT files do not have a "standard", and thus will likely never have the same 5 bytes. Unless every single TXT file you have started with the same first word or two by chance...

Some extensions they re-use the same offline ID and corresponding key. In this case, .bboo, .ooss, and .mool all have the same offline ID.