Kestukas

yeah, my is exactly same encrypotion with same ending, when i logged in tor network on my id it said nemesis encryption id_2809157423_fgb45ft3pqamyji7.onion

yes, seems it is hard to decrypt this one, as at start i wanted to look for encryption because thys encryption virus crypting only 36bytes of file, so other parts of files is recoverable, and posted info how people can try recovering data if they have large files, but EMSI denied my post saying this is harmfull , and need to wait for emsisoft to make an decryptos , so we wait now :)) because i have no will to do it myself , while i get punch in a head trying to help.

On 2017-05-17 at 4:53 PM, Frank chen said:

Can we know how the progress of cry128 36b variant decrypter is now? I am about to graduate in 1 month and all my matlab code is encrypted. I am not sure if I should pay or wait for you guys to save me. @Kevin Zoll  May god bless u 

share your mathlab file here, we can try look into it

9 hours ago, NnitehawkK-fb said:

http://borncity.com/win/2017/05/25/wannacry-co-eternalblue-vulnerability-checker-und-crysis-ransomware-decryptor/

 

anyone wanna try this?

 

not work

Hello forum,

i can confirm that cry36 is not so harmfull as few ransomware before,

if your files is  super important, it can be fixed by having some knowlage, remove some bytes form back of file, and try to use 10kb of file in start of file (can confirm that it encrypt only 10kb of file in start) so basically if your data files is databases ,some big xls/doc , Theorically its possible to recreate it by using analogues

p.s. need more analysis but seems first and last lines of encrypted files is same (so easy to determinate encryption type)

Seems best is to wait than.... hard really to learn all cryptography