Todor 0 Posted May 2, 2016 Report Share Posted May 2, 2016 Hello, I have a problem with decrypting my files, they all have .crypt extension. I tried some decrypters, but didn't have luck with them. All of them didn't find a key.In every folder with decrypted files I have a de_crypt_readme.bmp saying that the files are encrypted with keys usind RSA4096. I attached you an encrypted file. I'm trying to decrypt my files from weeks and still nothing. I'm hoping that you can help.I tried to attach a detected file, but an error says that i'm not permitted to upload this kind of file. Thanks in advance. Link to post Share on other sites
Elise 277 Posted May 3, 2016 Report Share Posted May 3, 2016 Hello Todor, I'm sorry to hear about this. To confirm what ransomware variant you are dealing with, can you let me know what the content of the ransom notes is and how the name of the encrypted files looks. Link to post Share on other sites
Todor 0 Posted May 3, 2016 Author Report Share Posted May 3, 2016 Hello again, all the files have *.crypt extension after the original one. Example: filename.docx.crypt /it's the same with .jpg, .png, .xls, .pdf, .ppt/This is the readme file: de_crypt_readme.bmp Link to post Share on other sites
Elise 277 Posted May 3, 2016 Report Share Posted May 3, 2016 Hi, Good news, looks like there is a decrypter for this variant, please see here for more information. If you need any further help removing active infection components, please let me know. Link to post Share on other sites
Todor 0 Posted May 3, 2016 Author Report Share Posted May 3, 2016 It's working!Thank you, Elise. You are goddess! Link to post Share on other sites
Elise 277 Posted May 3, 2016 Report Share Posted May 3, 2016 Glad to hear that, but I really only posted the link. Please let me know if you have any other problem or if this topic can be locked. Link to post Share on other sites
Todor 0 Posted May 3, 2016 Author Report Share Posted May 3, 2016 Something strange happened. The decrypter didn't decrypt all files. But I don't have explanation why. For example: I have 10 photos in one folder, IMG_0001, IMG_0002... but only two of them are decrypted. They are from one source (my camera), in the same location and so...These photos are not so important, but it's strange situation. Link to post Share on other sites
Elise 277 Posted May 3, 2016 Report Share Posted May 3, 2016 Maybe this is the reason? Also, the decryptor will only be able to decrypt files that are smaller than the files you derived the key from. Therefore, try to use a large file pair. Link to post Share on other sites
Todor 0 Posted May 3, 2016 Author Report Share Posted May 3, 2016 That's why you have to read before asking... I'm feeling stupid now. This was the reason. Everything is ok now. Thanks again.You can lock the topic. Link to post Share on other sites
Elise 277 Posted May 3, 2016 Report Share Posted May 3, 2016 Because this issue appears to be resolved, I will lock this topic. If you need it reopened, please send me a personal message. Link to post Share on other sites
Recommended Posts