Allen M Posted August 3, 2017 Report Share Posted August 3, 2017 I'm attempting to use decrypt_GloveImposter to recover family photos and personal records saved on an external hard drive. Everything was renamed to a .726 file extension. I've already formatted the computer and reinstalled windows to ensure the virus was removed. I have the decrypt_GlobeImposter.exe tool as well as several files that were encrypted and some backups I had in Dropbox. On my fresh copy of windows, if I try to put the encrypted and backup file on top of the decrypt_GlobeImposter.exe as instructed, I just get "The Decrypter could not determine a valid key for your system..." Error message: https://www.dropbox.com/s/1bn9ldn7efxxala/Screenshot 2017-08-03 00.55.49.png?dl=0 Did I make a mistake by formatting the system or is there still some way to recover my files? Folder with encrypted and unencrypted files. https://www.dropbox.com/sh/8vzo6ddjcu8cdd5/AABRl98UCn5ckG4gr6z2wQ5sa?dl=0 Encrypted file: https://www.dropbox.com/s/tw8go1pg6u8lrh8/Admin 0301_1509.html..726?dl=0 Original file: https://www.dropbox.com/s/ql4m7owrbbnksi5/Admin 0301_1509.html?dl=0 Any help would be appreciated! Thanks, Allen Admin 0301_1509.html Admin 0301_1509.html..726 Link to comment Share on other sites More sharing options...
Melissa P Posted August 3, 2017 Report Share Posted August 3, 2017 I am having the same issue with the decrypt_GlobeImposter tool trying to repair my encrypted files with the ..726 extension. I have not done a total reformat of my system yet but have cleaned it and removed the trojan. Any help would be greatly appreciated. 1 Link to comment Share on other sites More sharing options...
G.R. Posted August 3, 2017 Report Share Posted August 3, 2017 The tool is designed to work with .crypt files, and won't see anything with .726 extensions. I guess you could try renaming the .726 files to .crypt, but it would be nice if there was an updated tool for this soon. Link to comment Share on other sites More sharing options...
Константин Posted August 4, 2017 Report Share Posted August 4, 2017 Please tell somebody of staff guys, what is estimated time to get here an easy ..726 version decryptor, without renaming? or after key finding its catching all ..726 files automatically.... Link to comment Share on other sites More sharing options...
Henkles Posted August 4, 2017 Report Share Posted August 4, 2017 I've been hit with the 726 extensions. Any help would be very appreciated. I tried running the tool and it fails (same error as above) I changed the extension to .crypt and it still failed. Please help!! Link to comment Share on other sites More sharing options...
Allen M Posted August 4, 2017 Author Report Share Posted August 4, 2017 Renaming the files to .crypt will start the decrypter, but this tool only works with GlobeImposter v1. Apparently they still don't have a way to unlock v2 yet. Link to comment Share on other sites More sharing options...
Fabian Wosar Posted August 4, 2017 Report Share Posted August 4, 2017 There is, unfortunately, no known way to decrypt files encrypted by GlobeImposter2 that doesn't involve the cooperation of the ransomware authors. Sorry, but you will have to restore your latest backups. Link to comment Share on other sites More sharing options...
rookieplayer Posted August 5, 2017 Report Share Posted August 5, 2017 please see here: https://www.bleepingcomputer.com/forums/t/644166/globeimposter-crypt-pscrypt-ext-back-fileshtml-ransomware-support/?p=4303056 I have uploaded sample encrypted and decrypted files hope someone comes up with a tool to decrypt it. thanks Link to comment Share on other sites More sharing options...
Recommended Posts