.litar ransomware

[Tudor 0]

My files were encrypted by Stop/Djvu (.litar variant) ransomware. The ransomware has encrypted the D‏‏‎ ‎partition wich contains ages worth of family photos and videos.

Hapily, I have backup of the files,but not of all of them,just a part of the encrypted folders.

I have tried using the decryptor but i didn't work because my files were encrypted with a online key(here is a link to the log file made by the decryptor https://www.filehosting.org/file/details/883357/LYfdCAI3ksA0JjL3/Emsisoft Decryptor log.txt )

I also tried uploading file pairs  but I had too many many file pairs and I was unable to upload all of them without it taking me hours and hours.

Could I send my files to a emsisoft employee so that they can upload the files faster or could I get a script that automates the submision of the file pairs?

Link to readme.txt file: https://freetexthost.net/XVZqXUV

Link to PersonalID.txt file: https://freetexthost.net/lIHLDgK

Here is a picture of the files(Also the language that you are seeing is romanian)

[GT500 872]

20 hours ago, Tudor said:

I also tried uploading file pairs  but I had too many many file pairs and I was unable to upload all of them without it taking me hours and hours.

Could I send my files to a emsisoft employee so that they can upload the files faster or could I get a script that automates the submision of the file pairs?

For most file types you only need a single file pair per file type. JPEG/JPG and a few others are different, and will need you to upload a new file pair for each source the files came from (a specific camera can be a source, a specific phone can be a source, a specific image editing program can be a source, etc).

Go ahead and see what the decrypter can decrypt, and then decide what file pair to work on next based on that. Keep an eye on the first 5 bytes that the decrypter mentions for files it can't decrypt, because the file pairs work for all files that have the same first 5 bytes.

[Tudor 0]

I have mostly JPG files and all of their first 5 bytes start with FFD8FFE,then end with three random number wich makes it really hard to find file pairs for each of them.Though the mp4 files all have the same first 5 bytes.

Is there a way to upload file pairs faster,or is there a way to automate the submission of the file pairs?

[GT500 872]

17 hours ago, Tudor said:

Is there a way to upload file pairs faster,or is there a way to automate the submission of the file pairs?

Unfortunately the only way to do it right now is by uploading file pairs one at a time.

The easiest way to handle this is to create a spreadsheet with two columns, one with the first 5 bytes of each JPG image and the next with the file names. Then sort the rows by the column with the first 5 bytes, and that will group together all files in the list that have the same first 5 bytes. Then pick out the best file from each group you can use as a file pair.

Edited July 27, 2020 by GT500
Fixed typo.