Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Torrentunlocker works just halfway...


  • This topic is locked This topic is locked
4 replies to this topic

#1 kankamuso

kankamuso

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:46 PM

Posted 19 October 2016 - 10:36 AM

Hi,

 

Last year (august), I was infected by the TorrentLocker ransomware (it seems). Today, I made a new review on advances and found the TorrentUnlocker De-Ransomware tool. Ran it and I applied it on image files. This is what happens:

 

a) If the encrypted file is used as the test file after key retrieval, it does work with that file and can see the image.

B) If I apply that key to another encrypted file, it does work but just for half the file. From the middle to the top the image is corrupted (in JPEG it is not read, it does work for tiff files so I assume this is a header problem).

 

My question is... any clues on what is going on?. At least half of the file is unencrypted, so something is working there...

 

Thanks in advance



BC AdBot (Login to Remove)

 


#2 cybercynic

cybercynic

  • Members
  • 557 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Edge Of Tomorrow
  • Local time:05:46 PM

Posted 19 October 2016 - 10:49 AM

TorrentLocker, it seems? Why don't you find out for sure by uploading an encrypted file and the ransom note here: https://id-ransomware.malwarehunterteam.com/

 

The site will give you a positive ID for your ransomware and additional instructions.

 

BTW, where did you find this tool?


Edited by cybercynic, 19 October 2016 - 10:54 AM.

We are drowning in information - and starving for wisdom.


#3 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,430 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:05:46 PM

Posted 19 October 2016 - 11:04 AM

If you are talking about Nathan's tool, it does not work with most versions of the virus. It only worked with the first early variants, and then they patched their flaw. You would be better off contacting Dr. Web, they are the only ones able to currently decrypt files hit by Crypt0L0cker/TorrentLocker.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,963 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:46 PM

Posted 19 October 2016 - 02:01 PM

From the first page of this topic (Post #1)

The easy decryption method in TorrentLocker has been fixed by the developer. We have no way of decrypting your files anymore.

--
The Bleeping Computer Staff

In the past, this infection was using an easy to decrypt XOR encryption method. Unfortunately, some researchers decided to publicly blog about this encryption method, which caused the malware developer to change the encryption to a much stronger and unbreakable decryption using AES. Due to this change, Nathan Scott's TorrentLocker decrypter no longer works on this infection.

The latest version of TorrentLocker has patched the glitch I found in the infections encryption. This means if you were infected from 1 week ago going forward, my decrypter app will NOT work any longer. Sorry for any inconvenience.


.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,963 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:46 PM

Posted 19 October 2016 - 02:03 PM

There are ongoing discussions in these topics where you can ask questions and seek seek further assistance. Other victims have been directed there to share information, experiences and suggestions.Rather than have everyone with individual topics, it would be best (and more manageable for staff) if you posted any more questions, comments or requests for assistance in the above support topic discussion. To avoid unnecessary confusion, this topic is closed.

Thanks
The BC Staff
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users