Notes

http://virusinfo.info/showthread.php?t=162705
http://www.youtube.com/watch?v=2SD5sUrhC_U
http://www.softsklad.ru/safes/shifrs/8058prog.html

http://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information


Well, I'll explain this as easily as I can. Just follow the steps and you'll be fine.



I hope you can access a Linux box or virtual machine, because you'll most probably need one. (Maybe a Mac will do either, but I don't know because I'm not a Mac user).



First of all, install Python 3.2 or greater. If your Linux distribution does not install the sqlite3 module, you must locate it and also install it by hand.



Then, RIGHT CLICK on this link and select download destination as... "decrypt.py":


https://bitbucket.org/cybertools/malware_tools/raw/fa4ec9df293b2504a1fa8691c91f006f32acb8bc/bitcrypt/decrypt.py



Run the script on any of your encrypted files:



python ./decrypt.py "MY ENCRYPTED PICTURE.jpg.bitcrypt"



This will show you an error, because your key is not known yet. It will provide your decoded key so you can break it using another tool.



How? Download this:



https://gforge.inria.fr/frs/download.php/33131/cado-nfs-2.0.tar.gz



Decompress: Open a shell prompt, go to wherever the downloaded file is, and then run the following command:



tar zxvf cado-nfs-2.0.tar.gz



This will extract all the files to a new cado-nfs-2.0 folder.



Go to that folder and compile:



cd cado-nfs-2.0

make



Run the key cracker. This will take several HOURS (maybe DAYS) to complete:



./factor.sh YOUR_KEY_WHICH_IS_A_VERY_LONG_SERIES_OF_DIGITS_PROVIDED_BEFORE_BY_THE_DECRYPTING_SCRIPT -s 4 -t 6



If all goes well, the output will read as follows:



Info:Complete Factorization: Total cpu/real time for everything: xxxx/yyyy
LONG_NUMBER_1 LONG_NUMBER2



Open decrypt.py in a TEXT EDITOR.



Locate the block:



known_keys = { many long numbers

}



Add, before that "}" the following lines:



YOUR KEY, as provided by the previous call, a COLON, OPEN PARENTHESIS, FIRST LONG NUMBER, COMMA, SECOND LONG NUMBER, CLOSE PARENTHESIS.



For instance, let's figure out that your key is 123, the first number "456" and the second "789". You'll add this:



123:(456,789)



Don't worry. You're almost done. This needs to be performed only ONCE.



Now, you are ready to decode ANY file in your computer (not others, which will have different keys which will need to be cracked as well):



python ./decrypt.py "MY ENCRYPTED PICTURE.jpg.bitcrypt"

This should work and generate "MY ENCRYPTED PICTURE.jpg.bitcrypt.clear"

RENAME the output:

mv "MY ENCRYPTED PICTURE.jpg.bitcrypt.clear" "MY ENCRYPTED PICTURE.jpg"

Try to open it. It should be fully decrypted and working now. Repeat the process.

Back to top