+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Ransomware - Need help Decrypting (/showthread.php?tid=5537839)
Pages: Pages
1
2
Ransomware - Need help Decrypting - Antec - Jan 29, 2017
Hey guys,
Recently I got infected with some ransomeware and I need help decrypting the files that the malware has encrypted.
The file end in a .crypt
I cant seen to decrypt it using the anti-malware provided stuff they have..
I have a super important excel sheet that I need for work and it's encrypted :(
I've tried to recover using disk recovering software and still failed..
Any help is appreciated... thanks!
EDIT: It is identified as "GlobeImposter"
The thing is I don't have the original undecrypted file, i only have the encrypted one.
I've only ever saved my documents on a USB and there is only one copy of it which is on the usb.
* - Null - Jan 29, 2017
Do you know what the ransomware is called? There are some public decrypters for specific ones.
* - Antec - Jan 29, 2017
It's CryptXXX, I've tried the free programs but they're just not working :(
* - Lante - Jan 29, 2017
Can you tell exactly what free programs you tried without success?
* - Null - Jan 29, 2017
Here ya go, ->
https://support.kaspersky.com/viruses/disinfection/8547#block1
Follow that and let me know how it goes, then we can work from there.
Also, how did you get it in the first place?
* - Antec - Jan 29, 2017
(Jan 29, 2017 09:42 PM)Lante Wrote: Can you tell exactly what free programs you tried without success?
I've tried RannohDecryptor and a few free other ones from AVG.
(Jan 29, 2017 09:45 PM)AltoSaxaphone Wrote: Here ya go, ->
https://support.kaspersky.com/viruses/disinfection/8547#block1
Follow that and let me know how it goes, then we can work from there.
Also, how did you get it in the first place?
with Rannoh is asks me for the orginal file which I don't have because I save all my files directly to USB...
This is such a pain in the ass, I am tempted to pay the ransom but I don't know if it'll work or not!
* - ***W0lf*** - Jan 29, 2017
Try with this programs bro: https://www.bleepingcomputer.com/download/windows/ransomware-decryptors/
* - Antec - Jan 29, 2017
(Jan 29, 2017 11:17 PM)++W0lf++ Wrote: Try with this programs bro: https://www.bleepingcomputer.com/download/windows/ransomware-decryptors/
Thanks man!! but none of them work :(
Apparently this is my ID:
C6 91 72 28 1D A8 86 15 AB 53 ED 80 28 9F 03 7A
2C 26 DD 73 44 31 39 CF 51 D0 9D 53 AF 14 37 4E
09 71 3B 05 2B 3B 78 06 FA 8F BE 7F BE 84 2E 32
DD 1A 9F EA D0 2F C3 79 1A 0F 8A BC 34 48 3E 77
E1 96 AA DB 27 59 8C BF 65 E3 68 E9 94 A3 36 EE
7A D1 92 44 F1 FA 24 21 30 43 B3 FC 89 97 EB BB
4E 48 39 2D 12 09 BE 03 91 9E C2 22 5F FE E5 E7
67 80 40 3F F3 68 CE F7 F3 76 36 3A 37 DB 7D B0
anyone know if this could lead anywhere??
Thanks :)
* - ven0m - Jan 29, 2017
Have you tried the tools listed in this post? Try ID Ransomware for a better identification.
* - Antec - Jan 30, 2017
(Jan 29, 2017 11:45 PM)ven0m Wrote: Have you tried the tools listed in this post? Try ID Ransomware for a better identification.
Thanks for your input Ven0m!
Okay its identified as "GlobeImposter"
The thing is I don't have the unencrypted version of this excel file...
I've only ever saved it to my USB and they've encrypted that file on the USB!!
I hope there is solutions! I am willing to pay anyone to help me decrypt this file!
* - licker98 - Jan 30, 2017
Just to add variety to the thread, if the document cannot be replicated fast enough, it may be better to pay. I read that most of the cybercriminals give you the files back, but paying the ransome is pretty disheartening and the police certainly wouldn't pay Ransome over a human hostage. Now if only there was a way to send the SAS into your computer...
* - Reusable - Jan 30, 2017
https://decrypter.emsisoft.com/globeimposter says they can decrypt it
* - ven0m - Jan 30, 2017
(Jan 30, 2017 12:10 AM)Antec Wrote: Thanks for your input Ven0m!
Okay its identified as "GlobeImposter"
The thing is I don't have the unencrypted version of this excel file...
I've only ever saved it to my USB and they've encrypted that file on the USB!!
I hope there is solutions! I am willing to pay anyone to help me decrypt this file!
Can you send me the encrypted version of the Excel file via PM? I wish to check.
* - GenericSkid - Jan 30, 2017
(Jan 29, 2017 09:42 PM)Lante Wrote: Can you tell exactly what free programs you tried without success?
Could have also been jerkin it on internet explorer.
* - Antec - Jan 30, 2017
(Jan 30, 2017 12:23 AM)Reusable Wrote: https://decrypter.emsisoft.com/globeimposter says they can decrypt it
The thing is I don't have the original. I've only ever saved it on my USB..
It states that you need the original file along with the decrypted file?
(Jan 30, 2017 12:26 AM)Lord Pankake Wrote: Could have also been jerkin it on internet explorer.
I've tried so many.. but now things have changed and it's known as "GlobeImposter" when I thought it was "CryptXXX"
(Jan 30, 2017 12:24 AM)ven0m Wrote: Can you send me the encrypted version of the Excel file via PM? I wish to check.
Sending it now. Thank you!