Cheap KYC Verifications & Openups ◆ Spoof Call and Spoof SMS set any caller ◆ ProxiesFood: Unlimited Residential Proxy ◆ Anvilpoint CyberOps - Hacker for Hire ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Blackhat • Red Team • Offensive Security Cryptography, Encryption, and Decryption › Decrypting a file (ransomware)

New Reply 

Decrypting a file (ransomware)
cryptzoo
cryptzoo Offline
[n00b@HF:]
*
Registered
Posts:
3
Threads:
1
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jun 23, 2016 09:21 PM (This post was last modified: Jun 23, 2016 09:22 PM by cryptzoo.)
Hey there (noob here),

So recently my work place got attacked by a ransomware called CERBER. After trying out all the options (using all the free available decryptors), I bought the decryptor from the ransomware attacker. However, it is unable to find the private key to decrypt the encrypted files.

So here is my question, I have an encrypted file and its original file. I also have the public key. Is there any way I can crack the encryption? I need the private key to open other encrypted file who's original files are missing with no backups.

Note: I tried panda decryption tool, which was able to decrypt few files, but apparently, the encryption file changes its private key after a while. So I could not decrypt all my files.

Any help is appreciated :)
Cheers!
TouchMyMalware
TouchMyMalware Offline
[closed@HF:]
Posts:
147
Threads:
0
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jun 24, 2016 01:12 AM
I doubt there is any way you can crack it. Either they used block level RSA or AES. I know some ransomwares use the Win32 Crypto API to generate the keypair. And they forget to set the flag which only stores the key in memory but not in file. So chances are, the private key under those specific conditions is on your machine in your crypto folders. You will just need to import it to the CSP. Then call CryptDecrypt.
iLogic™
iLogic™ Offline
[bin@HF:]
***
HF l33t
Posts:
1,614
Threads:
97
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jun 24, 2016 01:13 AM
Hello.
It is possible to decrypt but it will take a lot of time (depending on hardware). Can you tell me what kind of encryption algorithm is it?
cryptzoo
cryptzoo Offline
[n00b@HF:]
*
Registered
Posts:
3
Threads:
1
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jun 24, 2016 01:59 AM
(Jun 24, 2016 01:13 AM)iLogic™ Wrote:  Hello.
It is possible to decrypt but it will take a lot of time (depending on hardware). Can you tell me what kind of encryption algorithm is it?

Hey, from my research, Cerber uses RSA 1024 public key using RC4 algorithm.
Silly Putty
Silly Putty Away
[closed@HF:]
Posts:
391
Threads:
37
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jun 24, 2016 02:10 AM
I've sent you a pm regarding
cryptzoo
cryptzoo Offline
[n00b@HF:]
*
Registered
Posts:
3
Threads:
1
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jun 24, 2016 05:21 AM
(Jun 24, 2016 02:10 AM)Silly Putty Wrote:  I've sent you a pm regarding

^^this guy just stole my money
Bandors Jr.
Bandors Jr. Away
[closed@HF:]
Posts:
1,814
Threads:
101
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jun 24, 2016 05:46 AM
There is no way you are going to decrypt the files, your best bet is to go to the link they tell you to when you are infected and use your one free decrypt wisely on your most important file and then go ahead and try and restore your system
CyberGuard
CyberGuard Offline
d248edf5da43523be279264452f2a2c3
***
HF Ub3r
Posts:
1,433
Threads:
107
Credibility:
000
Popularity:
-6
βytes:
β 0
Game XP:
0
Jun 24, 2016 09:18 AM
(Jun 24, 2016 05:21 AM)cryptzoo Wrote:  ^^this guy just stole my money

create a scam report about it with proof
BEKFEST
BEKFEST Offline
[user@HF:]
*
Registered
Posts:
390
Threads:
17
Credibility:
100
Popularity:
0
βytes:
β 0
Game XP:
0
Jun 24, 2016 09:56 AM
(Jun 24, 2016 05:21 AM)cryptzoo Wrote:  ^^this guy just stole my money

I really hope he didn't that'd be a scumbag thing to do to someone in your situation, make a scam report as CyberGuard said.
gabkwong2
gabkwong2 Offline
[closed@HF:]
Posts:
20
Threads:
0
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jun 24, 2016 09:49 PM
You are pulling up a dick move by doing that.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by shore1Jan 25, 2024 03:16 PM 3 275 Jan 25, 2024 03:16 PM
Last Post: SIM-5475994
by AnomynousSep 12, 2020 04:49 PM 4 127 Sep 12, 2020 04:49 PM
Last Post: Anomynous
by OahronApr 22, 2020 02:57 PM 1 106 Apr 22, 2020 02:57 PM
Last Post: Oahron