Researchers release CryptoLocker decryption tool

Posted by   Virus Bulletin on   Aug 6, 2014

Tool uses private keys found in database of victims.

Please note: this blog post was written in August 2014 and refers to a particular kind of encryption-ransomware that was active until June 2014. The tools mentioned are unlikely to work to decrypt newer versions of ransomware, including those branded as 'CrytpoLocker'.

The CryptoLocker ransomware is one of the nastiest pieces of malware to have targeted Internet users in recent years. The malware uses strong file encryption (more particularly, AES encryption with a key that has been encrypted using an RSA-2048 private key) to deny the user access to their files unless they pay a ransom of around US$300.

At a time when we often seem to be learning about accidental or intentional vulnerabilities in encryption, the fact that CryptoLocker didn't contain any such flaws (unlike some other ransomware) has been the cause of much frustration, and the only way to recover encrypted files (until now) has been to use a backup, or to pay the ransom.

However, there is good news for victims of CryptoLocker. Researchers at FireEye and Fox-IT have worked together to develop a free tool that will decrypt affected files. The tool requires users to upload a single encrypted file to a website, after which it is able to decrypt all other files found on the PC.

Rather than crack the encryption, the researchers made use of a database of the RSA private keys that was obtained during the recent takedown of the GameOver Zeus botnet - which was used to distribute the ransomware.

While this is certainly good news for those who have had their files encrypted with this ransomware, it is important to note that the encryption itself still hasn't been cracked. Moreover, following the 'success' of CryptoLocker, many copycats have sprung up (even including one targeting NAS devices). The multi-layered approach we advised back in November thus remains as important as ever.

More details on CryptoLocker can be found on the Fox-IT blog here and on FireEye's blog here.

Posted on 06 August 2014 by Martijn Grooten

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VB2019 paper: Geost botnet. The story of the discovery of a new Android banking trojan from an OpSec error

OpSec mistakes are what lead to many malware discoveries, and in the case of the Geost Android botnet the mistake was a really interesting one. Today we publish the VB2019 paper by Sebastian García, Maria Jose Erquiaga and Anna Shirokova on the Geost…

Analysis of malware responsible for sextortion spam that mines for Monero on the side

VB2019 Platinum partner Reason Cybersecurity presents a threat analysis report on the Save Yourself malware.

Guest blog: Threat intelligence – a unifying force of the future

In a guest blog post VB2019 Platinum partner Reason Cybersecurity looks to the future of threat intelligence.

Guest blog: Why we should be paying more attention to Linux threats

In a guest blog post VB2019 Silver partner Intezer outlines the importance of paying attention to Linux threats.

New Emotet spam campaign continues to bypass email security products

On Monday, the infamous Emotet malware resumed its spam campaign to spread the latest version of the malware. As before, the malware successfully bypasses many email security products.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.