opkclean.blogg.se - Decrypt crypto locker

Version 3.0 (despite losing several capabilities as compared to the previous version) has now almost completely replaced version 2.0. This family is also famous for two versions - CryptoWall 2.0 and CryptoWall 3.0. The massive spread of this malware was recorded in the first quarter of 2014, however, according to some sources, the first samples were identified as early as in November 2013.

onion domain extension.Ī part of Tor client inside Critroni (command server address and sent commands are highlighted) CryptoWall In summary, it is impossible to decrypt the files without the master-private key, and this key, as we have explained, is stored on a C&C server in the. Thirty-two bytes of session-public and 16 bytes of service information are written at the beginning of the encrypted file for searching the required master-private key on the command server. Then, the session-shared = ECDH (master-public, session-private) value is computed, SHA-256 hash from which is used as key for file encryption with AES-256 algorithm. Session-public and session-private are generated for each encrypted file. The master-private key is sent to a command server and is not saved on the infected machine (it is also encrypted using ECDH and it is impossible to view it when it is sent). To do this, it takes SHA-256 hash from a 34-byte random number consisting of: 0x14 bytes: value obtained through CryptGenRandom functionĠx08 bytes: value obtained through GetSystemTimeAsFileTime functionĠx04 bytes: value obtained through GetTickCount function

the encrypted file gets a "ctbl" extension.ĬTB-Locker uses the so called ECDH (Elliptic curve Diffie-Hellman) algorithm.Īt first, Critroni generates two main keys - master-public and master-private.

the information needed for decryption is put at the beginning of the file.

the compressed block is encrypted and written on the disk.

each read block is compressed using the deflate function of zlib library.

this temporary file is read off the disk block-by-block.

the file selected for encryption is placed in a temporary file using MoveFileEx API function.

Critroni (CTB-Locker) in the register's autorun branches File encryptionĬritroni doesn't encrypt many types of files, mostly MS Office documents, text documents and database files.