Decryption keys are now freely available for victims of CryptoLocker

@ All Readers

FireEye Blog: Your Locker of Information for CryptoLocker Decryption

FireEye is no longer providing decryption solutions for CryptoLocker. If your computer has recently been infected with ransomware, chances are that the infection has been caused by one of the many copycat attacks that use the same or similar name and method of operation. Since these new ransomware variants use different encryption keys, we have discontinued the DecryptCryptoLocker website and its associated decryption service.

The FireEye & Fox-IT decryptcryptolocker.com website posted this comment shortly before closing.

In August 2014, we launched our website to help the victims of the CryptoLocker malware. We are happy to have helped more than five thousand individuals and small businesses. CryptoLocker, unfortunately, has inspired criminals all over the world. We have seen more than 20 copycat ransomware attacks since the original CryptoLocker, some of which use the same name, modus operandi and layout as the original CryptoLocker. We believe that our Decryptolocker site has served its purpose, and we have decommissioned it given that the threat landscape has evolved.

This topic was created in 2014 for help with the original CryptoLocker Ransomware which first appeared in the beginning of September 2013. The topic keeps being resurrected by folks incorrectly assuming their infection is the result of CryptoLocker ransomware when that is not the case.

CryptoLocker Ransomware does not exist anymore and hasn't since June 2014. There are many copycat ransomware variants which pretend to be or use the CryptoLocker name but those infections are not the same. Any references to CryptoLocker and retrieving keys for it will not work anymore.

If you need assistance with a ransomware infection, please read and follow the instructions in these topics.

• How to Post a Topic Asking for Help With Ransomware
• ID Ransomware for assistance with identification and confirmation

If you need assistance with malware removal, please start a new topic in the Am I infected? What do I do? forum.

Thanks for you cooperation
The BC Staff
.
 
 
FireEye in collaboration with Fox-IT have released a way to possibly retrieve the private decryption key for those who were infected by the CryptoLocker infection. As covered extensively in the past, CryptoLocker was a ransomware program that encrypted the data files on an infected computer. In the past, the only way to decrypt your files was to pay the ransom in order to get a decryption key and decrypter. Recently, some of the servers associated with CryptoLocker and the Gameover malware distribution network were taken over by security firms and government agencies, which included FireEye and Fox-IT, during Operation Tovar. During this operation it appears that some of the decryption keys were discovered and are being made available.

In order to see if your decryption key is available, you need to go the site https://www.decryptcryptolocker.com. At this site you can upload one of your CryptoLocker encrypted files and an email address that you wish the key to be sent to. This service will then attempt to decrypt your file using all of the known private decryption keys, and if there is a match, will email you the key and instructions on how to decrypt the rest of your files.
 
 

In my tests the decrypter does indeed work, but can be confusing to use. If you have any questions on how to use the decrypter, feel free ask in our CryptoLocker support topic.

Are there any fees for decryption?

No, it's free. As I understand it (I don't have a cryptolocker infection to test with) you submit one encrypted file from your system and they will e-mail you the decryption key for all files on your system (assuming they have your key in the captured database) along with a decryption tool.

Edited by Andrew, 06 August 2014 - 03:24 PM.

have created a free decryption website for public use.


Further reading:
http://www.bbc.co.uk/news/technology-28661463
http://arstechnica.com/security/2014/08/whitehats-recover-victims-keys-to-cryptolocker-ransomware/

With this information being widespread now, how effective will the decryption keys be once the authors of the Malware discover that keys are available for free?

They have no control anymore. Once the keys were taken by security firms and government agencies, the malware devs lost control.

With this information being widespread now, how effective will the decryption keys be once the authors of the Malware discover that keys are available for free?

 

Well considering one of the suspected malware authors is now on an FBI wanted listed and their C&C Connections have been cut I'm sure they are trying to lay low with all that cash.

And probably developing a new variant as we speak ...

These types of malware are highly successful and are here to stay unfortunately. Just take a look at Synolocker. They are now targeting devices and bypassing the computer altogether.

And probably developing a new variant as we speak ...

These types of malware are highly successful and are here to stay unfortunately. Just take a look at Synolocker. They are now targeting devices and bypassing the computer altogether.

Well at least one of the pests have been knocked aside. But yeah, last I checked there were about 3-4 other varients and whole new ransomwares such as Synolocker.

With the other varients of Cryptolocker, shouldn't the decrypting process really be easy to shoot as well?

I mean, if the other varients such as Cryptodefence and Cryptowall came from Cryptolocker. Then shouldn't some "code-fiddling" reveal a pattern in each? (Feel free to correct anything I got wrong)

Any hope for us poor souls that got infected by CryptoWall? Surely decryption can't be too far 

Edited by omab, 07 August 2014 - 04:32 AM.

Any hope for us poor souls that got infected by CryptoWall? Surely decryption can't be too far 

Well if Cryptolocker's encryption got cracked, then the rest hopefully should follow suit eventually

 

Any hope for us poor souls that got infected by CryptoWall? Surely decryption can't be too far 

Well if Cryptolocker's encryption got cracked, then the rest hopefully should follow suit eventually

 

 

I don't think they cracked the encryption. They took control of one of the malware distributor's servers that have the keys stored on them. 

 

If I read Andrew's post correctly that is. 

With the other varients of Cryptolocker, shouldn't the decrypting process really be easy to shoot as well?

I mean, if the other varients such as Cryptodefence and Cryptowall came from Cryptolocker. Then shouldn't some "code-fiddling" reveal a pattern in each? (Feel free to correct anything I got wrong)

The keys were acquired during takeover. Not cracked.

There is no evidence that CryptoDefense and CryptoWall are in any way related to CryptoLocker other than that they do the same thing.

Hmmm... Are .rar files encrypted by cryptolocker? If not it might be just the right way to protect mictures and documents you want, you just need 7zip, peezip or winrar to un rar them i guess

It's about time... The "Good Guys" just need to keep up at whatever they're doing...