Released Decrypter for Unlock92 ransomware

Security researcher Michael Gillespie has created a decrypter that can help Unlock92 ransomware victims recover their records without paying ransom.

Unlock92 is a new version of ransomware first discovered by Malwarebytes S security researcher! Ri yesterday. The ransomware seems to have been developed by Kozy.Jozy's ransomware developer who appeared a week ago.cryptography Unlock92

But while Kozy.Jozy uses a powerful RSA-2048 algorithm system that does not let the researchers break its encryption, it seems that the developer has decided to make some modifications to the original source code that eventually weakened his defense.

But let's look at what is wrong with malware:

To lock the victim's files, Unlock92 creates a random hexadecimal character password of 64 for each infected user. The files are encrypted with a symmetrical AES encryption, and the above code encrypted with RSA is sent to the fraudster's server.

Ransomware strikes the following file extensions:
.cd, .ldf, .mdf, .max, .dbf, .epf, .xNUMXcd, .md, .db, .pdf, .ppt, .xls, .doc, .arj, .tar, .1z, .rar .zip, .tif, .jpg, .a, .bmp, .png, .cdr, .psd, .jpeg, .docx, .xlsx, .pptx, .accdb, .mdb, .rtf, .odt ,. ODS, .odb, .odg

Instructions for using decrypter:

"To create the key and IV, you will need an encrypted PNG file (* .png.CRRRT). The smaller the file, the better. The process may take some time, but it will take less than an hour for a small file on most machines. An i7 processor can analyze a 1KB file and find the key in minutes. Just place it in the brute-Forcer, and let it go. Once it finds the key, click the 'Confirm Password' button, then select a folder to decrypt it. "

Of course for more security keep a backup of your encrypted files first.

Although, as mentioned before, Unlock92 has been developed by the same programmer who wrote Kozy.Jozy the decrypter only works for Unlock92.

Download the decryption tool The Best Technology Site in Greecegns

every publication, directly to your inbox

Join the 2.112 registrants.

Written by Dimitris

Dimitris hates on Mondays .....

Leave a reply

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).