EMAN ransomware decryptor

[Tenebra23]

Idk where to post this and Google is useless for this topic (most websites spam their shitty virus remover that I don't need instead of giving me an answer).

So, recently my company was infected by a particular and new (october) ransomware (EMAN), email: [email protected]

This matrix uses AES-128 and RSA-2048 algorithms to lock data. It decrypted the files during the night, no one was working and I managed to stop it in the early morning. The virus has been removed, but many files are locked. I recovered most of them, but some of them are still encrypted.

I searched online for a decryptor, but I just found softwares to remove the virus. I do not need to remove the virus because I've already done that, I just need some kind of decryptor. nomoreransom.org says that it still under research, but to be sure I want to ask to some expert here.

Thank you in advance

 

[Pepemakingmony]

Damn tougth this only happens in movies, btw did they asked for a rescue if not what is the pourpose of the ransomware?

 

[MisterF]

Idk where to post this and Google is useless for this topic (most websites spam their shitty virus remover that I don't need instead of giving me an answer).

So, recently my company was infected by a particular and new (october) ransomware (EMAN), email: [email protected]

This matrix uses AES-128 and RSA-2048 algorithms to lock data. It decrypted the files during the night, no one was working and I managed to stop it in the early morning. The virus has been removed, but many files are locked. I recovered most of them, but some of them are still encrypted.

I searched online for a decryptor, but I just found softwares to remove the virus. I do not need to remove the virus because I've already done that, I just need some kind of decryptor. nomoreransom.org says that it still under research, but to be sure I want to ask to some expert here.

Thank you in advance

Do you know how you got infected ?

 

[Veil123]

I had a really bad experience with this months ago. It is not anything new, but pretty old and dirty ransomware that will encrypt all of your files and then you need to pay BTC to can get the decryption key (as some people are saying over the internet, even after they paid, they didn't receive anything).

The only way for you to decrypt the files will be to do a reverse engineering on each file, which is not that easy and it is really time consuming if you don't know where and how to start.

 

[Tenebra23]

Damn tougth this only happens in movies, btw did they asked for a rescue if not what is the pourpose of the ransomware?

Yes, they asked for money in order to give us a decryption key

Do you know how you got infected ?

I recently joined this company, and those tards got this infection via mail (a spam mail tho). Someone opened the attached file and the infection started. I managed to install all the security system needed, they were very exposed to many risks with the low-quality protection they had before.

I had a really bad experience with this months ago. It is not anything new, but pretty old and dirty ransomware that will encrypt all of your files and then you need to pay BTC to can get the decryption key (as some people are saying over the internet, even after they paid, they didn't receive anything).

The only way for you to decrypt the files will be to do a reverse engineering on each file, which is not that easy and it is really time consuming if you don't know where and how to start.

Yes, I also found the BTC address where to send money. Obv I told my company NOT to pay, because it was almost obv that we would not have received any key. We just contacted the local "postal police" (we have that in Italy, but it's kind of BS since they barely know how to turn on a PC). This type of Matrix is a variation tho, I've found many decryptors but they are created for different kind of ransomwares. I think I'll just wait for a new decryptor

 

[Veil123]

Yes, I also found the BTC address where to send money. Obv I told my company NOT to pay, because it was almost obv that we would not have received any key. We just contacted the local "postal police" (we have that in Italy, but it's kind of BS since they barely know how to turn on a PC). This type of Matrix is a variation tho, I've found many decryptors but they are created for different kind of ransomwares. I think I'll just wait for a new decryptor

I don't think that you will find a decryptor for that particular matrix that you have on your files. Why? The matrix vector length and the decryption key can have up to 128 char variations. And I am pretty sure that the creator of this is pretty much using random generated combinations for each PC as that is pretty simple and it is a failproof solution for any decryptor.

 

[MisterF]

Yes, they asked for money in order to give us a decryption key


I recently joined this company, and those tards got this infection via mail (a spam mail tho). Someone opened the attached file and the infection started. I managed to install all the security system needed, they were very exposed to many risks with the low-quality protection they had before.


Yes, I also found the BTC address where to send money. Obv I told my company NOT to pay, because it was almost obv that we would not have received any key. We just contacted the local "postal police" (we have that in Italy, but it's kind of BS since they barely know how to turn on a PC). This type of Matrix is a variation tho, I've found many decryptors but they are created for different kind of ransomwares. I think I'll just wait for a new decryptor

Once you pay you leave yourself open for further demands too.
These scumbags are the lowest of the low.

 

[EternalFun]

How can your company employees be so noob to open attachments from spam mails as well as work in a company?

Btw, which security did you install?

 

[Frozenhands]

I have heard several stories from clients who have had to deal with this. In general, they do have a backup system that allows them to restore up to one day. Often these infections come in via e-mail messages, then the spam filter they have is really worthless.

Once you have this within your network, it is better to have a backup system, because decrypting generally does not work with software that is available.

 

[F4lken]

Too bad you don't have at least daily backups of fileserver.

I'm sorry to tell you, but the chances you will decrypt your files are near to 0.
The only way to have a remote possibility to decrypt them is to make a dump of the ram memory of the machine on which the encryption process started, when it's still active and then search for the PGP key with forensic tools like Volatility (preinstalled on Kali linux) or Elcomsoft Disk Forensic Decryptor (Windows), then try to decrypt a single file and if it works make a script to decrypt them in bulk. Also in this case, if the ransomware is well-coded it will spoof the real key writing thousands of fake ones in RAM or self-delete from it in real time.

Put your heart in peace and setup a valid backup solutions with multiple daily incrementals schedule

Also, there are pretty basic group policy you can apply to your entire domain to prevent ransomware to execute. It takes 5 minutes to setup:

https://www.computerworld.com/artic...tting-infected-and-what-to-do-if-you-are.html

 

[Gogol]

It is impossible to break the encryption without knowing the key. That's how ransomwares work AFAIK. Your best bait (other than paying the money ofcourse) is to wait till an AV e.g. nod32 gets the decryption key and releases a patch for this particular ransomware.

 

[Tenebra23]

How can your company employees be so noob to open attachments from spam mails as well as work in a company?

Btw, which security did you install?

That's why they wanted to hire an IT and security specialist, because there are many tards that just open emails like there no tomorrow. I installed a simple and light software of mine that scans emails with attachments before downloading. They didn't have a SINGLE antivirus, they just rely on NAS backups... I'm shocked

It is impossible to break the encryption without knowing the key. That's how ransomwares work AFAIK. Your best bait (other than paying the money ofcourse) is to wait till an AV e.g. nod32 gets the decryption key and releases a patch for this particular ransomware.

Yes it's basically impossible until someone releases a valid key for this matrix variation

 

[trunkss]

In Greece it even happened to one of the biggest companies in the country (worth billions in the stock exchange). They paid something like 80.000 eur and had their files decrypted.

Edit: They paid the ransom.

 

[kid1810]

I think there won't be anything you can reverse the decryption. Because the infected files are produced after these two processes:

1. Generate private key for each victim. (On hacker machine)
2. Generate the encryption file base on the private key. (On hacker machine)

Finally, the encryption file will encrypt and infect the victims' files base on the private key AND encryption key from the generated virus file.

So, reversing the encryption is absolutely impossisble if you don't have quantum computer. My company has stumbled upon this 2 years ago. I even ended up buying the exact ransomeware that my computer was infected with. The Russian guy said that I can't do anything without the original private key of victim (me).

Turn out, I had to pay the hacker. I also worry about their demands after my payment. But, ransomeware hackers' nature are they only want money, that's it. Demanding more is too much hassle for them. Because the ways they spread ransomeware are either using botnet, hacked rdps, mass email sending. Those methods take lots of money to run, and the ROI is typically around 0.5-1% max.

Therefore, financially speaking, they'd rather accept the money than risk their investment to receive nothing. The only specific situation that they will demand more is when they have their eyes on a hacked rdps which appear to have very important company's information. Which in your case, I think that's not possible. Because viruses are spread through emails.

So, personally, if you sure about virus spreading source: emails or botnet, you should negotiate with the hacker using something like poor-begging, sick people need medical care, etc. DON'T EVER BE professional negotiator or important person in the company, pretend you are just a normal poor man, with nothing important in the pc.

If the spreading source is from hacked rdps, you can still make up some poor story, but don't be too extreme.

In these case, to be honest, police can't help, ransomeware professionals can't help. Only you with your own creative ways of talking can help you. Also, they are mostly from Russia or Urkraine, don't waste time typing a professional email. They won't understand half of the emails :|

 

[EternalFun]

They didn't have a SINGLE antivirus, they just rely on NAS backups... I'm shocked

Wow, a company having no security software and relies on backups. lol

 

[Tenebra23]

I think there won't be anything you can reverse the decryption. Because the infected files are produced after these two processes:

1. Generate private key for each victim. (On hacker machine)
2. Generate the encryption file base on the private key. (On hacker machine)

Finally, the encryption file will encrypt and infect the victims' files base on the private key AND encryption key from the generated virus file.

So, reversing the encryption is absolutely impossisble if you don't have quantum computer. My company has stumbled upon this 2 years ago. I even ended up buying the exact ransomeware that my computer was infected with. The Russian guy said that I can't do anything without the original private key of victim (me).

Turn out, I had to pay the hacker. I also worry about their demands after my payment. But, ransomeware hackers' nature are they only want money, that's it. Demanding more is too much hassle for them. Because the ways they spread ransomeware are either using botnet, hacked rdps, mass email sending. Those methods take lots of money to run, and the ROI is typically around 0.5-1% max.

Therefore, financially speaking, they'd rather accept the money than risk their investment to receive nothing. The only specific situation that they will demand more is when they have their eyes on a hacked rdps which appear to have very important company's information. Which in your case, I think that's not possible. Because viruses are spread through emails.

So, personally, if you sure about virus spreading source: emails or botnet, you should negotiate with the hacker using something like poor-begging, sick people need medical care, etc. DON'T EVER BE professional negotiator or important person in the company, pretend you are just a normal poor man, with nothing important in the pc.

If the spreading source is from hacked rdps, you can still make up some poor story, but don't be too extreme.

In these case, to be honest, police can't help, ransomeware professionals can't help. Only you with your own creative ways of talking can help you. Also, they are mostly from Russia or Urkraine, don't waste time typing a professional email. They won't understand half of the emails :|

Well thank you for the detailed explanation. The good thing is that thank to the daily backup, we got almost everything back, not everything. We lost 2-3 days of work because there are many PCs and I had to scan them manually. Nothing too fancy, but still a big lost.

I'd rather transplant my organs instead of chatting with some trash Russian hacker that can't even read a single sentence. I'm not an English native speaker, but their e-mails was full of primary school mistakes. I replied "ok" just to let him understand that I didn't care about his attack. My company has to pay me every month even if the servers explode, so idc too much

 

[kid1810]

Wow, a company having no security software and relies on backups. lol

Talking about ransomeware, secured backups are much better than av.

 

[jazzc]

Wow, a company having no security software and relies on backups. lol

You haven't been out in the world yet, have you?

 

[kid1810]

Well thank you for the detailed explanation. The good thing is that thank to the daily backup, we got almost everything back, not everything. We lost 2-3 days of work because there are many PCs and I had to scan them manually. Nothing too fancy, but still a big lost.

I'd rather transplant my organs instead of chatting with some trash Russian hacker that can't even read a single sentence. I'm not an English native speaker, but their e-mails was full of primary school mistakes. I replied "ok" just to let him understand that I didn't care about his attack. My company has to pay me every month even if the servers explode, so idc too much

Well, as long as you have backups, you can survive ransomeware easily. In yr case, its better than nothing hope everything else will be ok soon.

 

[jazzc]

Talking about ransomeware, secured backups are much better than av.

Backups are absolutely critical indeed but the AV is the first line of defense. Policies are what makes or breaks security though.

The real beauty is when the backup system is setup in such a silly way that the ransomware gets access to it and encrypts the backups as well