EMAN ransomware decryptor

Tenebra23

Tenebra23

Senior Member
Joined
Nov 24, 2017
Messages
816
Reaction score
451
Idk where to post this and Google is useless for this topic (most websites spam their shitty virus remover that I don't need instead of giving me an answer).

So, recently my company was infected by a particular and new (october) ransomware (EMAN), email: [email protected]

This matrix uses AES-128 and RSA-2048 algorithms to lock data. It decrypted the files during the night, no one was working and I managed to stop it in the early morning. The virus has been removed, but many files are locked. I recovered most of them, but some of them are still encrypted.

I searched online for a decryptor, but I just found softwares to remove the virus. I do not need to remove the virus because I've already done that, I just need some kind of decryptor. nomoreransom.org says that it still under research, but to be sure I want to ask to some expert here.

Thank you in advance
 
Advertise on BHW
Damn tougth this only happens in movies, btw did they asked for a rescue if not what is the pourpose of the ransomware?
 
Tenebra23 said:
Idk where to post this and Google is useless for this topic (most websites spam their shitty virus remover that I don't need instead of giving me an answer).

So, recently my company was infected by a particular and new (october) ransomware (EMAN), email: [email protected]

This matrix uses AES-128 and RSA-2048 algorithms to lock data. It decrypted the files during the night, no one was working and I managed to stop it in the early morning. The virus has been removed, but many files are locked. I recovered most of them, but some of them are still encrypted.

I searched online for a decryptor, but I just found softwares to remove the virus. I do not need to remove the virus because I've already done that, I just need some kind of decryptor. nomoreransom.org says that it still under research, but to be sure I want to ask to some expert here.

Thank you in advance
Click to expand...


Do you know how you got infected ?
 
I had a really bad experience with this months ago. It is not anything new, but pretty old and dirty ransomware that will encrypt all of your files and then you need to pay BTC to can get the decryption key (as some people are saying over the internet, even after they paid, they didn't receive anything).

The only way for you to decrypt the files will be to do a reverse engineering on each file, which is not that easy and it is really time consuming if you don't know where and how to start.
 
Pepemakingmony said:
Damn tougth this only happens in movies, btw did they asked for a rescue if not what is the pourpose of the ransomware?
Click to expand...

Yes, they asked for money in order to give us a decryption key
MisterF said:
Do you know how you got infected ?
Click to expand...

I recently joined this company, and those tards got this infection via mail (a spam mail tho). Someone opened the attached file and the infection started. I managed to install all the security system needed, they were very exposed to many risks with the low-quality protection they had before.
Veil123 said:
I had a really bad experience with this months ago. It is not anything new, but pretty old and dirty ransomware that will encrypt all of your files and then you need to pay BTC to can get the decryption key (as some people are saying over the internet, even after they paid, they didn't receive anything).

The only way for you to decrypt the files will be to do a reverse engineering on each file, which is not that easy and it is really time consuming if you don't know where and how to start.
Click to expand...

Yes, I also found the BTC address where to send money. Obv I told my company NOT to pay, because it was almost obv that we would not have received any key. We just contacted the local "postal police" (we have that in Italy, but it's kind of BS since they barely know how to turn on a PC). This type of Matrix is a variation tho, I've found many decryptors but they are created for different kind of ransomwares. I think I'll just wait for a new decryptor
 
Tenebra23 said:
Yes, I also found the BTC address where to send money. Obv I told my company NOT to pay, because it was almost obv that we would not have received any key. We just contacted the local "postal police" (we have that in Italy, but it's kind of BS since they barely know how to turn on a PC). This type of Matrix is a variation tho, I've found many decryptors but they are created for different kind of ransomwares. I think I'll just wait for a new decryptor
Click to expand...

I don't think that you will find a decryptor for that particular matrix that you have on your files. Why? The matrix vector length and the decryption key can have up to 128 char variations. And I am pretty sure that the creator of this is pretty much using random generated combinations for each PC as that is pretty simple and it is a failproof solution for any decryptor.
 
Tenebra23 said:
Yes, they asked for money in order to give us a decryption key


I recently joined this company, and those tards got this infection via mail (a spam mail tho). Someone opened the attached file and the infection started. I managed to install all the security system needed, they were very exposed to many risks with the low-quality protection they had before.


Yes, I also found the BTC address where to send money. Obv I told my company NOT to pay, because it was almost obv that we would not have received any key. We just contacted the local "postal police" (we have that in Italy, but it's kind of BS since they barely know how to turn on a PC). This type of Matrix is a variation tho, I've found many decryptors but they are created for different kind of ransomwares. I think I'll just wait for a new decryptor
Click to expand...

Once you pay you leave yourself open for further demands too.
These scumbags are the lowest of the low.
 
How can your company employees be so noob to open attachments from spam mails as well as work in a company?

Btw, which security did you install?
 
I have heard several stories from clients who have had to deal with this. In general, they do have a backup system that allows them to restore up to one day. Often these infections come in via e-mail messages, then the spam filter they have is really worthless.

Once you have this within your network, it is better to have a backup system, because decrypting generally does not work with software that is available.
 
Too bad you don't have at least daily backups of fileserver.

I'm sorry to tell you, but the chances you will decrypt your files are near to 0.
The only way to have a remote possibility to decrypt them is to make a dump of the ram memory of the machine on which the encryption process started, when it's still active and then search for the PGP key with forensic tools like Volatility (preinstalled on Kali linux) or Elcomsoft Disk Forensic Decryptor (Windows), then try to decrypt a single file and if it works make a script to decrypt them in bulk. Also in this case, if the ransomware is well-coded it will spoof the real key writing thousands of fake ones in RAM or self-delete from it in real time.

Put your heart in peace and setup a valid backup solutions with multiple daily incrementals schedule

Also, there are pretty basic group policy you can apply to your entire domain to prevent ransomware to execute. It takes 5 minutes to setup:

https://www.computerworld.com/artic...tting-infected-and-what-to-do-if-you-are.html
 
It is impossible to break the encryption without knowing the key. That's how ransomwares work AFAIK. Your best bait (other than paying the money ofcourse) is to wait till an AV e.g. nod32 gets the decryption key and releases a patch for this particular ransomware.
 
EternalFun said:
How can your company employees be so noob to open attachments from spam mails as well as work in a company?

Btw, which security did you install?
Click to expand...

That's why they wanted to hire an IT and security specialist, because there are many tards that just open emails like there no tomorrow. I installed a simple and light software of mine that scans emails with attachments before downloading. They didn't have a SINGLE antivirus, they just rely on NAS backups... I'm shocked
Gogol said:
It is impossible to break the encryption without knowing the key. That's how ransomwares work AFAIK. Your best bait (other than paying the money ofcourse) is to wait till an AV e.g. nod32 gets the decryption key and releases a patch for this particular ransomware.
Click to expand...

Yes it's basically impossible until someone releases a valid key for this matrix variation
 
In Greece it even happened to one of the biggest companies in the country (worth billions in the stock exchange). They paid something like 80.000 eur and had their files decrypted.

Edit: They paid the ransom.
 
I think there won't be anything you can reverse the decryption. Because the infected files are produced after these two processes:
  1. Generate private key for each victim. (On hacker machine)
  2. Generate the encryption file base on the private key. (On hacker machine)
Finally, the encryption file will encrypt and infect the victims' files base on the private key AND encryption key from the generated virus file.

So, reversing the encryption is absolutely impossisble if you don't have quantum computer. My company has stumbled upon this 2 years ago. I even ended up buying the exact ransomeware that my computer was infected with. The Russian guy said that I can't do anything without the original private key of victim (me).

Turn out, I had to pay the hacker. I also worry about their demands after my payment. But, ransomeware hackers' nature are they only want money, that's it. Demanding more is too much hassle for them. Because the ways they spread ransomeware are either using botnet, hacked rdps, mass email sending. Those methods take lots of money to run, and the ROI is typically around 0.5-1% max.

Therefore, financially speaking, they'd rather accept the money than risk their investment to receive nothing. The only specific situation that they will demand more is when they have their eyes on a hacked rdps which appear to have very important company's information. Which in your case, I think that's not possible. Because viruses are spread through emails.

So, personally, if you sure about virus spreading source: emails or botnet, you should negotiate with the hacker using something like poor-begging, sick people need medical care, etc. DON'T EVER BE professional negotiator or important person in the company, pretend you are just a normal poor man, with nothing important in the pc.

If the spreading source is from hacked rdps, you can still make up some poor story, but don't be too extreme.

In these case, to be honest, police can't help, ransomeware professionals can't help. Only you with your own creative ways of talking can help you. Also, they are mostly from Russia or Urkraine, don't waste time typing a professional email. They won't understand half of the emails :|
 
kid1810 said:
I think there won't be anything you can reverse the decryption. Because the infected files are produced after these two processes:
  1. Generate private key for each victim. (On hacker machine)
  2. Generate the encryption file base on the private key. (On hacker machine)
Finally, the encryption file will encrypt and infect the victims' files base on the private key AND encryption key from the generated virus file.

So, reversing the encryption is absolutely impossisble if you don't have quantum computer. My company has stumbled upon this 2 years ago. I even ended up buying the exact ransomeware that my computer was infected with. The Russian guy said that I can't do anything without the original private key of victim (me).

Turn out, I had to pay the hacker. I also worry about their demands after my payment. But, ransomeware hackers' nature are they only want money, that's it. Demanding more is too much hassle for them. Because the ways they spread ransomeware are either using botnet, hacked rdps, mass email sending. Those methods take lots of money to run, and the ROI is typically around 0.5-1% max.

Therefore, financially speaking, they'd rather accept the money than risk their investment to receive nothing. The only specific situation that they will demand more is when they have their eyes on a hacked rdps which appear to have very important company's information. Which in your case, I think that's not possible. Because viruses are spread through emails.

So, personally, if you sure about virus spreading source: emails or botnet, you should negotiate with the hacker using something like poor-begging, sick people need medical care, etc. DON'T EVER BE professional negotiator or important person in the company, pretend you are just a normal poor man, with nothing important in the pc.

If the spreading source is from hacked rdps, you can still make up some poor story, but don't be too extreme.

In these case, to be honest, police can't help, ransomeware professionals can't help. Only you with your own creative ways of talking can help you. Also, they are mostly from Russia or Urkraine, don't waste time typing a professional email. They won't understand half of the emails :|
Click to expand...

Well thank you for the detailed explanation. The good thing is that thank to the daily backup, we got almost everything back, not everything. We lost 2-3 days of work because there are many PCs and I had to scan them manually. Nothing too fancy, but still a big lost.

I'd rather transplant my organs instead of chatting with some trash Russian hacker that can't even read a single sentence. I'm not an English native speaker, but their e-mails was full of primary school mistakes. I replied "ok" just to let him understand that I didn't care about his attack. My company has to pay me every month even if the servers explode, so idc too much
 
Tenebra23 said:
Well thank you for the detailed explanation. The good thing is that thank to the daily backup, we got almost everything back, not everything. We lost 2-3 days of work because there are many PCs and I had to scan them manually. Nothing too fancy, but still a big lost.

I'd rather transplant my organs instead of chatting with some trash Russian hacker that can't even read a single sentence. I'm not an English native speaker, but their e-mails was full of primary school mistakes. I replied "ok" just to let him understand that I didn't care about his attack. My company has to pay me every month even if the servers explode, so idc too much
Click to expand...

Well, as long as you have backups, you can survive ransomeware easily. In yr case, its better than nothing :D hope everything else will be ok soon.
 
kid1810 said:
Talking about ransomeware, secured backups are much better than av.
Click to expand...

Backups are absolutely critical indeed but the AV is the first line of defense. Policies are what makes or breaks security though.

The real beauty is when the backup system is setup in such a silly way that the ransomware gets access to it and encrypts the backups as well :D
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top