Emsisoft Releases a Decrypter for HydraCrypt and UmbreCrypt Ransomware

[Batu69]

Fabian Wosar of Emisoft has done it again with his release of a decrypter for the HydraCrypt and UmbreCrypt ransomware infections. Both of these infections are part of the CrypBoss Ransomware family, whose source code was leaked on pastebin last year. When analyzing this source code, Fabian had found a flaw that allowed him to release a decrypter last year for this family of infections. Though HydraCrypt and UmbreCrypt have since modified the encryption scheme, Fabian was still able to utilize the original flaw to crack these variants as well.

Decrypting UmbreCrypt and HydraCrypt

If you are infected with this malware, simply download decrypt_hydracrypt.exe from the following link and save it on your desktop:

 

DecryptHydraCrypt Download

 

In order to find your decryption key, you need to drag an encrypted file and unencrypted version of the same file onto the decrypt_hydracrypt.exe icon at the same time.  So you would select both the encrypted and unencrypted version of a file and drag them both onto the executable.  If you do not have an an original version of one of your encrypted files, in our tests you can use a encrypted PNG file and any other unencrypted PNG file that you get off of the Internet and drag them together onto the decrypt_hydracrypt.exe icon.  Once you determine the key used to encrypt one of your files, you can then use that key to decrypt ALL other files on your computer.

 

To show what I mean about dragging both files at the same time, see the example below. To create the key, I created a folder that contains an encrypted PNG file, a totally different valid PNG file, and the decrypt_hydracrypt.exe program. I then dragged both the regular PNG file and the encrypted one onto the executable at the same time.

 

How to drag the files onto the Decrypter

 

When the program starts, you will be presented with a UAC prompt as shown below. Please click on Yes button to proceed.

 

UAC Prompt

 

When a key was able to be brute forced, it will display it an a new window like the one below. Please write down this key in the event you need it again in the future.

 

Decryption Key Found

 

To start decrypting your files with this key, please click on the OK button.  You will then be presented with a license agreement that you must click on Yes to continue. You will now see the main DecryptInfinite screen that displays all the encrypted files that were listed in the Registry.

Look through the list of encrypted files and if it appears that they are all there, then click on the Decrypt button. If there are files missing, you can click on the Add Folder button to add other folders that contain encrypted files.  Once you have added all the folders you wish to decrypt, click on the Decrypt button to begin the decryption process.  Once you click Decrypt, DecryptInfinite will decrypt all the encrypted files and display the decryption status in a results screen like the one below.

 

Decryption Results

 

All of your files should now be decrypted.

 

For those who wish to know more technical information about this ransomware, you can read our analysis of UmbreCrypt here.  If you need help getting this decrypter to work, please ask in our UmbreCrypt Ransomware Support Topic.

 

Article source