Story image

Cisco Talos releases PyLocky ransomware decryptor - but there's a catch

14 Jan 19

Security firm Cisco Talos has released a free decryption tool for Windows users affected by the PyLocky ransomware – but it won’t work for everyone.

PyLocky is an imitation of the notorious ‘Locky’ ransomware, except it is written in a programming language called Python. The ransomware tries to mimic other ransomware families.
While ransomware is a menace to those who happen to be infected by it, decryption tools can often reverse the damage. In PyLocky’s case Cisco Talos managed to create a decryption tool, but there’s a very big catch.

The tool will only work for those who managed to capture a PCAP of the outbound connection attempt to the ransomware’s command & control servers – a connection that happens mere seconds after the infection.
In a nutshell, the PyLocky ransomware decryptor will only work on machines that have network traffic monitoring capabilities.

According to Cisco Talos, PyLocky generates a random user ID and password when it executes. It also gathers information about the infected machine by using WMI wrappers.

"After obtaining the absolute path of every file on the system, the malware then calls the encryption algorithm, passing it the IV and password.”

Each file is first base64-encoded before it is encrypted. The malware appends the extension ".lockedfile" to each file it encrypts - for example, the file "picture.jpg" would become "picture.jpg.lockedfile." 

Each file is then overwritten with a ransom demand.

For those victims who do use network monitoring software, they just need to download the decryptor to their infected machine, download WinPcap, specify the PCAP file with IV and password, and wait for the decryptor to do its thing. The company says that during its testing phase, the decryptor was able to recover three infected systems, however very large files 4GB and over may not be able to be decrypted.

The company says the decryptor is built for use on Windows systems and takes no responsibility for misuse of the decryptor tool.

“Talos encourages users never to pay an attacker-demanded ransom, as this rarely results in the recovery of encrypted files. Rather, victims of this ransomware should restore from backups if their files cannot be decrypted. Just as in the June 2017 Nyetya attack, Talos has observed on numerous occasions that attackers who are demanding ransoms may have no way to communicate with victims to provide a decryptor,” says Cisco Talos.
 

Hillstone CTO's 2019 security predictions
Hillstone Networks CTO Tim Liu shares what key developments could be expected in the areas of security compliance, cloud, security, AI and IoT.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Huawei founder publically denies spying allegations
“After all the evidence is made public, we will rely on the justice system.”
Malware downloader on the rise in Check Point’s latest Threat Index
Organisations continue to be targeted by cryptominers, despite an overall drop in value across all cryptocurrencies in 2018.
IoT breaches: Nearly half of businesses still can’t detect them
The Internet of Thing’s (IoT’s) rapid rise to prominence may have compromised its security, if a new report from Gemalto is anything to go by.