Comments on: Remove Cry128 ransomware with Emsisoft’s free decrypter https://www.emsisoft.com/en/blog/27099/remove-cry128-ransomware-with-emsisofts-free-decrypter/ Straight-talking security advice from the Malware Experts Fri, 18 Nov 2022 12:24:23 +0000 hourly 1 By: Jurgens Steyn https://www.emsisoft.com/en/blog/27099/remove-cry128-ransomware-with-emsisofts-free-decrypter/#comment-789386 Thu, 05 Oct 2017 08:27:00 +0000 http://blog.emsisoft.com/?p=27099#comment-789386 Hey everyone, and thanks for the Decrypter, unfortunately it did not work for me and cannot find the key, are there any info on when a new version will be released?

thank you

]]> By: Vander https://www.emsisoft.com/en/blog/27099/remove-cry128-ransomware-with-emsisofts-free-decrypter/#comment-787621 Tue, 25 Jul 2017 03:39:00 +0000 http://blog.emsisoft.com/?p=27099#comment-787621 is there any new?;(( @fabianwosar:disqus

]]> By: Erkan Kara https://www.emsisoft.com/en/blog/27099/remove-cry128-ransomware-with-emsisofts-free-decrypter/#comment-787606 Sat, 22 Jul 2017 20:13:00 +0000 http://blog.emsisoft.com/?p=27099#comment-787606 Hello Everyone,
My files are effected from ransomeware attack. There is no size difference between encrypted and original files. Meanwhile, I have found the original file which is encrypting the files. It was called msiexev.exe and there was a command line using port 443 and a key. How can I decrypt my files using this key or if I provide you this key will it be useful for someone to decryptıon.

Erkan

]]> By: joerg https://www.emsisoft.com/en/blog/27099/remove-cry128-ransomware-with-emsisofts-free-decrypter/#comment-787535 Mon, 17 Jul 2017 06:50:00 +0000 http://blog.emsisoft.com/?p=27099#comment-787535 Hello,

is there any solution for the CRY36 ? I used the Kapersky Encoder, but they will not decrypt my files …. i have the CRY 36 .onion
Will come a decoder from Emysoft in the future ?

Thanks

Jörg

]]> By: Aníbal Amaral https://www.emsisoft.com/en/blog/27099/remove-cry128-ransomware-with-emsisofts-free-decrypter/#comment-787491 Thu, 13 Jul 2017 17:04:00 +0000 http://blog.emsisoft.com/?p=27099#comment-787491 Boas pessoal, também fui infectado já procurei em todo lado mas infelizmente ainda não à solução para para Cry 36,

o meu exemplo:

*** ALL YOUR WORK AND PERSONAL FILES HAVE BEEN ENCRYPTED ***

To decrypt your files you need to buy the special software – «Nemesis decryptor»
You can find out the details / buy decryptor + key / ask questions by email: mk.noobsaibot@aol.com

Your personal ID: 3833193842

]]> By: David Biggar https://www.emsisoft.com/en/blog/27099/remove-cry128-ransomware-with-emsisofts-free-decrypter/#comment-787470 Wed, 12 Jul 2017 18:12:00 +0000 http://blog.emsisoft.com/?p=27099#comment-787470 In reply to Anibal.

Currently no, there are not. I would keep any files you do not want to lose in case there is a decrypter made in the future, or in case the ransomware author(s) release decryption keys for older versions.

]]> By: Anibal https://www.emsisoft.com/en/blog/27099/remove-cry128-ransomware-with-emsisofts-free-decrypter/#comment-787467 Wed, 12 Jul 2017 09:36:00 +0000 http://blog.emsisoft.com/?p=27099#comment-787467 In reply to Fabian Wosar.

I’m infected with Cry36 any tools?

]]> By: Michalis Odysseos https://www.emsisoft.com/en/blog/27099/remove-cry128-ransomware-with-emsisofts-free-decrypter/#comment-787459 Tue, 11 Jul 2017 08:02:00 +0000 http://blog.emsisoft.com/?p=27099#comment-787459 In reply to Fabian Wosar.

Thanks boss! Your work is greatly appreciated

]]> By: Fabian Wosar https://www.emsisoft.com/en/blog/27099/remove-cry128-ransomware-with-emsisofts-free-decrypter/#comment-787458 Tue, 11 Jul 2017 07:47:00 +0000 http://blog.emsisoft.com/?p=27099#comment-787458 In reply to Michalis Odysseos.

No. Unless the private keys are leaked, there won’t be a new version. Kaspersky “liberated” at least a few of the keys. So you may want to give their decrypter a try: https://www.bleepingcomputer.com/forums/t/635859/crypton-ransomware-support-help-topic-id-number-x3m-locked-r9oj/page-22#entry4275000

]]> By: Michalis Odysseos https://www.emsisoft.com/en/blog/27099/remove-cry128-ransomware-with-emsisofts-free-decrypter/#comment-787455 Mon, 10 Jul 2017 08:47:00 +0000 http://blog.emsisoft.com/?p=27099#comment-787455 In reply to Sang Made Tri Guna.

Hi Fabian
Should we wait for an update on the encrypter? :)
Please let us know if this is still under development or if we have to give our hopes up!
Best Regards

]]> By: Nicolas Lemmer https://www.emsisoft.com/en/blog/27099/remove-cry128-ransomware-with-emsisofts-free-decrypter/#comment-786927 Tue, 13 Jun 2017 08:31:00 +0000 http://blog.emsisoft.com/?p=27099#comment-786927 In reply to Nicolas Lemmer.

I’d say that the encryption alters the first 10240 bytes,
and appends 36 bytes at the end of the file, looking like this :
22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
BF CC 6C 1D

Only the first byte (here hexadecimal 22) would change from file to file.
Other files will have the same last 35 bytes (32 zeros, and 4 bytes hexa BFCC6C1D
at the end of file).

]]> By: Nicolas Lemmer https://www.emsisoft.com/en/blog/27099/remove-cry128-ransomware-with-emsisofts-free-decrypter/#comment-786925 Tue, 13 Jun 2017 07:53:00 +0000 http://blog.emsisoft.com/?p=27099#comment-786925 Hello, I also have some infected files (let’s say about 200.000 files). Ransomware ID says Cry128 for the “DECRYPT_MY_FILES” note, and Cry36 for sample file. The crypted files are 36 bytes bigger than original files and have this kind of extension : id__gebdp3k7bolalnd4.onion._

The gebdp3k7bolalnd4.onion._ seems shared by other users. I read about the layered encryption
schemes so I guess there is little chance that this kind of encryption can be defeated.

Wish some day those who commit such harm can be caught and face trial !

]]>