Active Members Fi8sVrs Posted January 13, 2019 Active Members Report Posted January 13, 2019 (edited) This decryptor is intended to decrypt the files for those victims affected by the ransomware PyLocky. This decryptor is built to be executed on Windows systems only and it does require a PCAP of the outbound connection attempt to the C&C servers. This connection is seen seconds after the infection occurs and it will contain, among other info, the Initialization Vector (IV) and a password (both generated randomly at runtime) used to encrypt the files. Without this PCAP containing these values, the decryption won't be possible. The structure of the outbound connection contains an string like: PCNAME=NAME&IV=KXyiJnifKQQ%3D%0A&GC=VGA+3D&PASSWORD=CVxAfel9ojCYJ9So&CPU=Intel%28R%29+Xeon%28R%29+CPU+E5-1660+v4+%40+3.20GHz&LANG=en_US&INSERT=1&UID=XXXXXXXXXXXXXXXX&RAM=4&OSV=10.0.16299+16299&MAC=00%3A00%3A00%3A00%3A45%3A6B&OS=Microsoft+Windows+10+Pro Download: https://github.com/Cisco-Talos/pylocky_decryptor Source https://github.com/Cisco-Talos/pylocky_decryptor Edited January 13, 2019 by OKQL 3 1 Quote
