.wallet ransomware

[Fuad 0]

I was attacked by .wallet ransomware. It encrypted lo of files. I haven't found out any dycryptor yet. I've tried by kaspersky, avast, eset etc lates dycryptor. But no result came.

can some one decrypt attached file.

SC.pdf.id-209EB95E.[[email protected]].zip

[Marcos 5,739]

The files were encrypted by Filecoder.Crysis. Unfortunately, decryption is not possible. Crysis has been seen to be triggered by an attacker after getting to a computer via unsecured RDP: https://www.bleepingcomputer.com/news/security/number-of-rdp-brute-force-attacks-spreading-crysis-ransomware-doubles-in-6-months/.

It's important to back up important data on regular basis, secure RDP (or disable it, if not needed) and practice safe computing. Also we recommend protecting ESET's settings with a password to prevent unauthorized users from disabling or uninstalling AV.

 

[itman 1,924]

To this, I will add the following bleepingcomputer.com posting: https://www.bleepingcomputer.com/forums/t/632389/dharma-ransomware-filenameemaildharmawalletzzzzz-support-topic/page-72 along with the following quote from it:

If your server has been hit by a .wallet Cryptolocker, don't waste your time searching for a solution. You don't have it except this one: paying a ransom.

[KAMIRAN Support 0]

https://www.bleepingcomputer.com/news/security/wallet-ransomware-master-keys-released-on-bleepingcomputer-avast-releases-free-decryptor/

.Wallet Master key is released . We are waiting for ESET Crysis to be updatet with .wallet keys.

Also AVAST decryptor is detected By ESET (a variant of Win32/Kryptik.RWE trojan - False Positive ) And it must be Corrected.

our Customers want to know When ESET will update crysis decryptor ?

[Marcos 5,739]

18 hours ago, KAMIRAN Support said:

Also AVAST decryptor is detected By ESET (a variant of Win32/Kryptik.RWE trojan - False Positive ) And it must be Corrected.

It's already fixed. The detection was from 2011.

Quote

our Customers want to know When ESET will update crysis decryptor ?

As per the announcement above, an updated version of the Crysis decoder is downloadable from https://download.eset.com/com/eset/tools/decryptors/crysis/latest/esetcrysisdecryptor.exe .

[zdoty 0]

I have tried running the Avast Crysis and Eset Crysis decryption tool.  They have been able to decrypt most of the data.  However there are still a few .wallet files that they are not able to touch.  Unfortunately for me those few files are extremely important.  The log file that the Eset tool is spitting out shows the following:

INFO:  Cleaning file  [The file in question.]

INFO: Can't get header for file.

INFO: Can't get info from file.

ERROR: Not cleaned.

Is there anything I can do to get the files decrypted.

Thanks. 

[Marcos 5,739]

Check the content of the file. It could be that it was renamed but its content wasn't encrypted.

[zdoty 0]

I tried opening the file with notepad and it's completely empty.  All the files are 0kb.