一个勒索软件的解密工具，目前没有通用解密

wwwab

C:\Users\<USER>\Downloads\123.exe
C:\:
C:\$Recycle.Bin\
C:\$Recycle.Bin\S-1-5-21-3711686801-687107597-1149503783-1001\
C:\$Recycle.Bin\S-1-5-21-3711686801-687107597-1149503783-1001\!README!.txt
C:\$Recycle.Bin\!README!.txt
C:\cygwin64\
C:\cygwin64\bin\
C:\cygwin64\bin\!README!.txt
C:\cygwin64\dev\
C:\cygwin64\dev\mqueue\
C:\cygwin64\dev\mqueue\!README!.txt
C:\cygwin64\dev\shm\
C:\cygwin64\dev\shm\!README!.txt
C:\cygwin64\dev\!README!.txt
C:\cygwin64\etc\
C:\cygwin64\etc\alternatives\
C:\cygwin64\etc\alternatives\!README!.txt
C:\cygwin64\etc\crypto-policies\
C:\cygwin64\etc\crypto-policies\back-ends\
C:\cygwin64\etc\crypto-policies\back-ends\!README!.txt
C:\cygwin64\etc\crypto-policies\state\
C:\cygwin64\etc\crypto-policies\state\!README!.txt
C:\cygwin64\etc\crypto-policies\!README!.txt
C:\cygwin64\etc\defaults\
C:\cygwin64\etc\defaults\etc\
C:\cygwin64\etc\defaults\etc\crypto-policies\
C:\cygwin64\etc\defaults\etc\crypto-policies\!README!.txt
C:\cygwin64\etc\defaults\etc\pkcs11\
C:\cygwin64\etc\defaults\etc\pkcs11\!README!.txt
C:\cygwin64\etc\defaults\etc\pki\
C:\cygwin64\etc\defaults\etc\pki\ca-trust\
C:\cygwin64\etc\defaults\etc\pki\ca-trust\!README!.txt
C:\cygwin64\etc\defaults\etc\pki\tls\
C:\cygwin64\etc\defaults\etc\pki\tls\!README!.txt
C:\cygwin64\etc\defaults\etc\pki\!README!.txt
C:\cygwin64\etc\defaults\etc\profile.d\
C:\cygwin64\etc\defaults\etc\profile.d\!README!.txt
C:\cygwin64\etc\defaults\etc\skel\
C:\cygwin64\etc\defaults\etc\skel\!README!.txt
C:\cygwin64\etc\defaults\etc\!README!.txt
C:\cygwin64\etc\defaults\!README!.txt
C:\cygwin64\etc\fstab.d\
C:\cygwin64\etc\fstab.d\!README!.txt
C:\cygwin64\etc\pkcs11\
C:\cygwin64\etc\pkcs11\!README!.txt
C:\cygwin64\etc\pki\
C:\cygwin64\etc\pki\ca-trust\
C:\cygwin64\etc\pki\ca-trust\extracted\
C:\cygwin64\etc\pki\ca-trust\extracted\edk2\
C:\cygwin64\etc\pki\ca-trust\extracted\edk2\!README!.txt
C:\cygwin64\etc\pki\ca-trust\extracted\java\
C:\cygwin64\etc\pki\ca-trust\extracted\java\!README!.txt
C:\cygwin64\etc\pki\ca-trust\extracted\openssl\
C:\cygwin64\etc\pki\ca-trust\extracted\openssl\!README!.txt
C:\cygwin64\etc\pki\ca-trust\extracted\pem\
C:\cygwin64\etc\pki\ca-trust\extracted\pem\!README!.txt
C:\cygwin64\etc\pki\ca-trust\extracted\!README!.txt
C:\cygwin64\etc\pki\ca-trust\source\
C:\cygwin64\etc\pki\ca-trust\source\anchors\
C:\cygwin64\etc\pki\ca-trust\source\anchors\!README!.txt
C:\cygwin64\etc\pki\ca-trust\source\blacklist\
C:\cygwin64\etc\pki\ca-trust\source\blacklist\!README!.txt
C:\cygwin64\etc\pki\ca-trust\source\!README!.txt
C:\cygwin64\etc\pki\ca-trust\!README!.txt
C:\cygwin64\etc\pki\tls\
C:\cygwin64\etc\pki\tls\certs\
C:\cygwin64\etc\pki\tls\certs\!README!.txt
C:\cygwin64\etc\pki\tls\misc\
C:\cygwin64\etc\pki\tls\misc\!README!.txt
C:\cygwin64\etc\pki\tls\private\
C:\cygwin64\etc\pki\tls\private\!README!.txt
C:\cygwin64\etc\pki\tls\!README!.txt
C:\cygwin64\etc\pki\!README!.txt
C:\cygwin64\etc\postinstall\
C:\cygwin64\etc\postinstall\!README!.txt
C:\cygwin64\etc\preremove\
C:\cygwin64\etc\preremove\!README!.txt
C:\cygwin64\etc\profile.d\
C:\cygwin64\etc\profile.d\!README!.txt
C:\cygwin64\etc\setup\
C:\cygwin64\etc\setup\!README!.txt
C:\cygwin64\etc\skel\
C:\cygwin64\etc\skel\!README!.txt
C:\cygwin64\etc\ssl\
C:\cygwin64\etc\ssl\!README!.txt
C:\cygwin64\etc\!README!.txt
C:\cygwin64\home\
C:\cygwin64\home\!README!.txt
C:\cygwin64\lib\
C:\cygwin64\lib\engines-1.1\
C:\cygwin64\lib\engines-1.1\!README!.txt
C:\cygwin64\lib\gawk\
C:\cygwin64\lib\gawk\!README!.txt
C:\cygwin64\lib\groff\
C:\cygwin64\lib\groff\!README!.txt
C:\cygwin64\lib\pkcs11\
C:\cygwin64\lib\pkcs11\!README!.txt
C:\cygwin64\lib\security\
C:\cygwin64\lib\security\!README!.txt
C:\cygwin64\lib\!README!.txt
C:\Users\<USER>\Downloads\6bf5d935980b8789fd1257a2a6bec3dd46a00912707908e4fe150c2388dc0fc4.sample.exe

明明是个勒索病毒，你管这叫解密程序？

ccbea

wwwab 发表于 2021-9-25 11:53
明明是个勒索病毒，你管这叫解密程序？

确实是解密

wwwab

ccbea 发表于 2021-9-25 12:00
确实是解密

那为什么在疯狂!README!.txt（不清楚动作是创建还是查找还是修改还是删除）

anthonyqian

咖啡 GenericRXKK

gtc

下载就被咔嚓了，确实应该是毒！

ccbea

gtc 发表于 2021-9-26 09:05
下载就被咔嚓了，确实应该是毒！

我在沙盒和虚拟机运行了都没反应

kim545

反沙盘虚拟机吧，可是我的bd没反应，但是企业版vt上报了，这么多家都报看样子不干净，还不停readme这么明显的勒索动作

wwwab

#beijingcryptransomware