Unnamed Ransomware Uses Backdoored Crypto API, Unlock Keys Available

Decryption keys for the malware was released by the software developer whose example encryption code was used by a strain of ransomware.

The malicious software without a name encrypts users’ files on compromised Windows PCs using the AES algorithm. It appends the .locked extension to the ciphered documents before demanding a fee of 0.5 BTC from victims in order to obtain a decryption key.

The creators of the unnamed ransomware based their primordial malware on EDA2, a toolkit of file-encrypting sample code which demonstrates how ransomware works. Unfortunately, this appeared to be a huge mistake.

The creator of EDA2 intentionally left a backdoor in his code, and had little hesitation in revealing it to undo the newbie malware slingers. This is what the security blogger David Bisson wrote:

“Utku Sen, the man behind the project, intentionally inserted a backdoor into his code when he first developed EDA2 to make sure he could check potential abuses of his code. It is this backdoor access Sen leveraged in this particular case to obtain a list of decryption keys, which are now available for download.”

Ransomware creators have made crypto mistakes before, often quickly returning with malign code that’s far harder if not impossible to break. For that reason, it is premature to think that the new have-a-go extortionware has been knocked out, despite suffering a heavy blow.

Rewriting the code to use a different file encrypting engine will take some heavy lifting, though it would be naive to imagine that the unknown hackers behind the scam would take this as a reason to abandon their project.

Here is the full list with the uncovered unlock keys: