I recently was attacked by a ransomware that encrypted files in my computer and turning them into a .CRYSTAL file type. In the ransom note there is a “key id” which resembles a public key of sort, and a computer ID.
I paid - and got a “key” and a decryption program. This decrypts 70% of my server but all the larger files (more than 100MB) remain encrypted. Attacker demands another payment for them to release the “RSA key”. I’m uncertain whether this is a bluff and the file size condition is coded into the decryption program or if they actually used different key for large and small files.
Opening up the decryption exe file in hex editor, I discovered traces of Salsa20 and Chacha. I figured, what if I make the decryption script myself, I wouldn’t run into the file size limitation. The problem lies the initialization vector, how would I know what IV to use?
Thoughts?