Bart

Saw ransomware lately that uses RSA encryption & renames files w\ ".nobackup" extension? @Kafeine @erikloman @malwaremustdie @malekal_morte

@bartblaze it sounds familiar, i will look into a few samples i still have @MalwareMustDie @kafeine @erikloman@malekal_morte

@bartblaze any chance of having a file 'how to decrypt" ? if so you got an gpcode ... @kafeine @MalwareMustDie @erikloman @malekal_morte

@MalwareMustDie AFAIK it encrypts the files w\ AES, but the encryption key itself w\ RSA@kafeine @erikloman @malekal_morte @CassielMocoton

@bartblaze if not mistaken it used RC4 for the files and encrypted the key with RSA1024, it might be a newer version though. #malwaremustdie

@CassielMocoton Yeah, it might be a new(er) version. Just heard this from a friend who has this & wanted to gather some more info forehand.

@bartblaze don't know if you got my DM, try photorec to recover files. Still chances are pretty low and the faster you try the better