You are welcome to discuss various security topics with our professional team and other users like you!
Read our Registration Agreement and create your FREE account here!

*

safraga

  • *
  • 3
  • +1/-0
      • View Profile
retrieve Kovter ecryption key
« on: February 05, 2017, 07:13:57 pm »
Hi,
This week I was a new victime of the kovter ransomware.

Now I'me trying to retrieve the encryption key, bet without result.

I have 2 files, first clean from backup and the other is encrypted, if anyone can help me it will be appreciate.

Thank you in advance

safraga
« Last Edit: May 25, 2018, 11:43:21 am by sensadmin »

*

Execute

  • *****
  • 388
  • +55/-0
  • Your friendly neighbourhood IT guy
      • View Profile
Re: retrieve Kovter ecryption key
« Reply #1 on: February 06, 2017, 05:18:55 pm »
Hello, @safraga,
what is the extension of the encrypted files? Or it's the same as the encrypted file you uploaded?

Because there was a script that worked for older versions of Kovter, that you might try out.
The script is given at the end of this article: http://sensorstechforum.com/remove-kovter-ransomware-and-restore-crypted-encrypted-files/

Write back!

Best Regards,
Execute

*

safraga

  • *
  • 3
  • +1/-0
      • View Profile
Re: retrieve Kovter ecryption key
« Reply #2 on: February 07, 2017, 02:57:24 am »
Hello,
I tried this script but it can't find the key.
The extention of both files are JPG and it is the image.
The encrypted file is not readable and the other one yes.

Thank you

safraga

*

Execute

  • *****
  • 388
  • +55/-0
  • Your friendly neighbourhood IT guy
      • View Profile
Re: retrieve Kovter ecryption key
« Reply #3 on: February 07, 2017, 04:40:23 pm »
Hmm, so it is indeed a new version of Kovter and the old decryption script does not work.
You should definitely keep those files intact somewhere if a decryptor tool is released.

For now, I don't see anything that might help you out, except trying some Data Recovery Programs.
Here are a few examples for such software: Recuva by Piriform, Stellar Phoenix Data Recovery.

Kind Regards,
Execute

*

safraga

  • *
  • 3
  • +1/-0
      • View Profile
Re: retrieve Kovter ecryption key
« Reply #4 on: February 07, 2017, 06:14:25 pm »
Thank you for trying to help
At this point, I backup the files that I would like to restor and wait for a decryptor.

Best regards

safraga

*

Execute

  • *****
  • 388
  • +55/-0
  • Your friendly neighbourhood IT guy
      • View Profile
Re: retrieve Kovter ecryption key
« Reply #5 on: February 08, 2017, 09:58:58 am »
That is indeed the thing you should do, @safraga.
I will inform you if a decryption method is found,
but it probably is going to be a long wait.

Best Regards,
Execute