File Decryption Tool Mac OS X
File Decryption Tool How To Run The

On February 2021, the ransomware authors shut their business down and published the master RSA key that can be used for decrypting files for free.

Please update your browser if you want to see the content of this webpage correctly.

Just click a name to see the signs of infection and get our free fix.

Since then, weve observed multiple variants, with different file extensions.

For encrypting files, the ransomware uses AES-256 combined with RSA-2048.

For encrypting users files, this ransomware uses AES 256 encryption combined with Base64 encoding.

The text on this image can also be used to help identify Bart, and is stored on the desktop in files named recover.bmp and recover.txt.

The encrypted files have new extension.obfuscated appended at the end of the file name.

Since then, we observed five variants, that can be distinguished by encrypted file extension.

The ransomware uses two different encryption methods RC4 and AES 192.

In early 2017, a new variant of CryptoMix, called CryptoShield emerged.

Both variants encrypt files by using AES256 encryption with a unique encryption key downloaded from a remote server.

However, if the server is not available or if the user is not connected to the internet, the ransomware will encrypt files with a fixed key (offline key).

In cases where the offline key was not used to encrypt files, our tool will be unable to restore the files and no file modification will be done.

Update 2017-07-21: The decryptor was updated to also work with Mole variant.

It uses AES-256 combined with RSA-1024 asymmetric encryption.

The message is located in Decryption instructions.txt, Decryptions instructions.txt, README.txt, Readme to restore your files.txt or HOW TO DECRYPT YOUR DATA.txt on the users desktop.

Also, the desktop background is changed to one of the pictures below.

After a half-year development, we caught a new, final version of this ransomware.

It uses AES-128 encryption, using a key that is constant for a given PC and user.

Names of these files are localized, here are their English versions.

File Decryption Tool How To Run The

Refer to the blog post for more detailed instructions how to run the decryptor in case the ransomware is running on your PC.

File Decryption Tool Mac OS X

This ransomware spreads on Mac OS X (version 10.11 or newer).

The encryption is based on creating ZIP files - each encrypted file is a ZIP archive, containing the original document.

Written in C, it uses three key encryption scheme (RSA-4096 master key, RSA-2048 session key, 256-bit file key for SALSAChaCha encryption).