search

Googulator / TeslaCrack

Decryptor for the TeslaCrypt malware
GNU General Public License v3.0
177 stars 36 forks source link

Error: factors don't divide AES pubkey #28

Closed hermanndp closed 8 years ago

hermanndp commented 8 years ago

Hi, congratulation first for the good job done. I've an issue with the script. It shows the following error " Error: factors don't divide AES pubkey". Can you help me with? I've already recovered key and FF it. Thanks in advance. Hermann

Googulator commented 8 years ago

You have probably mistyped one of the factors, or accidentally factorized the wrong number (e.g. due to typo).

hermanndp commented 8 years ago

It sounds a bit weird because I copy/paste it. Can you help me and verify my Aes key if I send you a crypted file?

Demonslay335 commented 8 years ago

If you share an encrypted file, we can help you.

hermanndp commented 8 years ago

Here you are link to my encrypted files: http://we.tl/2Ah0P44WAE Any help is appreciated.

Demonslay335 commented 8 years ago

Here's your PrivateKeyFile using the factors I assume you submitted. Not sure if this will be the only key for your system. You can use this with teslacrack.py.

1B5C52AAFCFFDA2E71001CF1880FE45CB93DEA4C71328DF595CB5EB882A3979F

If you want all of your files in one go, you will need to factor the following number, and use unfactor_ecda.py to build the PrivateKeyBC, then use TeslaDecoder to decrypt ALL of the files. It's a tough one, seems to only go down to a C147 after a few rounds of ECM (I don't have my powerful system open right now).

SharedSecret1*PrivateKeyBC: 412761394895657458237201891806797015232271824497659843776412742924187351523166117923853709326249770152212254558528695717264080290756963558617391544048089

hermanndp commented 8 years ago

Thanks for the PrivaeKeyFIle. I tried it and works like a charm. I had already FF the decimal key and uploaded it on factordb.com . I don't know what goes wrong with unfactor.py ... Now I'll try to have my files back! Thanks for help

Demonslay335 commented 8 years ago

Awesome. :)

If it skips any files because of different key, it would be best to go after the PrivateKeyBC by factoring the number above.

ankostis commented 8 years ago

@hermanndp Would you mind if I attach your files as TCs? (sorry, for the late question)

hermanndp commented 8 years ago

Surely! If it is for a good purpose, you can use them! Ask for any question about. P.s. I decrypted successfully my data. I will decrypt some more to help us defeating this sort of ransomware!

ankostis commented 8 years ago

Thank you!

If you come across another key, please share it. I'm afraid to infect my virtualbox, just for collecting test-cases :-)