search

Googulator / TeslaCrack

Decryptor for the TeslaCrypt malware
GNU General Public License v3.0
177 stars 36 forks source link

Reconstruction failed! 001.jpg.vvv doesn't appear to be TeslaCrypted #43

Closed soltscher closed 7 years ago

soltscher commented 7 years ago

Hi, can you help me to decrypt my files?

When i'm running this command: python unfactor_ecdsa.py 001.jpg.vvv 2 2 2 2 7 41 9461 409597 82556995885720973 555591820772755090280730064538952983644566311139071 1605508616607374062938587916891065101878592342871857208988329186518551373

i got this: Reconstruction failed! 001.jpg.vvv doesn't appear to be TeslaCrypted

Demonslay335 commented 7 years ago

Can you share that encrypted file so we can verify the factors are correct?

soltscher commented 7 years ago

Here you can download my sample file: https://1drv.ms/u/s!AhQ7QEIwf5QdnnA-efQqWlnnzJJF

Demonslay335 commented 7 years ago

Ah, you factored the PrivateKeyFile, not the PrivateKeyBC. That's why the ecsda version didn't work.

Here's your PrivateKeyFile to decrypt. You can use TeslaDecoder by BloodDolly, it's a bit simpler to use since it has a GUI.

EB1386B24ACC665D15AE4C065312FE519F223989EE29B0C976B8D7D39EF3C0D7

If any files are skipped, you'll need to factor the PrivateKeyFile for one of them. The PrivateKeyBC (that would decrypt ALL files) is a C121, and would take much longer to factor.

soltscher commented 7 years ago

Thanks alot !!! Your PrivateKeyFile worked !!! Now all files are back to normal.

Decrypting files in folder: F:\ Please wait... Decryption finished. (10503 files decrypted, 0 files skipped, 0 warnings)