Ransomware
#12
Hey Ian,

I spent some time a while ago looking at DiskCryptor (same version that you're dealing with). It's complicated by virtue of also having the capability of using keyfiles (which I was dealing with). I'm assuming you don't have any indication these were used. I ended up moving on to something else before I could spend more time on it, but I did write up a terrible python script that will try a wordlist against an encrypted image.

It's quick and dirty, but IIRC, I think it should try about 20-30 passwords a second. It's really slow. It is not a good solution, but since you're dealing with numerical candidates (hopefully!), it might help. You can always run it on multiple computers to speed things up.

I dug it up for you. It breaks easily, and could benefit hugely from a complete rewrite. Feel free to improve it! For now, it's something to start with. If you are dealing with keyfiles and you have found one, I also have a keyfile & password version of this script. Make sure you follow the instructions closely.

https://pastebin.com/D0rmkrbS

Hope it helps.

Like someone else mentioned, if you haven't already done so, contact your local law enforcement and/or a digital forensics company. They may be able to offer more assistance with a proper examination of your devices.


Messages In This Thread
Ransomware - by galeforce9 - 12-13-2018, 07:07 PM
RE: Ransomware - by Mem5 - 12-13-2018, 07:56 PM
RE: Ransomware - by philsmd - 12-13-2018, 08:06 PM
RE: Ransomware - by galeforce9 - 12-13-2018, 08:12 PM
RE: Ransomware - by philsmd - 12-13-2018, 09:12 PM
RE: Ransomware - by Xanadrel - 12-14-2018, 12:07 AM
RE: Ransomware - by galeforce9 - 12-14-2018, 10:52 AM
RE: Ransomware - by philsmd - 12-14-2018, 11:06 AM
RE: Ransomware - by galeforce9 - 12-14-2018, 11:30 AM
RE: Ransomware - by Banaanhangwagen - 12-14-2018, 11:38 AM
RE: Ransomware - by galeforce9 - 12-14-2018, 01:05 PM
RE: Ransomware - by Nubbin - 12-17-2018, 05:58 PM
RE: Ransomware - by galeforce9 - 12-17-2018, 11:02 PM
RE: Ransomware - by Banaanhangwagen - 12-21-2018, 08:42 AM