Ctb-locker virus Author releases key database dump

Locker Ransomware Author allegedly releases Database Dump of Private Keys

allegedly, the author of the "Locker" Ransomware has uploaded a dump of the C2 server database, releasing private keys Of infected hosts to the public.

Allegedly, the author of the "Locker" Ransomware has uploaded a dump of the C2 server database, releasing private keys of  Infected hosts worldwide to the public. The "author" claims that the release is a mistake, that's no further keys would be utilized for encryption, and that Automat IC decryption of all affected hosts would begin on June 2nd.

This was the post made by the alleged author, uploaded to [Url=http://pastebin.com/1wzgqruh] on 05/30/2015.

Hi, i am the author of the Locker ransomware and I ' m very sorry about this has happened. It is never my intention to release this. I uploaded the database to mega.co.nz containing "Bitcoin address, public key, private key" as CSV. This was a dump of the complete database and most of the keys weren ' t even used. All distribution of the new keys has been stopped. hxxps://mega.co.nz/#!w85whbsb! Kab-5vs1gf20zyziuogmoaywdsi87o4qhjbqjiow6z4 automatic decryption'll start on 2nd for June at midnight. @devs, as you might being aware the private key is used in the RSACryptoServiceProvider class. NET and files are encrypted WI Th AES-256 bit using the RijndaelManaged class. this is the structure of the encrypted files: -the bit integer, Header Length-byte Array, header (length is previous int) *decrypt byte array using RSA & private key. decrypted byte array contains:--bit integer, iv length-byte array, IV (length is in previous int)-bit integer, key length-b Yte ARRay, Key (length is in previous int)  -Rest of the data are the actual file which can be decrypted using Rijndaelmanag Ed and the IV and Key again sorry for all the Trouble. poka brightminds ~ V

[b] File information[/b]

Name: [b]database_dump.csv[/b]

Size: [b]127.5 mb[/b]

md5: d4d781412e562b76fe0db0977cf6279b  

sha-1: 6ba671ce2a6c256c74d7db81186b0dbddd5e2185  

sha-256: d7fd791b86615fada64fe0290aecb70e5584b9ac570e7b55534555a3b468b33f  

virustotal:https://www.virustotal.com/en/file/d7fd791b86615fada64fe0290aecb70e5584b9ac570e7b55534555a3b468b33f /analysis/1433015747/

Based on a brief analysis, the file seems non-malicious and does contain a large quantity of RSA keys.
The CSV file contains Bitcoin addresses and RSA keys.

Open at your own risk, until further analyses is performed.

UPDATE May 31th,

Nathan Scott, an experienced programmer who can often is found developing and releasing decryption utilities and other SEC urity-related Tools on bleepingcomputer.com, have created adecrytpion utility for Thelockerransomware.

The decryption utility can be downloaded from the below Url:https://easysyncbackup.com/downloads/lockerunlocker_ V1.0.6.0.exe

About the Author Michael Fratello

Michael Fratellois a Security Engineer employed by Ciphertechs, Inc., a privately held information Security services provider located in D  Owntown Manhattan, New York. Specializing in penetration testing and Digital forensics, Michael, a St. John's University graduate majoring in computer Security Systems, have developed a passion for information security and often spends he free time studying, programming, a nd researching the exponentially growing number of threats found in-the-wild today.

Edited by Pierluigi Paganini

(Security Affairs –locker, malware)

Original address: http://securityaffairs.co/wordpress/37346/cyber-crime/locker-ransomware-db-dump.html

Ctb-locker virus Author releases key database dump