Victims of CoinVault ransomware can now rely on a new set of encryption keys added to the free CoinVault Ransomware Decryptor tool to recover their files.
Every day, dozens of users ask me how to decrypt their data locked by various ransomware such as CoinVault or Bitcryptor?
Now I have a good news for them, it is possible to use a free tool to recover the encrypted files.
The tool was designed by the experts of the Kaspersky Lab in collaboration with the Dutch police, the experts have used a set of encryption keys extracted from command-and-control (C&C) servers used by two groups that were using CoinVault and Bitcryptor.
In May 2014, the investigators detected numerous attacks based on the CoinVault ransomware that infected more than 1,500 victims in more than 108 countries.
In April 2015, the Dutch Public Prosecution Service extracted a set of CoinVault Decryption keys from a database present on a seized command and control server.
In April 2015, the expert from Kaspersky Lab announced the development of the tool called “CoinVault Ransomware Decryptor”, the researcher teamed up with The National High Tech Crime Unit (NHTCU) of the Dutch Police.
The tool included a set of around 750 decryption keys recovered from CoinVault servers hosted in the Netherlands.
In response to the action of the law enforcement, the authors of CoinVault updated their code and released a new version dubbed Bitcryptor.
Now the law enforcement could rely on additional 14,031 decryption keys obtained last month by the Dutch authorities following the arrest of two men in connection with CoinVault and Bitcryptor ransomware attacks.
The keys have been included in the Kaspersky’s Ransomware Decryptor Service which is available on the noransom.kaspersky.com website.
If you are a victim of CoinVault and Bitcryptor ransomware attacks you can try to download these keys to unlock the encrypted files.
To decrypt the file use the following procedure:
- Step 1: If you are infected with CoinVault, just note down the Bitcoin wallet address mentioned by the malware on the screen.
- Step 2: Get the encrypted file list from ransomware interface.
- Step 3: Download an effective antivirus and remove CoinVault Ransomware first.
- Step 4: Open https://noransom.kaspersky.com and download the decryption tool released by Kaspersky Labs.
- Step 5: Install additional libraries and Decrypt your files.
In order to protect your computer from malware:
- Ensure your system software and antivirus definitions are up-to-date.
- Avoid visits suspicious websites.
- Regularly backup your important files to a separate drive or storage that are only temporarily connected.
- Be on high alert for pop-ups, spam, and unexpected email attachments.
