Rakhnidecryptor claim to found the key, but decrypted files still unusable.

[Davide Gatti]

In 2015, my Hard Disk was completely encrypted by a ransom that renamed all the files this way: Destra e *****@*****.tld
Even then the rakhnidecryptor tool said it had decrypted the files, but then they were still unusable.

It has now been almost 10 years and numerous versions of rakhnidecryptor have come out, and each time I try to decrypt, but the files remain unusable.

I had already written in this forum, but I can no longer find the post, so I am reposting here with updated links, the request to look into this variant, which at first glance seems to encrypt a larger portion of files, approximately 1048576 bytes (0x100000h). I have the impression that the problem may just be that.
https://drive.google.com/file/d/1UuZQM1HTHK8WNcLLXmCfuIt8ktdqNDXf/view?usp=drive_link 

Also here you can download, a couple of samples file crypted and uncrypted file, to allow you to compare both kind.https://drive.google.com/file/d/1_V9OQhgjVbqYRnOGgK3VeEYX4DMPw42Y/view?usp=drive_link

I thank you in advance for any news about this, although it has now been 10 years.

Thanks

Davide

 

 

[Berny]

@Davide Gatti Welcome.

Please see → https://www.nomoreransom.org/en/index.html

Unfortunately in a lot of cases  files can't be decrypted without the private key that is only known by the attacker and paying the ransom does not guarantee the encrypted files will be unlocked.

Also please see → How to protect your PC against file-encrypting ransomware