Petya Ransomware
An individual passing by the twitter handle leostone could make a create an algorithm that can produce the watchword used to decode a Petya encoded PC. In my test this, this calculation could produce my key in 7 seconds.
The arrangement used to create this key is known as a hereditary calculation and is one that that copies the developmental procedure with a specific end goal to take care of issues. As per MathWorks:
A hereditary calculation (GA) is a technique for illuminating both compelled and unconstrained streamlining issues in view of a characteristic choice process that mirrors natural development. The calculation over and again alters a populace of individual arrangements. At each progression, the hereditary calculation arbitrarily chooses people from the present populace and utilizations them as guardians to create the youngsters for the people to come. Over progressive eras, the populace "develops" toward an ideal arrangement.
Leostone has setup a site (you can utilize this site if the other one is down) that a casualty can use to create the key once they give some data from the contaminated drive. The following are directions on the most proficient method to recover the required data so you can utilize leostone's site to create your unscrambling key.
Instructions to produce your Petya Decoding key to unscramble your hard drive
To utilize Leostone's decoding instrument you will require join the Petya influenced drive to another PC and concentrate particular information from it. The information that should be extricated is 512-bytes beginning at part 55 (0x37h) with a counterbalanced of 0 and the 8 byte nonce from area 54 (0x36) balance: 33 (0x21). This information at that point should be changed over to Base64 encoding and utilized on the https://petya-pay-no-ransom.herokuapp.com/ site to produce the key.
Shockingly, for some casualties extricating this information is not a simple undertaking. Fortunately Fabian Wosar made an exceptional apparatus that can be utilized to effortlessly remove this information. So as to utilize this device, you have to take the scrambled drive from the influenced PC and append it to a Windows PC that is working appropriately. On the off chance that your tainted PC has different drives, you should just expel the drive that is theboot drive, or C:\ drive, for your PC.
For the individuals who may think that its hard to expel a hard drive starting with one PC and append it then onto the next, you can buy a USB hard drive docking station. A docking station that I have utilized and suggest is the Inateck FD1003 docking station as it bolsters both 3.5" and 2.5" SATA drives and accompanies all that you have to attach the drive to a PC. Just embed the encoded crash into the docking station and after that join it through the USB link to a working PC.
FD1003 USB Hard Drive Docking Station
FD1003 USB Hard Drive Docking Station
FD1003 USB Hard Drive Docking Station
When you have the scrambled drive joined to a working PC, essentially download Fabian Wosar's Petya Division Extractor and spare it to your desktop. Once spared, separate it and execute the PetyaExtractor.exe program. Once the program begins it will examine the greater part of the removable and settled drives on your PC for ones that contain the Petya Ransomware bootcode. When it recognizes the drive, it will consequently choose it and show a screen like the one beneath.
Petya Extractor
Petya Area Extractor
Petya Area Extractor
Presently, open a web program and explore to either the https://petya-pay-no-ransom.herokuapp.com or https://petya-pay-no-emancipate mirror1.herokuapp.com/ webpage. On this site are two textboxes named Base64 encoded 512 bytes confirmation information and Base64 encoded 8 bytes nonce. All together for leostone's site to produce your decoding key, you have to enter the information extricated from Fabian's Petya Part Extractor into these textboxes.
In Petya Extractor, tap on the Duplicate Part catch, which will duplicate the 512 byte check information to your clipboard. Presently backpedal to the decoding site and glue (Control+V) the check information into the textbox marked Base64 encoded 512 bytes confirmation information.
At that point backpedal to the Petya Area Extractor and tap on the Duplicate Nonce catch to duplicate the nonce to your clipboard. At the end of the day, backpedal to the decoding site and after that backpedal to the unscrambling site and glue (Control+V) the nonce into the textbox named Base64 encoded 8 bytes nonce.
When you are done, the unscrambling site ought to have information in both textboxes as demonstrated as follows.
Petya Unscrambling Site with Information Entered
Petya Unscrambling Site with Information Entered
Petya Unscrambling Site with Information Entered
To create your unscrambling secret key, tap on the Submit catch. Leostone's site will now execute the hereditary calculation that is utilized to make your secret word for the Petya Ransomware bolt screen. This procedure shouldn't take over a moment, and when done, will show your secret key as demonstrated as follows.
Petya Decoding Key Found
Petya Decoding Key Found
Petya Decoding Key Found
Presently record this secret key and append your scrambled hard drive over into the first PC. With the drive appended, boot up the contaminated PC and when it gets the Petya Ransomware bolt screen, enter the created secret key. The secret key ought to be acknowledged and the ransomware will start to decode your hard drive.
Hard Drive being Decoded
Hard Drive being Decrypted
Hard Drive being Decoded
Once the hard drive is decoded, the ransomware will provoke you to reboot your PC and it should now boot regularly.
For the individuals who might want to demonstrate their thankfulness, there is a gift catch on Leostone's unscrambling site.
Refresh (4/11/16): Included data about the mirror unscrambling site if the essential is down. The mirror site: https://petya-pay-no-recover mirror1.herokuapp.com/
Source : https://ntechservices.blogspot.com/2017/07/private-decryption-key-for-original.html
