All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 6 posts ] 
Author Message
 Post subject: Media repair tool for MP3 and WAV affected by STOP/DJVU
PostPosted: June 13th, 2020, 21:25 
Offline

Joined: May 13th, 2019, 7:50
Posts: 204
Location: Nederland
I am working on a small repair tool that allows you to repair MP3 and WAV files that are affected by STOP/DJVU ransomware. To test it I need files encrypted by this ransomware. To repair WAV files the tool requires a reference file: A file recorded with the same device or same software as the victim files.

So, if you have any of those and would like me to repair them, please share them with me. I’ll then try to adjust the tool to repair them and send it to you so you can repair the rest of the files. So, I do not need tons of them, send me, say 10 + reference file if possible

Drop me a PM and the URL where you’ve uploaded them (Google Drive or similar).

"Stop is believed to be the most active ransomware in the world, accounting for more than half of all ransomware infections, according to figures from ID-Ransomware, a free site that helps identify infections. But Emsisoft said that figure is likely to be far higher." - source, https://techcrunch.com/2019/10/18/stop- ... ion-tools/

If time permits I'll keep adding more file types.

_________________
www.disktuna.com - photo repair service


Top
 Profile  
 
 Post subject: Re: Media repair tool for MP3 and WAV affected by STOP/DJVU
PostPosted: June 14th, 2020, 0:56 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 2976
Location: CDRLabs @ Chandigarh [ India ]
Joep Sir ,
I get daily cases of this ransomeware ,So you have been researching and i believe you know there are some tools that repair files of a particular type ,Can you share that too ,Drop me a pm with your email id and i will keep sending you references of few file formats ,Today itself i have three active cases with me

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Media repair tool for MP3 and WAV affected by STOP/DJVU
PostPosted: June 16th, 2020, 7:43 
Offline

Joined: May 13th, 2019, 7:50
Posts: 204
Location: Nederland
Well, 'researching' ...

I discovered by accident that a few JPEGs I had been repairing for a client were actually JPEGs affected by a STOP/DJVU variant (checked and confirmed with https://id-ransomware.malwarehunterteam.com/).

So then the only logical conclusion was that the file was not entirely encrypted, else I would not have been able to make the JPEG data visible. Only a portion of the files is encrypted by variants of STOP/DJVU. It can clearly be seen in attached picture, where JPEG-Repair strips any file from any data that prevents a JPEG decoder from decoding data.

So idea is, in general, that for specific file types it may be possible to strip it from corrupt/encrypted data + glue in a valid header + maybe restore some pointers within header to point to the data that survived encryption.

The larger the file, the smaller the effect of the encryption. Based on what I have seen STOP/DJVU variants encrypt 150 KB or so in digital photos (JPEG, CR2, NEF).

I am by no means a ransomware specialist, and the idea of repair is only even possible on data that wasn't actually encrypted.


Attachments:
2020-01-03 (1).jpg
2020-01-03 (1).jpg [ 78.89 KiB | Viewed 4346 times ]

_________________
www.disktuna.com - photo repair service
Top
 Profile  
 
 Post subject: Re: Media repair tool for MP3 and WAV affected by STOP/DJVU
PostPosted: June 21st, 2020, 11:16 
Offline

Joined: May 13th, 2019, 7:50
Posts: 204
Location: Nederland
working on adding video https://youtu.be/_2ZMRvbnOk4

_________________
www.disktuna.com - photo repair service


Top
 Profile  
 
 Post subject: Re: Media repair tool for MP3 and WAV affected by STOP/DJVU
PostPosted: June 21st, 2020, 15:40 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 2976
Location: CDRLabs @ Chandigarh [ India ]
Wow ,
Keep The Development Alive

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Media repair tool for MP3 and WAV affected by STOP/DJVU
PostPosted: June 23rd, 2020, 16:11 
Offline

Joined: May 13th, 2019, 7:50
Posts: 204
Location: Nederland
K. Got something. https://youtu.be/3AKJ27sZ9_E

_________________
www.disktuna.com - photo repair service


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 10 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group