Avast released a decryptor for the HermeticRansom ransomware

Avast has released a free decryptor for the HermeticRansom ransomware employed in targeted attacks against Ukrainian systems since February 23.

The security firms aim at helping Ukrainians victims in recovering their file for free.

The HermeticRansomware was one of the three components involved in disruptive attacks detailed by ESET researchers:

HermeticWiper: makes a system inoperable by corrupting its dataHermeticWizard: spreads HermeticWiper across a local network via WMI and SMBHermeticRansom: ransomware written in GoResearchers from Crowdstrike discovered a logic flaw in the encryption process that can allow researchers to break the encryption. The experts speculate the developers invested limited efforts in testing the ransomware, likely because the encryption was not the end goal of the threat.

“According to analysis done by Crowdstrike’s Intelligence Team, the ransomware contains a weakness in the crypto schema and can be decrypted for free.” reported Avast. “If your device has been infected with HermeticRansom and you’d like to decrypt your files, click here to skip to the How to use the Avast decryptor to recover files.”

Crowdstrike

Crowdstrike also released a script to recover encrypted files that was used by Avast as part of more friendly tool with an easy-to-use GUI.The post published by Avast includes detailed instructions to recover the encrypted data.

The post Avast released a free decryptor for the HermeticRansom that hit Ukraine appeared first on Security Affairs.