Pierluigi Paganini March 03, 2022

Avast released a decryptor for the HermeticRansom ransomware used in recent targeted attacks against Ukrainian entities.

Avast has released a free decryptor for the HermeticRansom ransomware employed in targeted attacks against Ukrainian systems since February 23.

The security firms aim at helping Ukrainians victims in recovering their file for free.

The HermeticRansomware was one of the three components involved in disruptive attacks detailed by ESET researchers:

• HermeticWiper: makes a system inoperable by corrupting its data
• HermeticWizard: spreads HermeticWiper across a local network via WMI and SMB
• HermeticRansom: ransomware written in Go

Researchers from Crowdstrike discovered a logic flaw in the encryption process that can allow researchers to break the encryption. The experts speculate the developers invested limited efforts in testing the ransomware, likely because the encryption was not the end goal of the threat.

“According to analysis done by Crowdstrike’s Intelligence Team, the ransomware contains a weakness in the crypto schema and can be decrypted for free.” reported Avast. “If your device has been infected with HermeticRansom and you’d like to decrypt your files, click here to skip to the How to use the Avast decryptor to recover files.”

Crowdstrike also released a script to recover encrypted files that was used by Avast as part of more friendly tool with an easy-to-use GUI.

The post published by Avast includes detailed instructions to recover the encrypted data.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)

[adrotate banner=”5″]

[adrotate banner=”13″]