Resume files locked by Linux Encoder with Bitdefender decryption tool

Bitdefender has discovered for the third time a flaw in Linux Encryption Ransomware Linux Encoder that exposes the decryption Key used to lock the files.

In November  2015, the Russian antivirus firm Doctor Web reported the discovery of a new Linux ransomware dubbed Linux Encoder that was specifically designed to infect Linux systems. The Linux.Encoder1 ransomware encrypts files present on the systems, once a machine is infected it downloads the files containing attackers’ demands and a file containing the path to a public RSA key. The Linux ransomware is launched as a daemon and deletes the original files, subsequently, the RSA key is used to store AES keys used to encrypt files.

The Linux Encoder, reportedly distributed via a vulnerability in eBay’s Magento e-commerce platform, demands the payment of one Bitcoin (roughly $380 at that time) in exchange for the key needed to recover the files.

A week later, the researchers at Bitdefender discovered a flaw in the process for the generation of the AES key used by the ransomware.

The flaw allowed the experts at Bitdefender to develop a decryption tool that automatically recovers files encrypted by the Linux Encoder. The company also provided a script and the procedure to follow to restore the encrypted files. Given the complexity of the procedure, Bitdefender provides free support to any user in need of assistance.

The response of the authors of ransomware not long in coming, they released the third version of the Linux Encoder ransomware that infected a nearly 600 servers worldwide.

Also this time, the security researchers from Bitdefender have managed to find a way to unlock resources blocked by the ransomware. And also this time, they have succeeded for the third time!

What went wrong this time?

When BitDefender disclosed the process used by the malware authors for the generation of the initial values and keys in the previous versions, some security experts ridiculed the developers by suggesting how to improve the ransomware.

“Apparently, the operators actually took note of these sarcastic recommendations; as a result, the IV (initialisation vector) is now generated from a hash of the file size and the filename – 32 bytes from rand() are hashed 8 times and used as the AES-256 key,” Caragea says.” 

If you are one of the victims who got infected by this new variant of Linux.Encoder ransomware you don’t have to pay the ransom to rescue your files, just download the Bitdefender’s Linux.Encoder decryption tool to unlock them.

Pierluigi Paganini

(Security Affairs – Linux Encoder, ransomware)