Proton Ransomware (.[email].c77L; #Restore-files.txt) Support Topic

It's Proton ransomware

Sample

Edited by rivitna, 18 February 2024 - 07:18 AM.

It's Proton ransomware

Sample

Hello,

Is there a decryptor for Proton?

Thanks for your reply.

To decrypt your files, you need the X25519 master private key :-(

@kingeope
 
I have merged your topic into the primary support topic for victims of this ransomware.

To decrypt your files, you need the X25519 master private key :-(

The virus is active on the computer and can also encrypt new files. Doesn't it use the same key for encryption? Would it be possible to find it this way?

Thanks for your reply.

The ransomware contains only the master public key, and immediately encrypts and erases the session private key

Public-key cryptography

Elliptic-curve Diffie–Hellman

Edited by rivitna, 18 February 2024 - 11:15 AM.

The ransomware contains only the master public key, and immediately encrypts and erases the session private key

 

Public-key cryptography

 

Elliptic-curve Diffie–Hellman

And the private key is not on the computer? The device is encrypting without an internet connection. Shouldn't it use the same key again? Wouldn't it be possible to find this key with the debugger? Sorry to bother you with my questions, I'm just wondering if there is a possible solution.

Finally, is this encryption not decrypted in any way? Do you think there is a chance that it will be decrypted in the future? I had important data but I lost it, should I give up hope completely?

Thank you for your response.
 

Whether you can recover (decrypt) your files or not depends on what ransomware infection you are dealing with, the type and strength of encryption used by the malware writers and a variety of other factors as explained in Ransomware Encryption: The math, time and energy required to brute-force an encryption key (Post #16)

 

And the private key is not on the computer? The device is encrypting without an internet connection. Shouldn't it use the same key again? Wouldn't it be possible to find this key with the debugger? Sorry to bother you with my questions, I'm just wondering if there is a possible solution.

Finally, is this encryption not decrypted in any way? Do you think there is a chance that it will be decrypted in the future? I had important data but I lost it, should I give up hope completely?

For the first time, the ransomware generates a pair of session keys, it encrypts these session keys and writes them to the registry.

The ransomware also writes the session public key to the registry.

The next time the ransomware is launched, it will either use the public key from the registry, or generate a new pair.

i have the same problem and i paied to them and they told me they need to access the server again and after accessing it they told me they cant find the key as my windows was formated and i installed a new one but the data is tthere they told me to pay another money to generate the key manualy and after paying they stoped answering me and i need the data ergent is there is any solution

i have the same problem and i paied to them and they told me they need to access the server again and after accessing it they told me they cant find the key as my windows was formated and i installed a new one but the data is tthere they told me to pay another money to generate the key manualy and after paying they stoped answering me and i need the data ergent is there is any solution

Why would you trust the criminals who encrypted your data in the first place? Negotiating with the ransomware developers is not a good idea and in many cases the criminals have no intention of decrypting files after the ransom is paid. See my comments about victim experiences in Should you pay the ransom? (Post #17) in regards to paying the ransom (which is not advisable) or negotiating with the ransomware developers.

You can inform the contact address, so the other will know not to trust this variant, in case the victim decide to pay the ransom.
 

i have the same problem and i paied to them and they told me they need to access the server again and after accessing it they told me they cant find the key as my windows was formated and i installed a new one but the data is tthere they told me to pay another money to generate the key manualy and after paying they stoped answering me and i need the data ergent is there is any solution

decrypt.computer@gmail.com

network.computer@gmail.com