<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div><br>On 22 Nov 2013, at 2:16 pm, Jerry Leichter <<a href="mailto:leichter@lrw.com">leichter@lrw.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div>On Nov 21, 2013, at 9:08 PM, Greg Broiles wrote:</div><blockquote type="cite"><div dir="ltr">According to Steve Gibson at <a href="https://www.grc.com/sn/sn-427.txt">https://www.grc.com/sn/sn-427.txt</a>, when CryptoLocker contacts the central server(s), the servers generate a unique (per victim) 2048-bit RSA keypair; the public key is sent from the server to the infected machine. The infected machine generates a random 256 bit AES key, which is then encrypted with the public key and sent to the server, and used locally to encrypt the ransomed files. The key stored in the infected machine's registry is the public half of the RSA key. <br>
</div></blockquote></div>This does mean that if you manage to catch the program while it's running, you can (in principle; the practice may be quite difficult) extract the AES key, which is all you need - the RSA keypair is purely secondary. <div><br></div><div><br></div></blockquote><div><br></div><div>Perhaps a large enough crib file could be placed on the drive prior to encryption? This way you may be able to recover the key?</div><div><br></div><div>Cheers,</div><div><br></div><div>Chris</div></body></html>