Free Decryptor for Fileslocker Ransomware Developed After Master Key Leaked

Jan 5, 2019


A free decryptor for Fileslocker ransomware has been developed after the leaking of the master key for the ransomware on Pastebin.

The master key is the key utilized by threat actors to decrypt files that have been encrypted by the ransomware. The post was generated on December 29, 2018 and says that the master key, which decrypts the secret key, is “related to V1, V2 version” and that the poster is “waiting for safety workers to create decryption tools.”

A free decryptor for Fileslocker ransomware was developed by Michael Gillespie, the creator of MalwareHunterTeams’s ID Ransomware – A tool that can be utilized to decide what ransomware variation has been used to encrypt files.

Amusingly, a new Christmas-themed form of Fileslocker ransomware was issued in late December which encrypted files and altered the Desktop wallpaper to a Christmassy background. Moreover, the browser on an infected appliance was opened and the Pastebin decryption key was shown.

In order for the free decryptor for Fileslocker ransomware to function, a sufferer must upload the ransomware note from the Desktop. The ransom note has the encrypted decryption key, which is unlocked using the newly developed master key-based decryptor.

Filerlocker ransomware is a ransomware-as-a-service offering that is typically dispersed by associates who get a cut of the profits from any ransom payments they make from dispersing the ransomware. What is not known is why the master key was issued.

The Pastebin posting provides a hint. It ends with the expression “The end is just the beginning,” which indicates that Fileslocker ransomware is no more and the group at the rear of the ransomware is moving on to other tasks. This is not unusual. When ransomware variations are retired, the master keys are often issued online. What the threat group moves onto next is anybody’s guess, but for now, at least, any persons who are infected with Fileslocker ransomware will be able to decrypt their files for free.

If you have been infected with Fileslocker ransomware, you can find out how to decrypt files free on this link.