【工具分享】LIVE1.5解密工具

最新推荐文章于 2024-06-11 10:19:00 发布

solar专业应急响应团队

最新推荐文章于 2024-06-11 10:19:00 发布

阅读量422

点赞数 9

分类专栏：工具分享文章标签： web安全安全网络网络安全

本文链接：https://blog.csdn.net/2401_83062893/article/details/136848268

版权

工具分享专栏收录该内容

7 篇文章 0 订阅

订阅专栏

1.前言

本篇文章衔接上篇【病毒分析】独家揭秘LIVE勒索病毒家族之1.5（全版本可解密）文章，该文对LIVE1.5版本解密工具的使用进行说明并提供了该工具的下载地址。

2.工具特征

2.1 配置信息

在执行文件的末尾明文存储了文件运行的相关信息。

{'MinDate': <int64 1699574400>, 'MaxDate': <int64 1702944000>, 'AppendedExtension': <'LIVE'>, 'NoteFilename': <'FILE RECOVERY_ID_436BF0.txt'>, 'DropNoteInSpecificDirectories': <true>, 'DirectoriesToDropNoteIn': <@as []>, 'IncludeFiles': <false>, 'FileSet': <['FILE RECOVERY_ID_436BF0.txt']>, 'IncludeDirectories': <false>, 'DirectorySet': <['C:\\Program Files', 'C:\\Program Files (x86)', 'C:\\ProgramData', 'C:\\Windows', 'C:\\msys64', 'C:\\Users\\All Users']>, 'IncludeExtensions': <false>, 'NoneSet': <['exe', 'dll', 'ini', 'tmp', 'url', 'lnk', 'ps1', 'nls', 'shs', 'themepack', 'bin', 'msp', 'wpx', 'bat', 'sys', 'spl', 'scr', 'icl', 'rom', 'msc', 'ico', 'LIVE']>, 'FastSet': <@as []>, 'IntermittentSet': <@as []>, 'FullSet': <['txt', 'log']>, 'EncryptHiddenFiles': <true>, 'EncryptHiddenDirectories': <false>, 'BufferSize': <4096>, 'Percent': <0.02>, 'Segmentation': <512.0>}

MinDate与MaxDate是Unix时间戳，翻译为GMT+8时间如下，程序在此段时间以外不会运行。

2023-11-10 08:00:00 - 2023-12-19 08:00:00。

2.2 勒索信

勒索信明文存在文件末尾。

具体内容如下：

Hello

Your file has been encrypted and cannot be used
To return to the file under the working conditions, you need to decrypt the tools
Decolling all data according to the instructions

Don't try to change or restore the file yourself, which will destroy them
If necessary, you can decrypt a test file for free. Free test decryption is only available for files less than 3MB in size.

To restore files, you need a decryption tool. Please contact us by email.
Please add the file name of this document to the email and send it to me. 【FILE RECOVERY_ID xxxxxx】
I will tell you the amount you need to pay. After the payment is completed, we will make the decryption tool and send it to you.

Customer service mailbox:
locked@onionmail.org
locked@onionmail.org

You can also contact us through intermediary agencies (such as data recovery companies)

If you refuse to pay, you will be attacked constantly. Your privacy -sensitive data will also be announced on Internet.

!! We are a team that pays attention to credibility, so you can pay safely and restore data.

LIVE TEAMI