Free Decrypter Available for Terribly Coded BadBlock Ransomware

Exterminator

Level 85
Thread author
Verified
Top Poster
Well-known
Oct 23, 2012
12,527
Emsisoft security researcher Fabian Wosar has released today a free decrypter for the BadBlock ransomware that can help ailing victims recover their files without paying the crooks' ransom.

BadBlock has ensured its place in ransomware lore, but not because of its ability to evade antivirus detection or by using some sort of powerful encryption, but by a huge error in its code that ruins the users' operating system.

BadBlock ruins operating systems
While most ransomware families take great care to filter out filesystem paths like the Windows and Program Files folders, BadBlock doesn't, and the result is as catastrophic as you'd expect.

The ransomware, which normally targets 56 file types among which EXE files, will end up encrypting Windows' executables, making the computer unbootable at the next restart.
BadBlock authors knew this, but they released their ransomware anyway, opting to "recommend" that users keep their computer on, but without mentioning what would happen if they don't.

BadBlock authors request that victims pay up 2 Bitcoin (~$500), which is quite a steep price compared to other ransomware variants.

BadBlock tells victims in real time what file was just encrypted
Another thing that stands out is that BadBlock shows the ransom note as soon as the encryption process starts, even showing the user an animated marquee with the latest file that was encrypted.

The BadBlock authors claim to use strong RSA encryption, storing the private key on their own server. They also recommend that users pay the ransom at a unique Bitcoin address, which they say is constantly monitored for payment.

In case the payment takes place, they tell victims that the decryption process would start automatically. Of course, restarting the PC would render it unresponsive, and all sorts of complications would follow.

The good thing is that a free decrypter is now available, and if you need help using it, there's an in-depth tutorial available on Bleeping Computer.

The BadBlock ransomware was spotted by security researcher S!Ri and was later analyzed by Dell's security team.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top