This question already has an answer here:

Does anybody know if the recent flavour of Petya ransomware (active in June 2017) is somewhat different from one that appeared back in 2016?

I am only interested in the decrypting approach.

This was asked back here. But I can't find any info on how relevant that solution is to the recent case.

Thank you.

marked as duplicate by Pimp Juice IT, Overmind, music2myear, Ramhound, fixer1234 Jul 10 '17 at 0:48

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I would say that your question is just a duplicate of your linked one, and you've even said as much. There could be an argument made on the distinction between the different variants of Petya (2016 vs 2017) though... – Kaizerwolf Jun 30 '17 at 12:49

I am only interested in the decrypting approach.

At this time there is no known flaw with the encryption method used by Petya, that means, there isn't an approach except to use the decryption key. Since the criminal's email provider deactived their account, that is not possible, which means IT IS NOT possible at this time to decrypt files encrypted by the Petya variation that uses the SMBv1 vulerability.

The only method that existed to get the decryption key was to pay the ransome, which is not possible because the criminal's email provider deactived their account

  • The newest variation of this malware is in the news, and there are news articles about it not being possible to get the decryption key if your effected, so I don't feel the need to provide articles since they would be out of scope for this question due to it having nothing to do with the decrypting approach. – Ramhound Jun 30 '17 at 12:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.