[HOW TO] Decrypt and then delete Qlocker encrypted files all at once

[Riverwave]

Context: I was hit by QLocker and have massive files being encrypted. I can only recover about 40 percent files by using QRescue, which I cannot stand for. I paid ransom and got the decryption key.
I found the scripts found online didn't delete the files and will require much more space to the decrypted files. The solution on this post is for how to massively decrypt all 7z files at their original folder location and delete the decrypted files.

Purpose: Decrypt all files at their original folders and delete the decrypted files. . The script will delete the encrypted .7z files after restoring it. You can comment out the del command if you don't want to delete the encrypted 7z file

Precondition: You already have Decryption key.

Step1: (Recommended) Backup your folders to be decrypted

Step2: Install the 7z tool https://www.7-zip.org/download.html

Step3: Open command line window (run cmd from start) on the PC with access to the encrypted folders

Step4: create a batch file (ie. decrypt.bat) with the following code

Code: Select all

SET source=DECRYPTED_FOLDER_TO_BE_RECOVERED
FOR /F "TOKENS=*" %%F IN ('DIR /S /B "%source%\*.7z"') DO (
"C:\Program Files\7-Zip\7z.exe" x -pYOUR_DECRYPTION_KEY "%%~fF" -o"%%~dpF"
del /F "%%~fF"
)

Step5: Run the batch file

Declaimer: Run the script at your risk. Suggest you test it before running it at full scale.

For deadbolt attack, I don't have a way to test it. Would like to know if it work

[FSC830]

Are you really talking from Qlocker or do you mean the latest ransomware Deadbolt?
Even when the decrypt procedure seems to be very similiar, just to avoid confusion.

Regards

[Riverwave]

Are you really talking from Qlocker or do you mean the latest ransomware Deadbolt?
Even when the decrypt procedure seems to be very similiar, just to avoid confusion.

Regards

It's a how-to for decrypting 7z files generated by QLocker. I was attacked on Jan 12 2022.
The solution wasn't tested for Deadbolt attack.

[seedles]

How did you recover the password?

[dolbyman]

From the running 7z process...there is several threads about it

[Robert02]

How did you recover the password?

User Riverwave written above this:
"I paid ransom and got the decryption key."

there is one trick written around but it works if your NAS was never shutdown after the attack

eventually @ FAsTec RAID recovery, we can save the day even if the NAS has been powered off, eventually call us

NAS Data Recovery Service - FAsTec - Servizio Recupero Dati NAS
NAS Recovery FAsTec