Coin Locker - A ransomware that tips its hat to Julius Caesar

What does the Coin Locker Ransomware have in common with Julius Caesar? The answer is an easily decrypted encryption method called the Ceasar Cipher which was used by Julius Caesar to encrypt confidential messages. This encryption method uses letter substitution where each character is replaced with another letter a certain amount of places before or after it in the same alphabet. For example, if the cipher was shifting to the right by 4, A would become E and B would become F. An example of cipher shifting by four characters to the right is shown in the figure below. As this type of cipher simply uses letter substitution it becomes trivial to decrypt.

Coin Locker was first reported towards the end of January and encrypts every file on your computer. Nathan Scott, who analyzed this infection stated "Coin Locker encrypts every file, including executables, that does not contain the word Windows, Mozilla, Google, or Notepad in the file path.". Any file that Coin Locker encrypts would also have the .encrypted extension appended to it. Scott further stated "When Coin Locker encrypts a file it uses a character substitution cipher where it shifts the original character four characters to the left.". This is shown in the source code below that was generated by Scott when he decompiled the Coin Locker executable.
 

Decompiled encryption function from CoinLocker

In every folder that a file is encrypted, Coin Locker will also create a Coin.Locker.txt file that is the ransom note for this infection. This ransom note gives instructions on how to connect to the malware's TOR site, which is now down, and submit payment. It is unknown if anyone has ever made payment for this malware or if developer would even deliver the decryption key.
 

You have been infected with the Coin Locker malware.

All files on this system have been encrypted.

To regain access to your files you will need the Coin Locker decryption software.

To obtain our software you will need to access the deep web with TOR, download TOR here:

https://www.torproject.org/download/download-easy.html.en

Launch TOR and navigate to our website:

http://unjbvgrxu2mpobuj.onion

Follow the steps on the site to use the decryption software and your files will be unlocked.

Due to the simplicity of the encryption algorithm used, Nathan Scott was able to create a decrypter for those affected by this ransomware. To use the decrypter, simply download the following program and save it to your computer:

http://download.bleepingcomputer.com/Nathan/Coin_Locker_Decrypter.exe

Once the program is downloaded, double-click on it to start it. When the program starts, select the drive you wish to decrypt and then click on the Decrypt button as shown in the image below.
 

The decrypter will scan the files on your computer and decrypt any files that contain the .encrypted extension. It should be noted that this tool will not remove the encrypted files, but will instead leave them intact in the event that there are issues. If the decrypter was able to decrypt your files, when it has completed you can use the same tool to delete the encrypted versions of your files.

As always if you have any questions, please do not hesitate to ask.

what a great news !!! it can be decrypted,yeah. as usual,bleeping team are super awesome. super big thanks,especially Grinler and Nathan too, for always helping us.

Edited by Comdark.Bubnix, 03 February 2015 - 04:09 PM.

Great work guys!

Edited by Cody Johnston, 03 February 2015 - 05:46 PM.

Thank's to the team bleeping (Grinler, Nathan and others), I was able to fix the encrypted files.

My encrypted files are not decrypted by this decrypter also. The extension of file is .ayhmife (for eg: 12.ayhmife). So, can anybody help me to decrypt my files. Any help would be highly appreciated.

My encrypted files are not decrypted by this decrypter also. The extension of file is .ayhmife (for eg: 12.ayhmife). So, can anybody help me to decrypt my files. Any help would be highly appreciated.

You most likely have this infection:

http://www.bleepingcomputer.com/virus-removal/ctb-locker-ransomware-information

Thank you for your nice info. 

So, is there any decrypter tool for this? 

I think these low grade cryptos are made by some script kiddies who is hearing those great cryptomalware infection news and want to try out theirs.
Anyway, life is getting miserable due to these unwanted and extra people.
Anyone knows how is the infection catching its prey - drivebys, ads or something else?
.
BTW, good work Nathan, Grinler and other people who make the anti-tools. That tells world has not lost the good people.

Thank you for your nice info. 
So, is there any decrypter tool for this?

No there is no decrypter for ctblocker unfortunately.

Anyone knows how is the infection catching its prey - drivebys, ads or something else?

Unfortunately, we do not know how this one is spreading.

Edited by wadwadi, 15 February 2015 - 07:52 PM.

Hi,
What does the file extension show?

"Any file that Coin Locker encrypts would also have the .encrypted extension appended to it.
The decrypter will scan the files on your computer and decrypt any files that contain the .encrypted extension. It should be noted that this tool will not remove the encrypted files, but will instead leave them intact in the event that there are issues."

Hi,

Now all my files end with : ZBDWXIE

Hello, 
 

Hi,
Now all my files end with : ZBDWXIE

Your files have been encrypted by CTB Locker, not Coin Locker. 
 
See here: 
http://www.bleepingcomputer.com/virus-removal/ctb-locker-ransomware-information

My files are the nomefile.encrypted type and Coinlocker also removing the extension .encrypted not me makes them open if anyone can help .
thank you.