Thousands of ransomware victims may ultimately get some long-awaited release.

The Story of Emsisoft

A New Zealand-based protection company Emsisoft has created a set of decryption tools for Stop.

A group of ransomware that involves Djvu and Puma, which they say can assist victims in regaining some of their files.

Stop is considered to be the most effective ransomware in the world, valuing for more than half of all ransomware viruses.

This is according to the numbers from ID-Ransomware, a free site that assists in identifying viruses. 

But Emsisoft stated that the number is anticipated to be considerably higher.

If you have never had ransomware, you are one of the fortunate ones. 

Ransomware is one of the significant common ways now for some criminals to earn money by infecting computers with malware that bars files by using encryption. 

Once the Stop ransomware affects, it renames a user’s data with one of a number of extensions, replacing, for example, jpg and .png files with .radman, .djvu, and .puma. 

Victims can unbar their files in trade for a ransom demand, usually a few hundred dollars in cryptocurrency.

Not every ransomware is built equally. 

Some safety experts have been able to unbar some victims’ files without paying up by discovering vulnerabilities in the system that powers the ransomware.

This allows them in some events to change the encryption and restore a victim’s files to normal.

Stop is the most advanced ransomware that researchers at Emsisoft have been equipped to crack.

Emsisoft can decrypt files barred by Stop | iTMunch

How Does Emistoft work?

Here are how the tools work.

The ransomware criminals give every victim a “master key.” 

That master key is linked with the first five bytes of every file that the ransomware can encrypt. 

Some types of files, like .png image files, share the identical five bytes in all .png files. 

By matching an original file with an encrypted file and using some mathematical computations, he can decrypt not just that .png file but different .png of the same filetype.

Some filetypes share the same original five bytes. 

Most recent Microsoft Office documents, like .docx and .pptx, share the same five bytes as .zip files. 

Including any before and after file, either one of these filetypes can decrypt the others.

There is a catch, but. 

The decryption tool is “not a cure-all” for the affected computer.

The victim has to see a good before and after of essentially every format that they want to recover.

SEE ALSO: Mark Zuckerberg creates the case for Facebook News

For more updates and the latest tech news, keep reading iTMunch.