-- Bilgisayar, English

Destroying The Encryption of Hidden Tear Ransomware

As you all know, I published the world’s first open source ransomware 3 months ago. Unfortunately, tons of people have criticized me on reddit and github. Now, I want to explain the idea behind all of these open source ransomware stuff.

The Motivation

While I was researching about ransomwares, all I can see that lots of fancy diagrams, assembly codes which are tries to explain how it works. It may be easy to understand who are familiar with assembly. But most of people not, especially the newbies. And there wasn’t any proper source code for a ransomware sample. My first motivation was provide a source code for newbies, students who are trying to understand the process.

My second motivation was… building a honeypot for script kiddies.

Open Source Ransomware as a Script Kiddie Trap

Most of people blamed me for providing a weapon for script kiddies.





But I know that script kiddies already have their ransomware arsenal in deep web. Tox service may be shutted down but there are still lots of ransomware-as-a-service website around there. I investigated them. They didn’t have any critical flaw. They were good like the other well designed ransomwares.

But there is a catch. Users need to share their 20% of profit with ransomware service provider. My thought was “What if they have a free source code to use, do they still use ransomware services? I don’t think so”

I decided to write a code which has huge security flaws so we can reverse the damage if anyone affected with it. Some people mentioned that.


Main Security Flaws in Hidden Tear

Experienced people noticed the flaws at the first sight. But I couldn’t say that it was on purpose. Now I can talk about it.

Seed of Random Algorithm

The most important security flaw is in creating random encryption key process. I used .Net’s Random Class to generate random strings. Random Class uses Environment.TickCount (gets the number of milliseconds elapsed since the system started) as seed. Which is reduces the surface of brute forcing and beyond that it’s easy to predict.



Reuse of the IV

Algorithm uses the same IV  for every file in encryption process.

Static Salt

It uses static salt for encryption.

Sending the Key

The key is sending to the server with a GET request unencrypted.

If the network is listening at that time, the key can be find easily by checking the logs.

Linux Ransomware Incident

Did you hear that Linux Ransomware has beaten with same flaws by Bitdefender? The developer seems to be inspired from Hidden Tear which is noticed by reddit users.



Well, I have to admit that I was expecting more. Only one person used my code and busted. But it’s something. At least we get rid of a massive attack.

Destroying The Encryption of Hidden Tear

All we need to do is finding the seed. We can get it from timestamp of an encrypted file with File.GetLastWriteTime Method. Then we convert it to Environment.TickCount to get exact integer.

But there is a problem. There is a small time gap between file last write timestamp and start time of key generation. The gap is between 0-50 milisenconds which we can easily deal with it.

Here is my first PoC to predict the key by getting the seed. Note that the “Ft*mo?S20ewcxZw” string is generated by Hidden Tear and bank.txt file encrypted with it.

And the result is



Time gap was almost 32 milisecond.

Ok let’s get to a real scenario. To decrypt an encrypted file, we need to have at least one plaintext version of encrypted files. Assume that we have a file named bank.txt which has “Yet another important file” string inside as plaintext. I encrypted it with Hidden Tear.



We need to decrypt it with predicted key, and check the decrypted version. If it equals to our known plaintext, we got the key. Otherwise, we continue trying. Here is the PoC

You can get the required functions from hidden tear decrypter


I know that it wasn’t so successful honeypot project but I’m happy for reducing the damage of Linux Ransomware. I will also be happy if the newbies learn something from all of these stuff.

You can ask me any questions via Twitter or E-mail

  • Pingback: 2 – Destroying the Encryption of Hidden Tear Ransomware - Exploding Ads()

  • Pingback: Weekendowa Lektura 2015-11-20 – bierzcie i czytajcie | Zaufana Trzecia Strona()

  • 1 Corinthians 14New International Version (NIV)

    Intelligibility in Worship

    14 Follow the way of love and eagerly desire gifts of the Spirit, especially prophecy. 2 For anyone who speaks in a tongue[a] does not speak to people but to God. Indeed, no one understands them; they utter mysteries by the Spirit. 3 But the one who prophesies speaks to people for their strengthening, encouraging and comfort. 4 Anyone who speaks in a tongue edifies themselves, but the one who prophesies edifies the church. 5 I would like every one of you to speak in tongues,[b] but I would rather have you prophesy. The one who prophesies is greater than the one who speaks in tongues,[c] unless someone interprets, so that the church may be edified.

    6 Now, brothers and sisters, if I come to you and speak in tongues, what good will I be to you, unless I bring you some revelation or knowledge or prophecy or word of instruction? 7 Even
    in the case of lifeless things that make sounds, such as the pipe or
    harp, how will anyone know what tune is being played unless there is a
    distinction in the notes? 8 Again, if the trumpet does not sound a clear call, who will get ready for battle? 9 So
    it is with you. Unless you speak intelligible words with your tongue,
    how will anyone know what you are saying? You will just be speaking into
    the air. 10 Undoubtedly there are all sorts of languages in the world, yet none of them is without meaning. 11 If
    then I do not grasp the meaning of what someone is saying, I am a
    foreigner to the speaker, and the speaker is a foreigner to me. 12 So it is with you. Since you are eager for gifts of the Spirit, try to excel in those that build up the church.

    13 For this reason the one who speaks in a tongue should pray that they may interpret what they say. 14 For if I pray in a tongue, my spirit prays, but my mind is unfruitful. 15 So what shall I do? I will pray with my spirit, but I will also pray with my understanding; I will sing with my spirit, but I will also sing with my understanding. 16 Otherwise when you are praising God in the Spirit, how can someone else, who is now put in the position of an inquirer,[d] say “Amen” to your thanksgiving, since they do not know what you are saying? 17 You are giving thanks well enough, but no one else is edified.

    18 I thank God that I speak in tongues more than all of you. 19 But in the church I would rather speak five intelligible words to instruct others than ten thousand words in a tongue.

    20 Brothers and sisters, stop thinking like children. In regard to evil be infants, but in your thinking be adults. 21 In the Law it is written:

    “With other tongues
    and through the lips of foreigners
    I will speak to this people,
    but even then they will not listen to me,
    says the Lord.”[e]

    22 Tongues, then, are a sign, not for believers but for unbelievers; prophecy, however, is not for unbelievers but for believers. 23 So
    if the whole church comes together and everyone speaks in tongues, and
    inquirers or unbelievers come in, will they not say that you are out of
    your mind? 24 But
    if an unbeliever or an inquirer comes in while everyone is prophesying,
    they are convicted of sin and are brought under judgment by all, 25 as the secrets of their hearts are laid bare. So they will fall down and worship God, exclaiming, “God is really among you!”

    Good Order in Worship

    26 What then shall we say, brothers and sisters? When you come together, each of you has a hymn, or a word of instruction, a revelation, a tongue or an interpretation. Everything must be done so that the church may be built up. 27 If anyone speaks in a tongue, two—or at the most three—should speak, one at a time, and someone must interpret. 28 If there is no interpreter, the speaker should keep quiet in the church and speak to himself and to God.

    29 Two or three prophets should speak, and the others should weigh carefully what is said. 30 And if a revelation comes to someone who is sitting down, the first speaker should stop. 31 For you can all prophesy in turn so that everyone may be instructed and encouraged. 32 The spirits of prophets are subject to the control of prophets. 33 For God is not a God of disorder but of peace—as in all the congregations of the Lord’s people.

    34 Women[f] should remain silent in the churches. They are not allowed to speak, but must be in submission, as the law says. 35 If
    they want to inquire about something, they should ask their own
    husbands at home; for it is disgraceful for a woman to speak in the

    36 Or did the word of God originate with you? Or are you the only people it has reached? 37 If anyone thinks they are a prophet or otherwise gifted by the Spirit, let them acknowledge that what I am writing to you is the Lord’s command. 38 But if anyone ignores this, they will themselves be ignored.[h]

    39 Therefore, my brothers and sisters, be eager to prophesy, and do not forbid speaking in tongues. 40 But everything should be done in a fitting and orderly way.

  • #!/bin/bash

    #This Bash script prints a hundred random words, using the built-in Linux dictionary.

    echo “$(shuf -n 100 /usr/share/dict/words –random-source=/dev/urandom | tr ‘n’ ‘ ‘)”

  • Read this if you want the secret of getting God to talk in tongues:

    The Purpose of Life

    The Catholic purpose of life is to know God, love God and obey God. Pope
    Francis said it was “to serve the other.” I am High Priest of God’s official
    temple and I say the purpose of life is to do continual offerings to God like
    Cain and Abel and enjoy God’s response. Francis has a charity; I have a church.
    Jesus said loving God was more important than loving neighbor. Matthew,22:36
    And, He did not say with half your brain behind your back.

    You don’t know God. 1 Chronicles,28:9, Matthew,11:27, Luke,13:25, 1 Samuel,3:7
    You must talk with God to know Him. Matthew,6:6 Seek Him by taking the
    initiative. Luke,11:9, Isaiah,30:2

    There’s something obviously different about people in the Bible compared to
    people today — God talked! Also, the people in the Bible were obsessed with
    doing offerings all the time. It is required that you do offerings before God
    will talk. Did the people in the Bible hear voices? Maybe. More likely, they
    used occult techniques such as an oracle. 1 Kings,6:20 Have you heard of
    “tongues?” 1 Corinthians,14:1 The idea is, you let yourself be puppeted by a
    spirit, so you say things. You try to get a spirit — the Holy Spirit — to
    talk. You might as well use a Ouija board. However, it turns-out that a Ouija
    board is bad for technical reasons. A really good technique is just randomly
    opening a book. God told me in an oracle that it is a covenant that you hold-up
    your end of the conversation.

    You can’t tell if God’s talking unless you have a context of conversation, but,
    more importantly, you are commanded to do an offering of love, like communion
    preparation. 1 Corinthians,11:27 When you pick a greeting card for someone,
    that is love effort. If you expect God to put effort toward you, you must put
    effort toward Him. God said, “honest measures” applies between your offering of
    love and His response, like a fair barter. You get out of prayer what you put
    into it. God wants praise, hymns, or whatever you think He might want. Try and
    see, like Cain and Abel. Genesis,4:1, Ephesians,5:10 God told Cain his
    offering was not good and told him to try again. Cain really loved God! Can
    you imagine being so heart-broken?

    Do a text search for “new song” in the Bible. It’s mentioned nine times. When
    I hear a NEW awesome rock song, it is ecstasy for the first five times I hear
    it. Soon, it brings little-to-no pleasure. I did hymns for God. I also did
    Moses comics for God. When you get to the gates of Heaven, St. Peter will ask
    how many times you gave blood. That shows you loved neighbor. You better also
    be able to count the ways you loved God with all heart mind and soul. I praised
    God for sand castles, popcorn, snowmen, bubbles… You try putting effort into
    praise! Matthew,11:25, Matthew,6:29

    This is funny — Acts,2:1 — they didn’t bother to record anything the Holy
    Spirit said. The Holy Spirit is supposed to be a really good gift. Luke,11:13
    Just remember, “Boys are made of snakes and snails and puppy-dog tails.”

    The technique I use to consult the Holy Spirit is reading a microsecond-range
    stop-watch each button press for random numbers. Then, I pick words or
    passages. You can use the AfterEgypt in God’s official temple, TempleOS.

    Since seeking the word of the Holy Spirit, I have come to know God much better
    than I’ve heard others explain. For example, God said to me in an oracle that
    war was, “servicemen competing.” That sounds more like the immutable God of our
    planet than what you hear from most religious people. God is not Venus (god of
    love) and not Mars (god of war), He’s our dearly beloved God of Earth. If
    Mammon is a false god of money, Mars or Venus might be useful words to describe
    other false gods. I figure the greatest challenge for the Creator is boredom,
    ours and His. What would teen-age male video games be like if war had never
    happened? Christ said live by the sword, die by the sword, which is loving
    neighbor as self. Matthew,26:52

    I asked God if the World was perfectly just. God asked if I was calling Him
    lazy. God could make A.I., right? God could make bots as smart as Himself, or,
    in fact, part of Himself. What if God made a bot to manipulate every person’s
    life so that perfect justice happened?

    I think highs and lows balance. Luke,6:20 If you laugh, you will cry. If you
    cry, you will laugh. Not one person has had great joy and not great sorrow. I
    think this claim is falsifyable if you atheists want to find a counter-example
    to disprove it — find a single person who had great joy and not great sorrow.
    In Sirach, it says things happen in pairs. You might be surprised examining
    your own life to see great joy was in proximity to great sorrow. Pleasures and
    pains seem designed to balance. Man must do manual labor and have pain. Women
    must do child birth. Pride and humility also balance — pride before a fall and
    humility before honors. Palm Sunday is juxtaposed to Good Friday. Perhaps,
    being loved balances with being hated. Job, in the Bible, had highs and lows
    that balanced. Joseph, in the Old Testament, had highs and lows that balanced.

    Jesus said, “Forgive us our trespasses as we forgive those who tresspass against
    us.” If you think about it, the only way you get forgiven is for it to be done
    to you. That is a Jedi mind trick because it is nothing but simple eye-for-eye
    tooth-for-tooth justice. Live by the sword; die by the sword. The Bible is
    filled with justice pairs. St. Paul persecuted Christians and gained
    forgiveness by getting persecuted. King David almost got killed by Saul, then
    he killed a guy and took his wife. Abraham almost killed his unloved son,
    Ishmael. Genesis,21:16 That is why God asked Abraham to kill Isaac. God’s
    favorite thing on TV is soap operas.

    God hates complaining. Numbers,11:1 Food and clothing is all we’re to ask for
    or demand, in fact — daily bread. 1 Timothy,6:8 Just think about man in the
    last 100,000 years mostly living like Native Americans and how God must see us.
    You need food, clothing and entertainment, money is to get those. Man does not
    live on bread alone. Luke,4:4, Amos,8:11

    God’s favorite animals are bears and elephants. They are funny shaped — I
    think God must have seen too much starvation over the years. If the purpose of
    life is to know and love God, then a priest’s job is to make everybody know and
    love God. By saying God likes bears and elephants, I did more toward that end
    than all priests in history. Hosea,6:6 “It is love that I desire, not
    sacrifice; knowledge of God, not holocaust.” As a former Catholic, that blew my
    mind. I actually thought love was sacrifice! I was so dumb-founded reading,
    “it is love that I desire, not sacrifice,” that I actually looked-up the word,
    “love”. It means to take delight in. I realized it is demonic pride if you
    think love means hurting yourself for others. In the Philippians, they got the
    notion crucifying yourself was a good idea. Similarly, a child thinking about
    Lent, might conclude, “if it’s bad, it must be good.” That is, if you think God
    wants you to hurt yourself to please Him, you are worshiping a demon, not God!
    God wants you to take delight in His company, get to know Him and praise Him.
    It is best to separate justice — sin and punishment — from relationship with
    God. Never ask God to change justice into injustice by not punishing. God said
    to me in an oracle, “Excessive contrician wearisome.” He doesn’t want to hear
    confessions. When you pray, be witty and charming and rarely earnest. Enjoy
    God’s company without imposing on Him and don’t expect secrets of the Universe.
    Earnestness in prayer is the root of much evil. Be entertaining. Don’t remind
    Him of sin, LOL.

    God’s ways are far above man’s ways. Mom said Heaven was a never-ending family
    reunion. Yikes! A friend said, “Most guy’s idea of Heaven would be running
    around doing things they’d get locked up for on Earth.” I wonder how long kids
    play Grand Theft Auto before getting board. Perhaps, it takes ten years, but
    they will get bored. Most people are like King Midas. When you realize how
    silly most notions of Heaven are, you come to appreciate that Earth is not that
    bad. This is the first step in loving God, the Creator — praising Creation.
    My parents spend their retired days watching TV and going to casinos. That’s
    not a good argument for getting extended-play!

    Imagine a billionare. Everyone around him can’t forget his money for even a
    moment. The truth is, most people are after God’s “money” — they fear for
    their salvation. Here’s a test — would you pray to and praise God even if
    there were no salvation? Love God and don’t be a “user”. Asking for stuff is
    annoying. Luke,11:5

    All those sophisticated theological “infinity” things — omniscience,
    omnipotence, omnipresence, omnivorous — will mess you up. Trust me that
    anthropomorphic is far better, in practice. Christ suggested thinking of God as
    “Abba” which is Aramaic for “Daddy” and said the childlike had an advantage.
    Matthew,11:25 Pray out-loud because God doesn’t want the hastle of reading your
    brain. The best way to stop people from testing God is to suggest He can’t do

    Jesus said, “I am meek and humble of heart.” Matthew,11:29 What does “humble
    of head” mean? Humble of heart means you look around and say, “I don’t care as
    much as they do.” A proud of heart person says, “I am superior because I have
    more compassion then everybody else.” If you are proud of heart, you don’t
    accept a gift. God gives birthrights. Esau, in the Bible, scorned his
    birthright and God hated him. Malachi,1:1 Jesus even accepted $30,000 worth of
    perfume (300 day’s wages) and caused Judas to betray him. Mark,14:5 If you
    express false outrage at wars, you are proud of heart. If you fight to go in
    the door last, e.g. “No, you first…” then you are proud of heart. If you ask
    God to save starving Africans as though you care more than God, you are proud of

    I connected being humble of heart with animal sacrifices. The animal sacrifices
    in the Bible really seem off-the-mark from what we modern people imagine truth
    to be! I asked God and He said the people were, “primitive.” Well, obviously,
    a sacrifice represents giving-up something of value, but is there more to it?
    It would be tramatic to see a goat’s throat being slit and it dying for your
    sins. I’m not an expert, but sometimes they killed animals to make-up for sins.
    Perhaps, starting at age eight and every year thereafter, they kill a goat for
    your sins? (I’m just speculating.) In a couple years, it is not tramatic and
    you yawn and say to the goat, “bummer for you, Mr. Goat, that you gotta die for
    my sins.” When a high school football team beats their rivals, nobody thinks
    twice that the winning team really hurts the feelings — devastates — the
    losing team member’s feelings. The heart of being masculine is being
    competetive and not caring about the necessity to slit the throat of the goat.
    As a Catholic, saying Jesus died for our sins and that we cannot earn salvation,
    never sat well. I clung to the heretical notion that you earn salvation.
    Animal sacrifices were the heart of Biblical Judaism and although it seems
    satanic, you really do have to slit the throat of the goat and accept grace, a
    term for something you did not earn. Heck, every time you eat beef, a cow had
    to die for you. God said to me in an oracle that having pets was, “homo.” I
    think God’s idea of pets is farm animals you eat.

    If you feel guilty for being American and want Mexicans to share your
    birthright, you are proud of heart. Jesus was a racist and called Canaanites
    “dogs”. Matthew,15:26 In an oracle, God told me He was against immigration.
    The Chinese intellectuals felt bad about not being laborers. Don’t feel guilty
    about not being a laborer because God made it a Brave New World.
    1 Corinthians,12:1

    In an ant colony, the workers have one set of marching orders, the soldiers have
    another set of marching orders, the queen and drones have marching orders and
    the diggers have marching orders. The Bible gives conflicting orders —
    conservatives pay attention to one set of passages and liberals pay attention to
    others. Everybody has selective hearing, but that’s good because we are
    different members of the body of Christ.

    Jesus repeats the phrase, “for those who have ears to hear” many times, but not
    actually at the times that matter. Jesus says several Jedi mind tricks — He
    asks, what father gives a scorpion to his son? Luke,11:12 Jesus says, when you
    ask God for things, it is as annoying as like a neighbor in the night!
    Luke,11:7 He said, “I came to serve” but Jesus’ three years of service were
    more like being a rockstar than a janitor. John,13:14

    There are sheep and there are shepherds. You would be silly to take other
    shepherds seriously when they are only caring for their sheep. Sheep are very
    hard to communicate to, as Jesus learned. He used parables. Seed on a path
    gets eaten by birds; weeds choke; and the one percent is rich soil.

    Just as ego causes most to love neighbor, not God, people skip knowing and
    loving God and cowardly get stuck on obeying Him. A desire to obey God, doesn’t
    have to be encouraged, since it comes so naturally. Don’t worry, God does not
    want pawns to push around. God will talk, but won’t tell you what to do, even
    if you want Him to. Also, you’ll quickly learn that prophecy does not come true
    and should smack yourself for wanting more than just enjoying God’s company.

    • FuckU

      Nobody fucking cares. God is a farce.

  • You have to do an offering before generating random words or a random passage.Talk to God or write a hymn. Be witty and charming. You get back the same love effort you put in. Imagine how picking a greeting card takes love effort. Write a hymn. God will talk.


  • Pingback: Cloud Security Alliance says infosec wonks would pay $1m ransoms – Enterprise Security Professional()

  • Pingback: Cloud Security Alliance says infosec wonks would pay $1m ransoms-IT大道()

  • Pingback: Flawed ransomware makes impossible the file recoverySecurity Affairs()

  • Pingback: Flawed RANSOM_CRYPTEAR ransomware makes impossible the file recovery - Systerity()

  • Pingback: Flawed RANSOM_CRYPTEAR ransomware makes impossible the file recovery | Tailor Technology()

  • Pingback: Dealing With Script Kiddies – Cryptear.B Incident()

  • Pingback: Dealing with Script Kiddies – Cryptear.B Incident – Hacker Planet()


  • Pingback: Ransomware z otwartym źródłem wymknął się z pod kontroli – backdoor nie zadziałał…()

  • Pingback: A security researcher created a dangerous virus for fun — and then chaos broke loose » GeoFront Capital Group()

  • Pingback: A security researcher created a dangerous virus for fun — and then chaos broke loose | Elexonic()

  • Pingback: Basında Hidden Tear – Published Articles()

  • Pingback: Hidden Tear Project: Forbidden Fruit Is the Sweetest | The State of Security()

  • Pingback: Hidden Tear Project: Forbidden Fruit Is the Sweetest - OSINT()

  • Pingback: Infocaos | Hidden Tear Project: Forbidden Fruit Is the Sweetest()

  • Pingback: Cloud Security Alliance Says Infosec Wonks Would Pay $1m Ransoms | CyberCureME()

  • Pingback: All you need to know about Ransomware - EthicalHat()

  • Pingback: All you need to know about Ransomware - EthicalHat()

  • Pingback: Top infosec vendors, cops, liberate thousands from ransomware (The Register) – sec.uno()

  • Pingback: Cybercrime-as-a-Service Economy: Stronger Than Ever (InfoRiskToday) – sec.uno()

  • Pingback: Top infosec vendors, cops, liberate thousands from ransomware | VIPshield.co.uk()

  • Pingback: Cybercrime-as-a-Service Economy: Stronger Than Ever - OSINT()

  • Pingback: Edukacja – argument nr 1 za Ransomware Open Source – Piteras.pl()

  • Pingback: January 2017: The Month in Ransomware()