分类目录归档：勒索恢复

.pzpq扩展名勒索恢复

发表于 2025 年 1 月 13 日 由 惜分飞

有一个10g的库,数据库被勒索病毒加密扩展名为:.email=[biobiorans@gmail.com]id=[f5657ac3dc58dc8c].biobio.[backups@airmail.cc].pzpq
pzpq

#Read-for-recovery.txt文件中内容

Email 1: 
backups@airmail.cc

Email 2: 
hero77@cock.li

Send messages to both emails at the same time 

So send messages to our emails, check your spam folder every few hours 

ID: E3DxxxxxxxxxxxxxxxDBB73

If you do not receive a response from us after 24 hours, create a valid email, for example, gmail,outlook 
Then send us a message with a new email

通过底层对数据库block进行分析,确认损坏的block情况为,头部损坏16个block,中间16个block,尾部16个block
QQ20250113-214706

通过Oracle数据文件勒索加密恢复工具,实现快速恢复
QQ20250113-220625
然后尝试打开数据库报ORA-600 4193错误

un Jan 12 22:35:09 2025
ALTER DATABASE OPEN
Sun Jan 12 22:35:10 2025
Thread 1 opened at log sequence 4
  Current log# 3 seq# 4 mem# 0: D:\ORCL\REDO03.LOG
Successful open of redo thread 1
Sun Jan 12 22:35:10 2025
MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
Sun Jan 12 22:35:10 2025
SMON: enabling cache recovery
Sun Jan 12 22:35:10 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\udump\norcl_ora_2796.trc:
ORA-00600: internal error code, arguments: [4193], [58], [52], [], [], [], [], []

Sun Jan 12 22:35:11 2025
Doing block recovery for file 1 block 404
Block recovery from logseq 4, block 73424 to scn 137439548723
Sun Jan 12 22:35:11 2025
Recovery of Online Redo Log: Thread 1 Group 3 Seq 4 Reading mem 0
  Mem# 0: D:\ORCL\REDO03.LOG
Block recovery stopped at EOT rba 4.73426.16
Block recovery completed at rba 4.73426.16, scn 32.595250
Doing block recovery for file 1 block 9
Block recovery from logseq 4, block 73424 to scn 137439548721
Sun Jan 12 22:35:11 2025
Recovery of Online Redo Log: Thread 1 Group 3 Seq 4 Reading mem 0
  Mem# 0: D:\ORCL\REDO03.LOG
Block recovery completed at rba 4.73426.16, scn 32.595250
Sun Jan 12 22:35:11 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\udump\norcl_ora_2796.trc:
ORA-00604: error occurred at recursive SQL level 1
ORA-00607: Internal error occurred while making a change to a data block
ORA-00600: internal error code, arguments: [4193], [58], [52], [], [], [], [], []

Error 604 happened during db open, shutting down database
USER: terminating instance due to error 604
Sun Jan 12 22:35:11 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_pmon_2168.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_reco_2688.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_smon_2332.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_ckpt_2600.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_lgwr_2672.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_dbw0_1344.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_mman_2828.trc:
ORA-00604: error occurred at recursive SQL level 

Sun Jan 12 22:35:12 2025
Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_psp0_2324.trc:
ORA-00604: error occurred at recursive SQL level 

Instance terminated by USER, pid = 2796
ORA-1092 signalled during: ALTER DATABASE OPEN...

通过分析trace,确认是系统回滚段的free block pool异常,使用bbed进行修复

BBED> clean free_block_pool
Clean free block pool completed.you can use dump to verify the data, then can us
e sum apply command to save data.
BBED> sum apply

Warning: apply the modified data will overwrite original data.
Would you like to continue? (y/n)
y

Old checksum value: 0xf2c0
New checksum value: 0xf315
Writing block has completed

BBED>

open数据库成功,然后安排导出数据即可
QQ20250113-222649

对于类似这种被加密的勒索的数据文件,我们可以实现比较好的恢复效果,如果此类的数据库(oracle,mysql,sql server)等被加密,需要专业恢复技术支持，请联系我们:
电话/微信:17813235971    Q Q:107644445QQ咨询惜分飞    E-Mail:dba@xifenfei.com
系统安全防护措施建议：
1.多台机器，不要使用相同的账号和口令
2.登录口令要有足够的长度和复杂性，并定期更换登录口令
3.重要资料的共享文件夹应设置访问权限控制，并进行定期备份
4.定期检测系统和软件中的安全漏洞，及时打上补丁。
5.定期到服务器检查是否存在异常。
6.安装安全防护软件，并确保其正常运行。
7.从正规渠道下载安装软件。
8.对不熟悉的软件，如果已经被杀毒软件拦截查杀，不要添加信任继续运行。
9.保存良好的备份习惯，尽量做到每日备份，异地备份。

发表在 勒索恢复 | 标签为 , , , , , , | 留下评论

.hmallox加密mariadb/mysql数据库恢复

发表于 2025 年 1 月 6 日 由 惜分飞

有客户运行在win机器上的mariadb数据库被勒索加密了,加密扩展名为.hmallox
hmallox

HOW TO BACK FILES.txt文件内容

Hello

Your data has been stolen and encrypted
We will delete the stolen data and help with the recovery of encrypted files after payment has been made

Do not try to change or restore files yourself, this will break them
We provide free decryption for any 3 files up to 3MB in size on our website

How to contact with us:
1) Download and install TOR browser by this link: https://www.torproject.org/download/
2) If TOR blocked in your country and you can't access to the link then use any VPN software
3) Run TOR browser and open the site: wtyafjyxxxxxxxxxxxxxxxxxxxxxxxxljoyuklaad.onion/mallox/privateSignin
4) Copy your private ID in the input field. Your Private key: D7xxxxxxxxxxxxxxx90
5) You will see chat, payment information and we can make free test decryption here

Our blog of leaked companies:

wtyafjyxxxxxxxxxxxxxxxxxxxxxxxxljoyuklaad.onion

If you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.org
Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.

通过分析,ibd文件情况尚可
ibd

对于这种情况,对于ibd文件进行分析结合客户提供的字典信息,完美恢复数据,业务直接使用

发表在 MySQL恢复, 勒索恢复 | 标签为 , , , | 留下评论

.wstop扩展名勒索数据库恢复

发表于 2024 年 12 月 8 日 由 惜分飞

操作系统文件被加密成.[[gmtaP2R5]].[[dataserver@airmail.cc]].wstop扩展名,类似
wstop

运行的oracle数据库文件,从名称上看没有被加上明显的后缀名
wstop-oracle
通过winhex打开文件分析,虽然文件名称没有改变,但是文件依旧被破坏
QQ20241208-094519
通过专业工具检测具体破坏情况,每个文件破坏三段,破坏24个block左右
wstop-oracle-hk
因为损坏block较少,这种情况,可以通过我开发的Oracle数据文件勒索加密工具进行处理,然后open数据库
QQ20241208-095622
类似勒索病毒预防建议：
1. 教育和培训：提高用户的网络安全意识非常重要。通过定期的网络安全培训和教育，向用户传达有关勒索病毒及其传播方式的知识，让他们能够警惕潜在的威胁，并学会如何正确应对可疑的电子邮件、链接和附件。
2. 更新和维护：及时更新操作系统、应用程序和安全软件，以修补已知的漏洞，并确保系统能够及时获取最新的安全补丁。此外，定期进行系统维护和检查，确保系统的安全配置和设置。
3. 备份数据：定期备份重要的数据和文件，并将备份存储在安全的离线或云存储中。确保备份是完整的、可靠的，并且能够及时恢复，以便在发生勒索病毒感染或其他数据丢失事件时能够快速恢复数据。
4. 网络安全工具：使用可信赖的网络安全工具，包括防病毒软件、防火墙、入侵检测系统等，以提高系统的安全性和防护能力。定期对系统进行全面的安全扫描和检测，及时发现并清除潜在的威胁。
5. 访问控制：实施严格的访问控制措施，限制用户对系统和文件的访问权限，避免使用管理员权限进行日常操作，以减少恶意软件感染的风险。此外，定期审查和更新访问控制策略，确保系统安全性得到有效维护。
6. 应急响应计划：制定和实施应急响应计划，明确团队成员的责任和任务，建立应对勒索病毒和其他安全事件的应急响应流程，以最大程度地减少损失并快速恢复业务正常运营。

如果此类的数据库(oracle,mysql,sql server)等被加密,需要专业恢复技术支持，请联系我们:
电话/微信:17813235971    Q Q:107644445QQ咨询惜分飞    E-Mail:dba@xifenfei.com

发表在 勒索恢复 | 标签为 , | 评论关闭