Free Decryptor for the Solidbit
ransomware

Free Decryptor
for the Solidbit
ransomware
User Manual

Truesec AB

hello@truesec.com

Oxtorgsgränd 2, 111 57 Stockholm

www.truesec.com

Table of Contents
1. Change History
2. Background
2.1 The decryption software
2.2 Chaos ransomware family
3. Preparations
3.1 Perform a full disk backup
3.2 Remove the ransomware persistence
3.3 Disk space and permissions
3.4 Obtain the decryptor software
4. Running the decryptor
4.1 Setup
4.2 License agreement
4.3 Settings
4.4 Selecting files to decrypt
4.5 Running the decryptor
4.6 Verifying and cleanup

Date: 2022-09-16

3333
44
44
45566
788

TLP: CLEAR

Version: 1.0

Truesec GroupSwedenDenmark

US

Corp. ID: 556690-8074
www.truesec.com+ 46 810 00 10
hello@truesec.com+ 46 810 00 10
hello@truesec.com+1 (904) 900-4532
hello@truesec.com

21. Change History
VersionDate

Description

0.1
0.2
1.0

2022-09-16
2022-09-19
2022-09-19

First Draft
Quality Review
First Release
Table 1 Change History

2. Background
2.1 The decryption softwareThis is a free software that helps you recover files encrypted by the Chaos ransomware family.
BEFORE USING THIS SOFTWARE, YOU MUST CAREFULLY READ THIS USER MANUAL.
This software is listed on the "No More Ransom" project, an initiative by Europol’s ECC, et. al., withthe goal to help victims of ransomware retrieve their encrypted data without having to pay thecriminals.
This software is provided by Truesec and is distributed under GPLv3. Truesec is a global cybersecurity company that covers the entire cybersecurity spectrum. Our incident response teamperforms hundreds of complex cyber incident investigations every year. Founded in Sweden, wehave been delivering cutting-edge solutions to both the private and public sectors since 2005.

2.2 Chaos ransomware family
The Chaos ransomware family is a set of malicious software, which are derived from the same
original malicious software. The Chaos ransomware was first published at 2021-06-09, under thename Ryuk .Net Ransomware Builder. The author later rebranded the builder to Chaos Ransomware
Builder. The builder has been constantly updated since then, and multiple forks have been observedsuch as Minecraft alt1 and WannaFriendMe. 2
The ransomware group Onyx first appeared in in April 2022. The ransomware group use a fork of theChaos ransomware. The group changed its name to VSOP in August 2022.
Around May 2022, a ransomware known as Yashma/AstraLocker appeared, that was based on Chaos
ransomware. The group officially shutdown in July 2022 and published a free decryptor. 3
In August 2022, a ransomware-as-a-service named Solidbit appeared that is also based on a Chaos
fork.4

1 https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-in-fake-minecraft-alt-list-brings-destruction
2 https://www.bleepingcomputer.com/news/security/roblox-game-pass-store-used-to-sell-ransomware-decryptor/
3 https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-astralocker-yashma-ransomware-victims/
4

https://www.varonis.com/blog/anatomy-of-a-solidbit-ransomware-attack

Date: 2022-09-16

TLP: CLEAR

Version: 1.0

Truesec Group

SwedenDenmark

USCorp. ID: 556690-8074
www.truesec.com+ 46 810 00 10
hello@truesec.com+ 46 810 00 10
hello@truesec.com+1 (904) 900-4532
hello@truesec.com

33. Preparations
This section contains the preparation steps needed to run this decryption software. Please read theinstructions carefully to avoid data loss and unexpected results. These steps are mandatory.

3.1 Perform a full disk backup
Take a full backup of the entire drive before running the decryptor.
The ransomware removes large files, and these could potentially be carved by a file recovery utility.
Therefore, it is very important to preserve the free space on the drive.

3.2 Remove the ransomware persistenceThe ransomware creates various types of persistence, depending on the strain and configuration.
Persistence techniques include startup folder items, scheduled tasks, system services, and autorun
registry keys. You must manually remove any persistence on your system. Failure to do so will resultin your system being encrypted once again.
In general, a decryptor software does not replace the need of a proper forensic investigation. Weurge you to perform containment, forensic investigation, and remediation activities to secure yourenvironment from further damage.

3.3 Stop the ransomware process
Before running the decryptor, you must ensure that the ransomware process is no longer running.

3.4 Disk space and permissions
The decryptor software needs to have read/write permission to the files/folders you want todecrypt. The decryptor will create a new decrypted file for each encrypted file, therefore werecommend that you have at least 50% free disk space on the target volume.

3.5 Obtain the decryptor software
Please follow the link listed on https://nomoreransom.org to download the decryptor software.
Optionally, you can build the decryptor from source. See the readme in the Github repository forfurther instructions.

Date: 2022-09-16

TLP: CLEAR

Version: 1.0

Truesec GroupSweden

Denmark

USCorp. ID: 556690-8074
www.truesec.com+ 46 810 00 10
hello@truesec.com+ 46 810 00 10
hello@truesec.com+1 (904) 900-4532
hello@truesec.com

44. Running the decryptor
The decryptor is a wizard application. Navigate through the wizard and follow the instructions in theapplication to recover your files.
Please note that the decryption can take up to a few hours. Do not shutdown the computer until thedecryption has completed.

4.1 Setup
Extract the zip archive and run the setup.exe file.

Figure 1 Files in the solution zip archive

The installer is not signed and therefore you will be prompted with the below warning. Click install
to continue.

Figure 2 Installation publisher confirmation

When the setup is completed, you should be greeted by the welcome page as seen in the below
figure.

Date: 2022-09-16

TLP: CLEAR

Version: 1.0

Truesec Group

SwedenDenmarkUSCorp. ID: 556690-8074
www.truesec.com+ 46 810 00 10
hello@truesec.com+ 46 810 00 10
hello@truesec.com+1 (904) 900-4532
hello@truesec.com

5Figure 3 Welcome page

4.2 License agreement
Carefully read the license agreement. You must accept the agreement to use this software.

Figure 4 License agreement page

4.3 Settings
Description of configuration options.

Date: 2022-09-16

TLP: CLEAR

Version: 1.0

Truesec Group

SwedenDenmark

US

Corp. ID: 556690-8074
www.truesec.com+ 46 810 00 10
hello@truesec.com+ 46 810 00 10
hello@truesec.com+1 (904) 900-4532
hello@truesec.com

64.3.1 File settings
Recursively parse subdirectories – Select the checkbox to recursively parse subfolders for the target
folders (selected on the next page in the wizard). If the checkbox is not checked, subdirectories will
be skipped.
File extension of encrypted files – Define the extension that was appended to the encrypted files by
the ransomware.

4.3.2 Decryptor settings
Decryptor – Select the strain that has encrypted the files you want to decrypt. If you do not know
which strain you are affected by, click the “Help me identify” button.

4.3.3 Database settings
Solidbit does not require any database file. Please leave this section blank.

4.4 Selecting files to decrypt
Select the folder(s) containing the files you want to decrypt by clicking the “Add Folder(s)” button.

Date: 2022-09-16

TLP: CLEAR

Version: 1.0

Truesec GroupSweden

Denmark

US

Corp. ID: 556690-8074
www.truesec.com+ 46 810 00 10
hello@truesec.com+ 46 810 00 10
hello@truesec.com+1 (904) 900-4532
hello@truesec.com

7

4.5 Running the decryptor
Please note that the decryption can take up to a few hours. Do not shutdown the computer until thedecryption process has completed.

4.6 Verifying and cleanup
After the decryption has completed, your files should be decrypted, and you will be able to accessthem again.
Please note that the decryptor does not remove any encrypted files. In some cases, the decrypted
file will not be valid. Please manually confirm that every decrypted file is valid before removing theencrypted file.

Date: 2022-09-16

TLP: CLEAR

Version: 1.0

Truesec Group

SwedenDenmark

USCorp. ID: 556690-8074
www.truesec.com+ 46 810 00 10
hello@truesec.com+ 46 810 00 10
hello@truesec.com+1 (904) 900-4532
hello@truesec.com

8