Prometheus Ransomware Decryptor By CyCraft Technology Corp Published: 2021-09-16 · Archived: 2026-04-05 12:44:57 UTC Quick How-to Guide We provided a GUI version for windows users. All features are supported in the GUI version. If your programming skills aren’t developed to a mature level, please follow the steps below to decrypt your files: 1. Choose a file or folder to decrypt. 2. Choose the output file name or output folder. 3. Select “Use thread” and fill in 2–4 for PC. (Threads usually make the decryption routine faster, but it actually depends on the number of your CPU cores) 4. Click decrypt. 5. There is a counter, which shows the current guessing tickcount. 6. The decrypting result will show in the text block below. (There may be multiple possible keys, so the decryption routine will continue to decrypt to find more possible keys. You can press “Next one” to skip the current file.) Press enter or click to view image in full size https://medium.com/cycraft/prometheus-decryptor-6933e7bac1ea Page 1 of 9 Brief History on Prometheus The emerging ransomware group Prometheus made headlines last month with Unit42’s report. According to the report, which had observed Prometheus for 4 months, victims of the emerging ransomware group total more than 30 in multiple different countries, including the United States, the UK, and a dozen more countries in Asia, Europe, the Middle East, and South America. Organizations targeted for attack by Prometheus included government agencies, financial services, manufacturing, logistics, agriculture, healthcare services, insurance agencies, energy, consulting, law firms, and more. Although Prometheus claimed to be affiliated with REvil (the Russia-based ransomware group attributed to the attack on global meat supplier JBS that succeeded in acquiring an 11 million USD ransom, Prometheus’s code and behavior are more similar to Thanos. Brief History on Thanos — The Possible Predecessor of Prometheus First observed in 2020, Thanos gained notoriety for its 43 different configuration options as well as being the first ransomware to utilize the evasion technique know as RIPlace. RIPlace was introduced via a POC exploit in November 2019. Initially, RIPlace could bypass several ransomware defense mechanisms, including AV and certain EDR solutions. It wasn’t until a few months later that RIPlace was seen in the wild. Get CyCraft Technology Corp’s stories in your inbox Join Medium for free to get updates from this writer. Remember me for faster sign in Like other ransomware on the ransomware-as-a-service (RaaS) market, Thanos ransomware does appear to have code overlaps with other ransomware, notably Hakbit; however, just like other ransomware, Thanos does come with customization options and appears to still be under active development. Usage Build make win32 # windows 32 bits make win64 # windows 64 bits make linux # linux make win32GUI # windows 32 bits GUI (built on windows) make win64GUI # windows 64 bits GUI (build on windows) Command Arguments https://medium.com/cycraft/prometheus-decryptor-6933e7bac1ea Page 2 of 9 Usage of ./bin/prometheus_decrypt: -b string Custom search with byte value. (i.e. \xde\xad\xbe\xef -> deadbeef) Please use ?? to match any byte (i.e. de??beef) -c Use current tickcount. (only support in Windows) -e string Search file extension. -f int Found candidate. (default 1) -i string Input encrypted file. -k string Decrypt with this key. -m int Move backward m minutes from the current decrypted seed when guessing the next sample. (defau -o string Output decrypted file. -p int Use n thread. (default 1) -r Reversed tickcount. -s string Custom search with regular expression. -t int Start tickcount. Brute Force Random Seed Brute force the random seed of a png image from tickcount 0. ./prometheus_decrypt -i ./sample/CyCraft.png.PROM\[prometheushelp@mail.ch\] -o ./output/CyCraft.png - In this command, there are 4 arguments: i: input encrypted file o: output file e: search file format p: thread count Reversed Tickcount Brute force the random seed of a png image from tickcount 100000 in reversed order. ./prometheus_decrypt -i ./sample/CyCraft.png.PROM\[prometheushelp@mail.ch\] -o ./output/CyCraft.png - https://medium.com/cycraft/prometheus-decryptor-6933e7bac1ea Page 3 of 9 There are 2 additional arguments: t: start from 100000 r: reversed order (100000…0) Brute force from current tickcount (only for Windows) Brute force the random seed of a png image from the current tickcount in reversed order. This feature is usually used in reversed order. ./prometheus_decrypt -i ./sample/CyCraft.png.PROM\[prometheushelp@mail.ch\] -o ./output/CyCraft.png - There is an additional argument: c: start from the current tickcount Decrypt (Encrypt) with a key Decrypt (Encrypt) a file with a provided key. ./prometheus_decrypt -i ./sample/CyCraft.png.PROM\[prometheushelp@mail.ch\] -o ./output/CyCraft.png - There is an additional argument: k: provided key Brute force random seed with custom format (regular expression) Brute force the random seed of a text file with a known string “we had another great”. ./prometheus_decrypt -i ./sample/test.txt.enc -o ./output/test.txt -p 16 -s "we had another great" There is an additional argument: s: regular expression to match the decrypted file Brute force the random seed with custom format (bytes pattern) Brute force the random seed of a png file with its header in hex. ./prometheus_decrypt -i ./sample/test.txt.enc -o ./output/test.txt -p 16 -b '89??4e??0d??1a0a??00' There is an additional argument: b: PNG header in hex format. https://medium.com/cycraft/prometheus-decryptor-6933e7bac1ea Page 4 of 9 The full bytes are “8950 4e47 0d0a 1a0a 0000”. We can use ?? to match any byte. Custom search with bytes pattern is much more convenient than regular expression since there are lots of file format that it can’t be performed by visible characters. Brute force the random seed for a directory Brute force the random seed of a png file with its header in hex. ./prometheus_decrypt -i ./sample -o ./output -p 16 -m 1 -f 2 There are two additional arguments: m: Move backward m minutes from the current decrypted seed when guessing the next sample. (default 30) Use seed-m*60*1000 as the start tickcount. f: Found candidate. (default 1) Limit the candidates found. There may be several candidates to a file, limit its candidates can save time. Since there are lots of files to decrypt, you can press Ctrl-c to skip the current guessing file. Output Since we match the file with magic number, it might be matched even if a wrong key is provided. Therefore, we keep the decryption process continued to guess. You can terminate it anytime if you find the correct decrypted file. % ./prometheus_decrypt -i ./sample/test.txt.enc -o ./output/test.txt -p 16 -s "we had another great" Decrypt file with seed 615750, key: +@[%T-mZSh+E[^^i{W:dpwnhdL4