Decryptor for MoneroPay Ransomware

After analysis of the MoneroPay ransomware (MD5: 14ea53020b4d0cb5acbea0bf2207f3f6), we managed to patch the binary to turn it into a decryptor.

XData ransomware attacked users in Ukraine

On May 18, the author(s) of XData ransomware ran the massive attack against Ukrainian users supposedly leveraging the EternalBlue exploit as well as an ordinary spearphishing email delivery method. A week later, an anonymous user, supposedly the author of AES-NI ransomware the XData is based on, released the master private key. Currently, the XData decryption tools are available. We analysed the XData code and found two host-based 'kill-switches', one of them is about detecting an antivirus running on an infected machine.