Contact person: RCRU64 Ransomware Decryption Test

Phone:Show

Email:Show

Location: Kajang, Malaysia

Budget: Recommended by industry experts

Time to start: As soon as possible

Project description:
"My Windows machine was hit by the RCRU64 ransomware and every important file is now unreadable. I have located a repository that appears to contain the original malware source ([login to view URL]) and I believe the routines inside can be repurposed to recover my data.

To minimise risk, I want to start with one encrypted file. If you can return that file fully restored and verifiably intact, I will engage you to process the rest of the archive.

Scope
• Analyse the RCRU64 code in the linked repository and extract or recreate the decryption logic.
• Apply it to a single sample file I will provide.
• Deliver the decrypted version along with a brief outline of the steps or script used so I can confirm repeatability.

Acceptance
The recovered file must open normally on Windows without traces of the malicious stub, and its hash must differ from the encrypted counterpart while matching the original structure (I can supply a pre-infection thumbnail or metadata for comparison).

No backups exist, so extreme care is required—overwriting or data loss is unacceptable. Once the proof-of-concept succeeds, we can move on to my full set." (client-provided description)