Cdpo Virus Ransomware (.cdpo File)

What is Cdpo ransomware?

The appearance of the .cdpo files on your computer mean that you are attacked by Cdpo ransomware. This malware is targeted at your wallet - it encrypts the files and then asks you to pay the ransom to decrypt them. Before the encryption, it makes several changes in your system to disable any security mechanisms and prevent the launch of antivirus programs.

Cdpo ransomware uses Salsa20 encryption. This cipher is not the most strong encryption but still cannot be decrypted in familiar ways.

The changes Cdpo virus does to the security of your system are pretty heavy. The malware disables the Microsoft Defender and alters some configurations, so you will not launch the installation files of most antivirus tools. It also changes the HOSTS file, leading to an inability to open some of the websites with ransomware removal and file decryption guides.

Encryption process

The Cdpo ransomware uses the Salsa20 encryption algorithm. That is not the strongest method, but it still provides an overwhelming amount of possible decryption keys. To brute force the 78-digit number of keys, you need 3.5 unvigintillion years (1*10^65), even if you use the most powerful regular PC. Quantum computers can show a bit better results, but it is still too slow to get your files back while you are alive.

The exact algorithm of encryption is next: malware scans each folder for the files it is able to encrypt. Then, when it finds the target, it makes a copy of your file, removes the original one, encrypts the copy and leaves it instead of the removed original. Such a procedure is done to prevent the situation when you have already opened the file, so ransomware is not able to read it because of the Windows restrictions. To each encrypted copy, the virus adds the specific extension - ".cdpo". Then, ransomware creates a _readme.txt file in the folder where the encrypted file is located, and goes to the next folder.

Such an encryption method can be exploited for file recovery. Since the original file is deleted, you may try to recover it using the file recovery tools. The less time is passed - the bigger the chance to get your files back, so hurry up!

Another specific moment that can help you to use the files even after the encryption is the fact that Cdpo ransomware encrypts only the first 150KB of each file. Hence, you can try to run a big file, such as video or music, without the encryption. Similar feature also works with other ransomware families - Dharma, Conti and Makop encrypt the same 150KB.

Ransom note: _readme.txt

Ransom note is the same for the whole ransomware family. In fact, it is one of the main signs of to which family the certain ransomware belongs. Here is the typical note for STOP/Djvu family:

External Links:

🔗 HowToFix.Guide: How To Decrypt .cdpo Files?

Indicators of Compromise(IOC)

File Name	MD5	File Size
📜 SAMPLE.EXE	0407f464f5383cc888945bda2afa42c6	740352
📜 SAMPLE.EXE	8c3631853d9b8d9749d0a37519cd7c7e	1273856
📜 SAMPLE.EXE	ca106182fc4543131ef128b77f57c70a	749568
📜 SAMPLE.EXE	14aef15f47c83979904e8b4ca634dbef	748032
📜 SAMPLE.EXE	14a5973627a876bdbafb029a26084f64	836608
📜 SAMPLE.EXE	afdd799a769a2fd3f66c2fad9f1d1026	821760
📜 SAMPLE.EXE	1c35f5280fcc9305d7ae3b66addd807d	828928
📜 SAMPLE.EXE	1a3bb5acfb7f3ee075b7e6bd97243935	829440
📜 SAMPLE.EXE	ee76b731823735786a480232332cb3ef	651048
📜 SAMPLE.EXE	507c0b362fb27c14fb11594977e0893f	685437