@hrenki
Thanks for the advise! I tried a docx file. I let the kaspersky tool run through the complete range, but it could not find any key. Did you have the decrypted Version in the same directory? I don't exactly know if the decrypted Version would help to find the key.
I could rebuild most of the files on my System using shadow volume copies. So i have plenty of files in both, the plain and the encrypted Version. The Problem is the NAS, there is no shadow volume copy available.
Does anybody know if there are tools that can regain the key from the plain and encrypted file pairs? As far as i know, RSA 2048 is immune against known plain text attacks but somehow i doubt, that this Version of Virus Encoder implemented it correctly. My Internet researches leed to some indications, that this Version of Virus encryptor uses some algorithms or code which is well known from previous ransomeware.
I also found an unknown certificate on my System which actually is an RSA-2048 key and in ist properties it tells me, that there is a matching private key available on my System. I guess it's worth to try the decryption with this key. Does anybody have an idea or advice how to do so? I must confess i'm not an expert in cryptographics.