Emsisoft: Victims of AstraLocker and Yashma ransomware can recover their files for free

Emsisoft has released a free decryption tool that allows victims of the AstraLocker and Yashma ransomware to recover their files without paying a ransom.

Cybersecurity firm Emsisoft released a free decryptor tool that allows victims of the AstraLocker and Yashma ransomware to recover their files without paying a ransom.

The security firm states that the AstraLocker decryptor works for ransomware versions based on the Babuk malware that appends the .Astra or .babyk extensions to the name of the encrypted files.

The Yashma decryptor released by the company works for the Chaos-based versions using .AstraLocker or a random .[a-z0-9]{4} extension.

The AstraLocker decryptor is for the Babuk-based one using .Astra or .babyk extension, and they released a total of 8 keys.

The Yashma decryptor is for the Chaos-based one using .AstraLocker or a random .[a-z0-9]{4} extension, and they released a total of 3 keys.

2/4

— Emsisoft (@emsisoft) July 7, 2022

The researchers also shared a step-by-step guide to use their tool and a series of reccomndations to sanitize the victims’ systems.

In case a system was compromised through the Windows Remote Desktop feature, the experts recommend changing all passwords of all users that are allowed to login remotely and check the local user accounts for additional accounts the attacker might have added.

“Be sure to quarantine the malware from your system first, or it may repeatedly lock your system or encrypt files. If your current antivirus solution fails to detect the malware, it can be quarantined using the free trial version of Emsisoft Anti-Malware.” reads the guide. “If your system was compromised through the Windows Remote Desktop feature, we also recommend changing all passwords of all users that are allowed to login remotely and check the local user accounts for additional accounts the attacker might have added.”

The decryptor by default will not remove any encrypted files at the end of the decryption process, this option was implemented because the tool can’t guarantee that the decrypted data is identical to the one that was previously encrypted.

Last week, AstraLocker ransomware operators told BleepingComputer they were shutting down the operation and provided decryptors to the VirusTotal malware analysis platform.

AstraLocker is based on the source code of the Babuk Locker (Babyk) ransomware that was leaked online on June 2021. BleepingComputer tested the decryptors and confirmed they are legitimate. The threat actors behind Astralocker told BleepingCompyter that they plan to abandon the extortion and switch to cryptojacking.

The real reason behind the decision to cease the operation could be the pressure by law enforcement in response to their recent attacks.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)

The post Emsisoft: Victims of AstraLocker and Yashma ransomware can recover their files for free appeared first on Security Affairs.

Recent Posts
Contact Us

We're not around right now. But you can send us an email and we'll get back to you, asap.

Not readable? Change text. captcha txt