AuroraDecrypter

Also known as Zorro as of lately, Aurora ransomware was released in the summer of 2018 and collected over $12,000 in payments so far. As the name suggests, AuroraDecrypter is a tool designed to help you recover files that are targeted by this malware and avoiding payment and consequentially, support for this practice.

Even though the method of distribution is not known exactly, security specialists state that there are clues it may enter systems via the remote desktop services that are exposed. More precisely, it uses brute force to gain the password for the RDP and gain access to the computer.

Once installed, Aurora connects to a specific Command and Control server in order to receive an encryption key and lock down various files on the computer. On a side note, the ransomware also checks the location of the victim based on the IP address and apparently, it avoids encrypting data for PCs located in Russia.

As you would expect, the encrypted files append the AURORA extension along with their original extension. However, there have been reports that other extensions may be used during the encryption, including or not limited to ONI, DESU, NANO and ANIMUS.

The tool enables you to recover your files, providing that you have two files - one encrypted, one clean backup - in the common document or media formats. Afterwards, access the Bruteforcer tool to add these files and give it some time to find the corresponding key. The key can be then used to unlock a full directory and even an entire drive.

AuroraDecrypter is an easy to use program that allows you to recover the files that are hijacked by the ransomware. Nevertheless, you should and can protect yourself from this malware by using good computer and security habits. Make sure that your antivirus solution is up to date, create a backup of your data just in case and ensure that the Remote Desktop service is locked down correctly.