Emsisoft Decryptor for Aurora

The Aurora ransomware already has a long history, with different variants released into the wild and a significant number of infected computers. Its main infection channel is the Remote Desktop Services, which allows hackers to break into the victim’s system.

Like any other ransomware, it encrypts files by appending them special extensions, such as “.aurora”, “Nano”, ".isolated", ".infected", ".masked", ".crypton", ".coronolock", and many more, depending on the ransomware variant.

The cyber community’s response consists of a dedicated decryption tool suggestively called the Emsisoft Decryptor for Aurora. Like many of Emsisoft’s decryptors, this one requires an infected file and its “clean” correspondent, which you have from a previous backup, for instance. A ransom note in text format is required, which is usually available in every folder where an encrypted file is found.

Having these files, it attempts to rebuild the decryption key to unlock the rest of your affected files.

Once you select the number of threads to use, Emsisoft Decryptor for Aurora starts the brute force attack. The encryption parameters are then reconstructed, which can take more or less time, depending on the ransomware variant.

With the decryption key at hand, the application prompts you to select the folders where the infected files are located. The “Results” tab is where you can see all the actions taken by the application and monitor its progress. When the task is completed, you get a notification.

The Aurora ransomware does not save any information about the files it encrypts and, therefore, the decryptor cannot guarantee that the recovered file will be identical to the original. It is advisable you configure the application to preserve the encrypted file as well and not remove them completely.

While it does not offer a 100% guarantee, the Emsisoft Decryptor for Aurora is definitely worth a try if you find out that you are a victim of the aforementioned ransomware. It is way better than paying up the ransom to unlock your files.