Emsisoft: Victims of AstraLocker and Yashma ransomware can recover their files for free

Emsisoft has released a free decryption tool that allows victims of the AstraLocker and Yashma ransomware to recover their files without paying a ransom.

Cybersecurity firm Emsisoft released a free decryptor tool that allows victims of the AstraLocker and Yashma ransomware to recover their files without paying a ransom.

The security firm states that the AstraLocker decryptor works for ransomware versions based on the Babuk malware that appends the .Astra or .babyk extensions to the name of the encrypted files.

The Yashma decryptor released by the company works for the Chaos-based versions using .AstraLocker or a random .[a-z0-9]{4} extension.

The researchers also shared a step-by-step guide to use their tool and a series of reccomndations to sanitize the victims’ systems.

In case a system was compromised through the Windows Remote Desktop feature, the experts recommend changing all passwords of all users that are allowed to login remotely and check the local user accounts for additional accounts the attacker might have added.

“Be sure to quarantine the malware from your system first, or it may repeatedly lock your system or encrypt files. If your current antivirus solution fails to detect the malware, it can be quarantined using the free trial version of Emsisoft Anti-Malware.” reads the guide. “If your system was compromised through the Windows Remote Desktop feature, we also recommend changing all passwords of all users that are allowed to login remotely and check the local user accounts for additional accounts the attacker might have added.”

The decryptor by default will not remove any encrypted files at the end of the decryption process, this option was implemented because the tool can’t guarantee that the decrypted data is identical to the one that was previously encrypted.

Last week, AstraLocker ransomware operators told BleepingComputer they were shutting down the operation and provided decryptors to the VirusTotal malware analysis platform.

AstraLocker is based on the source code of the Babuk Locker (Babyk) ransomware that was leaked online on June 2021. BleepingComputer tested the decryptors and confirmed they are legitimate. The threat actors behind Astralocker told BleepingCompyter that they plan to abandon the extortion and switch to cryptojacking.

The real reason behind the decision to cease the operation could be the pressure by law enforcement in response to their recent attacks.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)