04-17-2020 , 12:07 AM
Aurora is a ransomware family that encrypts files using XTEA and RSA, and may also be known as "Zorro", "Desu", or "AnimusLocker". Known extensions include ".Aurora", ".aurora", ".animus", ".ONI", ".Nano", ".cryptoid", ".peekaboo", ".isolated", ".infected", ".locked", ".veracrypt", ".masked", ".crypton", ".coronolock", ".bukyak", and ".serpom".
The malware leaves many ransom notes, examples include "!-GET_MY_FILES-!.txt", "#RECOVERY-PC#.txt", and "@_RESTORE-FILES_@.txt". Here is an example of the note's contents:
Download and use HERE
The malware leaves many ransom notes, examples include "!-GET_MY_FILES-!.txt", "#RECOVERY-PC#.txt", and "@_RESTORE-FILES_@.txt". Here is an example of the note's contents:
Code:
==========================# zorro ransomware #==========================
SORRY! Your files are encrypted.
File contents are encrypted with random key.
Random key is encrypted with RSA public key (2048 bit).
We STRONGLY RECOMMEND you NOT to use any "decryption tools".
These tools can damage your data, making recover IMPOSSIBLE.
Also we recommend you not to contact data recovery companies.
They will just contact us, buy the key and sell it to you at a higher price.
If you want to decrypt your files, you need to get the RSA-key from us.
--
To obtain an RSA-key, follow these steps in order:
1. pay this sum 500$ to this BTC-purse: 18sj1xr86c3YHK44Mj2AXAycEsT2QLUFac
2. write on the e-mail ochennado@tutanota.com or anastacialove21@mail.com indicating in the letter this ID-[id] and BTC-purse, from which paid.
In the reply letter you will receive an RSA-key and instructions on what to do next.
We guarantee you the recovery of files, if you do it right.
==========================# zorro ransomware #==========================Download and use HERE