Aurora ransomware - How to remove

A couple days ago MalwareHunterTeam shared on their Twitter about another lovely-named ransomware virus Aurora. Soon enough other malware professionals @TigzyRK and @demonsly335 joined in providing a little bit more information about the rapidly spreading crypto-virus.

Before you take any radical, stress-induced actions, please read this article to learn the best ways to deal with Aurora/OneKeyLocker virus infection without being a victim of more frauds. Additionally, you can educate yourself on ransomware by reading a Varonis’ Complete. Furthermore, if you came across this article just out of sheer interested we suggest you read the Ultimate Ransomware Prevention guide, to save your files from the dangerous crypto-extortionist. 

What do you need to know about Aurora ransomware

Firstly, the reason why this ransomware has two names is that, as we will uncover in the distribution section later, Aurora/OneKeyLocker is a geo-malware, which modifies itself depending on the location of a victim. Regardless the different names this parasite appends .Aurora extension to the compromised files’ names.

Cyber specialists indicate that this crypto-extortionist is using embedded SQLite engine, which could lead to the assumption that Aurora uses SQLite to store some information that was collected from the compromised system.

Despite the minor differences, Aurora works as a typical malicious ransomware. It sneaks into the computer, bypasses the system’s security, finds personal files like music, documents, videos or pictures and encrypts it using special cipher and marking them with .Aurora string.

After the successful encryption, Aurora crypto-virus makes 6 copies of the ransom note named HOW_TO_DECRYPT_YOUR_FILES.txt, HOW_TO_DECRYPT_YOUR_FILES2.txt, HOW_TO_DECRYPT_YOUR_FILES3.txt, HOW_TO_DECRYPT_YOUR_FILES4.txt, HOW_TO_DECRYPT_YOUR_FILES5.txt, HOW_TO_DECRYPT_YOUR_FILES6.txt and drops it in various file directories so that the victim would notice it better.

The ‘HOW_TO_DECRYPT_YOUR_FILES.txt’ ransom note states:

===# aurora ransomware #===

Aurora Ransomware

SORRY! Your files are encrypted.
File contents are encrypted with random key.
Random key is encrypted with RSA public key (2048 bit).
We STRONGLY RECOMMEND you NOT to use any “decryption tools”.
These tools can damage your data, making recover IMPOSSIBLE.
Also we recommend you not to contact data recovery companies.
They will just contact us, buy the key and sell it to you at a higher price.
If you want to decrypt your files, you have to get RSA private key.
In order to get private key, write here: [email protected]
And pay 500$ on 3CwxawqJpM4RBNididvHf8LhFA2VfLsRjM wallet
If someone else offers you files restoring, ask him for test decryption.
Only we can successfully decrypt your files; knowing this can protect you from fraud.
You will receive instructions of what to do next.

===# aurora ransomware #===

Although this message is exaggerated to scare the victim so he/she would pay the money for the ransomware creators, there is some truth in it, which you should take in consideration. But in all cases DO NOT PAY for any service that offers file decryption. Just as Aurora states only they have the decryption key because they encrypted the files in the first place.

According to the hackernoon.com, the way asymmetric RSA algorithm works is it creates 2 keys – one private (decryption) and one public (encryption). As long as the hackers keep the private decryption key to themselves it is impossible to unlock the compromised files because you would need a unique code for your machine.

There are plenty of decrypting tools and services offering scams and it would be a shame to fall from one bad situation to worse and give out sensitive data or send money to these scammers too. That is why while there is no OFFICIAL trusted decryption software like BitDefender’s or Rakhni, you will have to try other methods to restore your files.

How Aurora malware is distributed

As reported Aurora uses a popular geo-targeting technique through GeoPlugin to spread using victims location. This dynamic approach allows adjusting some parts of the ransomware depending on what region victim’s IP comes from. According to Sophos, such malware can alter the infection tactics, spam email type, language, ransom note’s language, ransom amount, preferred cryptocurrency or even its name.

There is still no information what countries Aurora targets the most and it is hard to guess because it’s a geo-malware, but the found ransom note was in English so it could have been the U.S., UK, Australia or etc. However, the virus is not limited to just the English speaking countries, cause some cyber bloggers noticed that the virus was targeting Russian IPs as well. These versatile features are also noticed in Locky, WannaCry, TrickBot malware.

The most popular spreading method of Aurora/OneKeyLocker virus is the spam email attachments. Maybe the attack isn’t as massive as Locky’s 23 million emails, but no doubt that at least several thousand malicious messages with Aurora ransomware could have been sent out to various places globally. OneKeyLocker can also be distributed via malvertising, bundling or exploit kits. More on ransomware spreading on datto.com and biztechmagazine.com.

What is the solution for Aurora virus

Before trying to restore the files or to overall use the computer you should firstly remove this crypto-virus either manually or with automatic malware removal tool. There is no difference what method you choose, but from our experience, we advise you to choose the second option and trust your PC’s infection to the confident easy-to-use anti-spyware tool. We have to full list of such programs but usually, prefer Spyhunter and Malwarebytes.

Automatic Malware removal tools

Sometimes a sneaky Aurora virus can block your access to the internet and you won’t be able to download anything prior or after virus removal, but in this case just run Windows in a Safe Mode or follow the PCtechbytes.com. Lastly, because Aurora doesn’t have the decryptor yet, we suggest trying to recover locked files with Shadow Volume Copies. 

Edit: Emsisoft released a decryptor for Aurora, here is the link to the instruction and download page. While the ransomware still needs to be removed, the files can be recovered using that decryptor.

Manual Aurora virus removal and file restore

Step 2. Restore Aurora ransomware affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Aurora virus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so.

Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer.

a) Native Windows Previous Versions

Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

 
b) Shadow Explorer

It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored. 

Step 3. Use Data Recovery programs to recover Aurora ransomware encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download Data Recovery Pro (commercial)
• Install and scan for recently deleted files. 

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.