Helping the victims of Yatron and FortuneCrypt ransomware

[harlan4096]

Ransomware has been and remains a big headache for both users and experts alike. It is not a simple task to recover files encrypted by ransomware, and in many cases it’s impossible. But we have good news for the victims of Yatron and FortuneCrypt malware: Kaspersky experts have developed and published decryptors for the files this particular malware encrypts.

How to decrypt files encrypted by Yatron

Yatron ransomware is based on another encryptor, Hidden Tear, which has an unusual story. A few years ago, Turkish researcher Utku Sen created this malware for educational and research purposes and uploaded the source code to the Internet. The legacy of this software is still with us all; experts continue to find new ransomware based on it, and Yatron is just one such example.

Fortunately, vulnerabilities were found in the Yatron code, and our experts took advantage of them to create a decryptor. If you see a *.yatron extension on any locked files, then go to the No More Ransom website to download a decryption tool that will recover your files.

How to decrypt files encrypted with FortuneCrypt

The second ransomware package is also difficult to call a masterpiece — er, hackerpiece? Instead of using advanced languages like C/C++ and Python, the creators of FortuneCrypt wrote it in BlitzMax, a fairly simple language that is a kind of turbocharged BASIC. In the history of our research into malware tracking, we had never before encountered this language.

Our experts found that the malware’s encryption algorithm is far from perfect, and that allowed them to develop a decryptor for it. As with Yatron, FortuneCrypt victims can download a decryption tool from the No More Ransom portal.

What to do about ransomware on your computer

First of all, do not pay the ransom. Paying only encourages criminals, and it is no guarantee you will be able to recover your data. The best course of action is to go to the No More Ransom website, which was created by experts from several cybersecurity companies and law enforcement agencies from all over the world, including Kaspersky, Interpol, and the Dutch police, to alleviate the plight of ransomware victims. The website contains decryptors for hundreds of ransomware programs, and of course they are all free.
...

Continue Reading