Please note that these free tools are provided as-is and without warranty of any kind. The tools may only work with specific ransomware versions, and may not work with versions that were released after a tool was created. Technical support for the tools is available only to customers using a paid Emsisoft product.
Yashma is a ransomware distributed under the name of "AstraLocker 2.0", and is based on the Chaos ransomware builder, using a combination of AES-128 and RSA-2048 to encrypt files. It was distributed under the name of "AstraLocker 2.0". The extension ".AstraLocker", or a random 4-character alphanumeric extension is appended to files.
Below is an example ransom note "Restore_Files.html":
A S T R A L O C K E R 2.0
What happened?
----------------------------------------------
All Your files has been succesfully encrypted due to security problem with Your PC.
All Your backups are deleted, or encrypted.
Can I recover my files?
----------------------------------------------
Sure! But You need special decryptor for that.
If You want to recover Your files, you need to cooperate.
What can I do to get my files back?
----------------------------------------------
You can buy my decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.
The price for the software is about 50$ (USD). Payment can be made in Monero, or Bitcoin (Cryptocurrency) only.
What guarantees?
----------------------------------------------
I value my reputation. If i do not do my work and liabilities, nobody will pay me. This is not in my interests.
All my decryption software is perfectly tested and will decrypt your data.
How do I pay, where do I get Monero or Bitcoin?
----------------------------------------------
Purchasing Monero or Bitcoin varies by country, it's best to do a quick google search yourself to learn how to buy Monero or Bitcoin. You need to pay 50$ in Bitcoin or Monero.
You can buy Bitcoin here:
https://localbitcoins.com/
Where i can pay?
----------------------------------------------
Monero Address:
48CEU93NRDqCmH3qfksLRLeQJ9mjbFCUXEyZkStiRDWtDodmAtd7voHF1sHa17MgmoYmMoErrJstV6nC1DqYoKxT38r6TUh
Bitcoin Addres:
bc1qpawwquwas0gd88u66hgxp222p52madqp5lk5xw
Contact
----------------------------------------------
After payment contact:
[email protected]
and send Your personal ID with transaction ID (if you are paying with Bitcoin)
Warning! If you report these emails, they may be suspended and NOBODY gets help.
It is in Your INTEREST to get the decryptor.
Your personal ID is:
ID12_Yashma
1)Don't change the extension of the files. You will harm the files.
2)Don't move encrypted files.
3)Don't try to recover files by Yourself. This is impossible. Your files are encrypted with Curve25519 encryption algorithm, You can't decrypt files without private key.
4)Don't report to authoritaries. If You do it, key will be deleted, and Your files will be encrypted forever.
5)The price will be lower if you email me within 24 hours after encrypting your files.