Ransomware

Planetary Decryptor Gets Your Files Back For Free

By:
On:
In: Cryptography, InfoSec, Ransomware
Tagged: , , , , ,
With: 0 Comments

Planetary Decryptor Gets Your Files Back For Free

A decryptor for the Planetary Ransomware family was released by Emsisoft this week that allows victims to decrypt their files for free. This ransomware family is named Planetary because it commonly uses the names of planets for the extensions added to encrypted file’s names.

When encrypting files it will append the .mira, .yum, .Pluto, or .Neptune extension to a an encrypted file’s name. For example, if a file called test.jpg was encrypted, it would be renamed to test.jpg.Pluto.

The latest variant appends the .mira extension, which is named after the fictitious planet from the Xenoblade video game.

encrypted
Encrypted .mira Files

In order to decrypt your files for free, you will need to make sure that you have a copy of the ransom note created when you were infected.

The ransom note is named !!!READ_IT!!!.txt and is located in each folder that had files that were encrypted and on the desktop.

decrypt
Planetary Ransomware Note for Mira variant

Decrypting the Planetary Ransomware

If you were infected with the Planetary Ransomware and still have the encrypted files and a ransom note, simply download the decrypt_Planetary.exe program from the following link and save it on your desktop:

Once downloaded, run the program with administrative privileges in order to decrypt all the files that were targeted by the ransomware.  Once started, you will be at the bruteforcer screen where it asks you to select a ransom note.

ransomware
Bruteforcer screen

Browse and select a ransom note and then click on the Start button.

The decryptor will then display the decryption key that was found as shown below.

Decryption
Decryption key found

You can now press the OK button to load the key into the decryptor.

The main decryptor screen will now be displayed and you should add any drives that contain files you wish to decrypt.

Decrypt
Main Decryptor Screen

Once ready, click on the Decrypt button to begin the decryption process. The decryptor will now search the computer for encrypted files that end with the .mira, .yum, .Pluto, or .Neptune extension and automatically decrypt them.

Decrypt
Decrypting Files

When it has finished, the Results tab will state Finished and all of your files should now be decrypted.

 

CBNN

No Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.