How to Decrypt Magniber Files

Magniber Ransomware is one of the few remaining ransomware strains that target end-users and are unrelated to DJVU. In the case of Magniber, the virus is a successor to the Cerber ransomware. Generally, it can been seen as an iteration of the same thing, but unlike Cerber and DJVU threats like .watz or .qual, this one unfortunately generates a different suffix for every key, making everything much harder to track.

In this post, we’ll attempt to help victims of Magniber recover as much of their data as possible. Fortunately, there’s a free decryptor tool designed to restore files locked by this ransomware and there are also a couple of other methods you can try.

However, we cannot promise you that all or any of your files will be restored. Each case of a ransomware attack is different and there are many variables at play that will determine if and how many of your data you’ll be able to recover.

Also, very importantly, you must ensure that the malware is removed from your PC before making any attempts to restore your files, or they may end up getting locked again.

SUMMARY:

Magniber Ransomware -Virus Removal Instructions

Ransomware threats tend to have many different variations and the same is true about Magniber. This makes it difficult to predict exactly where it stores its malicious data so we can’t provide a specific removal guide. Instead, we can give you some general directions on how to hunt down the virus, but you’d still need to do most of the leg work.

If you don’t feel confident in your abilities to manually find and remove the virus, it’s recommended that you use a specialized anti-malware tool with ransomware-removal abilities. SpyHunter, the program posted on this page, can help you with the Magniber removal and let you try the file-recovery methods without fear of getting your data locked again.

But if you still want to try to remove the virus on your own, here are the things you must try:

1. Delete any recently downloaded files and recently installed programs – Check your browser’s download history, open the location folders of all newly downloaded files, and delete them. It’s pretty much guaranteed that the file/program that got you Magniber is among them. Also, go to Apps & Features by searching for it in the Start Menu and uninstall newly installed programs that coincided with the ransomware attack.
2. Explore the Task Manager – Your goal is to look for questionable processes that use lots of RAM and CPU and have unusual names. Right-click the suspicious process, open its File Location, and delete everything there. Use Lock Hunter if you can’t delete any of the files. Then also remember to end the process itself.
3. Clean the Task Scheduler – Search for the Task Scheduler in the Start Menu, open it, and check the Task Scheduler Library for suspicious tasks that may be designed to automatically run the ransomware (or download it again). You’ll have to right-click any questionable tasks and go to Properties > Actions to see what action they perform to figure out if they are malicious.

If you don’t think you can find the malware and fully remove it, but don’t want to use an anti-malware tool, your only other option is to reinstall Windows. Note that it’s possible that this doesn’t always remove the ransomware, but it’s still your best chance to clean your system.

Magniber Decryption Instructions

Hopefully, you’ve already managed to remove the Magniber ransomware from your PC and can now focus on the file recovery solutions. As we mentioned, there can be no guarantees that any of the next methods will work, but it’s still much better to give them a try than to pay the ransom to the hackers.

We’ll provide several potential solutions, and we recommend you try each of them to maximize your chances of successful data recovery.

Magniber Free Decryptor Instructions

There’s a free decryptor for this ransomware that can unlock files locked by a lot of Magniber versions. Here, you can find a full list of the file suffixes that are recognized by this decryptor and can be unlocked by it. Note that the decryptor is mostly in Korean, but our instructions should be enough to orient you on how to use it:

1. Download the decryptor from this page, extract the contents of the .ZIP file, and then run the decryptor icon as administrator.
2. Copy the suffix from one of your encrypted files, paste it in the first text field in the decryptor window, and click the button next to it.
   
3. If a value appears in both the Key and IV fields, you can directly click Start and the decryption will begin.
   
4. If a value appears only in the Key field and IV remains empty, you’ll need a pair of two identical files – one encrypted and one accessible to continue.
5. If you have such a file pair, click the first button with the three dots, find the original (non-encrypted) file and load it. Then click the second three dots button and load the encrypted file from the pair.
   
6. Click Start and wait for the decryption to commence.

Note that the encrypted files will not be deleted during the process, so you’ll need to have enough space on your drive to accommodate their decrypted copies.

Restore Magniber Files With PhotoRec

Most forms of ransomware function by creating encrypted copies of the targeted files and then deleting the originals. PhotoRec works by attempting to restore those deleted originals. Depending on the severity of the infection, you may or may not be able to restore your data using this tool, but it’s definitely worth the try:

1. Download Photo Rec, right-click its file, and extract it.
2. Open the extracted folder and run qphotorec_win as administrator.
3. Under “Please select a media drive“, select your main drive.
   
4. Next, select the partition where your encrypted files are stored (the partition must have a NTFS file system).
5. Click the File Formats button and uncheck all file types except the ones you wish to recover to speed up the process.
6. Click the Browse button and choose a location where you want the recovered data to be saved (we recommend using an external drive).
   
7. Finally, click Search to start the recovery process.
   

Once the process is finished, go to the location you specified earlier and to see how many off your files have been recovered.

Recover Magniber Data With Media_Repair

Media_Repair uses a different approach to recover Ransomware-locked files which might sometimes provide a better solution for data encrypted by Magniber. It works only for certain types of media files (MP3, WAV, MP4, MOV, 3GP, and M4V) and it requires you to have a reference file in order to recover your data.

That reference file can be an identical unencrypted version of an encrypted file or a totally different file captured by the same device (camera, mic, etc.) using the same settings (resolution, aspect ratio, zoom, etc.).

If the encrypted file is created with a program, the reference file must also be created by that same program and, again, with the exact same settings. If you have a reference file for the type or types of data you wish to recover, here’s how to use the Media_Repair tool:

1. Paste the reference file or files in the same folder/s as the respective encrypted files
2. Download Media_Repair and extract the contents of the downloaded file.
3. In the left panel, navigate to the folder containing encrypted data.
4. Select any of the encrypted files shown in the right panel and click the upper button to the right. This will tell you if the program might be able to decrypt it.
5. Select the reference file in the right panel and click the lower button to the right to instruct the program it must use it as reference.
   
6. Click the Play button below to start the decryption process and wait for it to finish. You can pause the process at any time using the Stop button.
   

Once the decryption finishes, go to the folder with the encrypted files and there should be a new folder there named FIXED. Open it to see if, to what degree, and how many of your files have been restored.

These were all the methods for decrypting Magniber files we’ve found so far. If you have tried a different solution that has worked for you (even only partially), feel free to share it in the comments section below.