Blog

The Definitive Collection of Ransomware Decryption Tools on the Web

The Definitive Collection of Ransomware Decryption Tools on the Web [2020/11/27] [source]

  1. Identify your ransomware variant by visiting ID Ransomware
  2. Utilize the free ransomware decrypter tools listed below
  3. Try to restore from a backup
Decryptor DownloadRead MeEncrypted File ExtensionCreator/Contributor
CuteInstructionsaaaddress1
my-Little-RansomwareInstructionsaaaddress1
AES_NIInstructions*.aes_ni, *.aes256, *.aes_ni_0dayAvast
Alcatraz LockerInstructions*.AlcatrazAvast
ApocalypseInstructions*.encrypted, *.FuckYourData, *.locked, *.Encryptedfile, *.SecureCryptedAvast
ApocalypseVMInstructions*.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCryptedAvast
BadBlockInstructionsDoesn’t change file extension. Look for BadBlock in ransom note (32-Bit)Avast
BadBlockInstructionsDoesn’t change file extension. Look for BadBlock in ransom note (64-Bit)Avast
BartInstructions*.bart.zipAvast
BigBobRossInstructions*.obfuscatedAvast
BTCWareInstructions*.btcware, *.cryptobyte, *.cryptowin, *.theva, *.onyonAvast
Crypt888InstructionsThis ransomware adds Lock. to the beginning of file namesAvast
CryptFile2Instructions*.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd*.rsclAvast
CryptoMix (Offline)Instructions*.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd*.rscl, *.MOLEAvast
CryptoShieldInstructions*.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd*.rscl, *.MOLEAvast
ZetaInstructions*.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd*.rsclAvast
CrysisInstructions*.johnycryptor@hackermail.com.xtbl, *.ecovector2@aol.com.xtbl,  *.systemdown@india.com.xtbl, *.Vegclass@aol.com.xtbl, *.{milarepa.lotos@aol.com}.CrySiS, *.{Greg_blood@india.com}.xtbl, *.{savepanda@india.com}.xtbl, *.{arzamass7@163.com}.xtbl, *.{3angle@india.com}.dharma, *.{tombit@india.com}.dharma, *.walletAvast
EncrypTileInstructionsThe ransomware adds the word “encryptTile” into a file nameAvast
EncrypTileInstructions*.EncrypTileAvast
FindZipInstructions*.cryptAvast
GandCrabInstructions*.GDCB, *.CRAB, *.KRAB, *.%RandomLetters%Avast
GlobeInstructions*.ACRYPT, *.GSupport[0-9], *.blackblock, *.dll555, *.duhust, *exploit, *.frozen, *.globe, *.gsupport, *.kyra,  *.purged, *.raid[0-9], *.siri-down@india.com, *.xtlb, *.zendrz, *.zendr[0-9], *.hnyearAvast
HiddenTearInstructions*.locked, *.34xxx, *.bloccato, *.BUGSECCCC, *.Hollycrypt, *.lock, *.saeid, *.unlockit, *.razy, *.mecpt, *.monstro, *.lok, *.암호화됨, *.8lock8, *.fucked, *.flyper, *.kratos, *.drypted, *.CAZZO, *.doomedAvast
JigsawInstructions*.kkk, *.btc, *.gws, *.J, *.encrypted, *.porno, *.payransom, *.pornoransom, *.epic, *.xyz, *.versiegelt, *.encrypted, *.payb, *.payb, *.pays, *.payms, *.paymds, *,paymts, *.payrms, *.payrmts, *.paymrts, *.paybtcs, *.fun, *.hush, *.uk-dealer@sigaint.org, *.geficktAvast
LambdaLockerInstructions*.MyChemicalRomance4EVERAvast
LegionInstructions*._23-06-2016-20-27-23_$f_tactics@aol.com$.legion, *.$centurion_legion@aol.com$.cbfAvast
NoobCryptInstructionsNoobCrypt doesn’t change the file name. Leaves “ransomed.html” messageAvast
StampadoInstructions*.lockedAvast
SZFLockerInstructions*.szfAvast
TeslaCryptInstructionsThe latest version of TeslaCrypt doesn’t rename files.Avast
XDataInstructions*.~xdata~Avast
ApocalypseInstructions*.encrypted, *.FuckYourData, *.locked, *.Encryptedfile, *.SecureCryptedAVG
ApocalypseVMInstructions*.encrypted, *.FuckYourData, *.locked, *.Encryptedfile, *.SecureCryptedAVG
BadBlock 32-BitInstructionsDoesn’t change file extension. Look for BadBlock in ransom noteAVG
BadBlock 64-BitInstructionsDoesn’t change file extension. Look for BadBlock in ransom noteAVG
BartInstructions*.bart.zipAVG
Crypt888InstructionsThis ransomware adds Lock. to the beginning of file namesAVG
MirCopInstructionsLock.{Original file name}AVG
LegionInstructions*._23-06-2016-20-27-23_$f_tactics@aol.com$.legion, *..$centurion_legion@aol.com$.cbf or *.$centurion_legion@aol.com$.cbf to end of filenameAVG
SZFLockerInstructions*.szfAVG
TeslaCryptInstructionsDecryptor for variant that doesn’t rename filesAVG
AnnabelleInstructions*.ANNABELLEBitDefender
Bart*.BartBitDefender
GandCrab (V1, V4 and V5 up to V5.2 versions)Instructions*.GDCB, *.CRAB, *.KRAB, *.%RandomLetters%BitDefender
Juicy LemonInstructions*.id-{number}_maestro@pizzacrypts.infoBleeping Computer
PizzaCryptsInstructions*.id-{number}_, .id-{number}_sos@juicylemon.biz, .id-{number}_*@juicylemon.biz*protonmail.com*, .id-{number}_*@juicylemon.biz_BitMessage_*Bleeping Computer
ODCODCInstructions*.odcodcBleeping Computer
CryptorbitInstructionslocks files and creates HowDecrypt.txt and HowDecrypt.gifBleeping Computer
Operation Global IIIInstructions*.exeBleeping Computer
BitStakInstructions*.bitstakBleeping Computer
GhostCryptInstructions*.Z81928819Bleeping Computer
JigsawInstructions*.FUN, *.KKK, *.GWS, *.BTCBleeping Computer
Princess LockerInstructionsRansomware appends random characters to the file extensionBleeping Computer
AuroraInstructions*.NanoBleeping Computer
FilesLocker v1 and v2Instructions*.[fileslocker@pm.me]Bleeping Computer
EverbeInstructions*.insane, *.DUESCRYPT, *.deuscrypt, *.Tornado, *.twist, *.everbe, *.embrace, *.pain, *.volcanoBleeping Computer
InsaneCryptInstructions*.[everbe@airmail.cc].everbe, *.embrace, *.painBleeping Computer
AnnabelleInstructions*.ANNABELLEBleeping Computer
CryptoDevilInstructions*.devilBleeping Computer
ZykaInstructions*.lockBleeping Computer
Unlock92Instructions*.CRRRTBleeping Computer
CryptoHostCryptoHostDetected as Ransom:MSIL/Manamecrypt.A and Ransom_CRYPTOHOST.A.Bleeping Computer
TorrentLockerInstructions*.encrypted, *.encBleeping Computer
AlphaInstructions*.encryptBleepingComputer
BitKangarooInstructions*.bitkangarooBleepingComputer
Crypt38Instructions*.crypt38BleepingComputer
DCryInstructions*.dcryBleepingComputer
MicroCopInstructionsAdds Locked to the beginning of your encrypted filesBleepingComputer
Mole02InstructionsN/ABleepingComputer
Offline CryptoMixInstructions*.CRYPTOSHIELD, *.scl, *.rscl, *.lesli, *.rdmk, *.code, *.rmdBleepingComputer
PowerLockyInstructions*.lockyBleepingComputer
StrikedDecrypterInstructions*.Andrey.gorlachev@aol.com,*.nukem@mortalkombat.top, *.rap@mortalkombat.top, *.m.pirat@aol.com, *.duk@mortalkombat.top, *.jekabro@mortalkombat.top, *.bitcoin@mortalkombat.topBleepingComputer
AnDROidInstructions*.androidBleepingComputer
Anti-DDosInstructions*.f*ckedBleepingComputer
Crypt0Instructions*_crypt0BleepingComputer
Crypto-BlockerInstructions*.corruptedBleepingComputer
CryptoLocker by NTKInstructions*.pownedBleepingComputer
CryptoSomwareInstructions*.FailedAccessBleepingComputer
DeriaLockInstructions*.deriaBleepingComputer
DoNotOpenInstructions*.killedXXXBleepingComputer
EnkripsiPCInstructions*.bleepedBleepingComputer
F*ckTheSystemInstructions*.anonBleepingComputer
HarzhuangziInstructions*.HarzhuangziBleepingComputer
HatersInstructions*.hatersBleepingComputer
HitlerInstructions*.NaziBleepingComputer
JeepersCryptInstructions*.jeepersBleepingComputer
ManifestusInstructions*.f*ckedBleepingComputer
MikoyanInstructions*.MIKOYANBleepingComputer
NullByteInstructions*._nullbyteBleepingComputer
SnakeEyeInstructions*.SnakeEyeBleepingComputer
XncryptInstructions*.xncryptBleepingComputer
MoleInstructions*.moleCERT-PL
BarRaxInstructions*.barraxCheck Point
Merry X-MasInstructions*.PEGS1, *.MRCR1, *.RARE1, *.MERRY, *.RMCM1Check Point
JigsawInstructions*.FUN, *.KKK, *.GWS, *.BTCCheck Point
PylockyInstructionsRANSOM_PYLOCKY.ACisco
TeslaCryptInstructions{original file name}.ECCCisco
ThanatosInstructions*.THANATOSCisco
NanolockerInstructionsCyberclues
PopcornInstructions*.filockElevenpaths
Decrypt ProtectInstructions*.htmlEmsisoft
777Instructions*.777Emsisoft
Al-NamroodInstructions*.unavailable, *.disappearedEmsisoft
Amnesia2Instructions*.amnesiaEmsisoft
ApocalypseInstructions*.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCryptedEmsisoft
ApocalypseVMInstructions*.encrypted, *.lockedEmsisoft
AuroraInstructions*.Aurora, *.aurora, *.animus, *.cryptoid, *.peekaboo, *.isolated, *.infected, *.lockedEmsisoft
AutoLockyInstructions*.lockyEmsisoft
BadBlockInstructionsDoesn’t change file extension. Look for BadBlock in ransom noteEmsisoft
Cry128Instructions*.fgb45ft3pqamyji7.onion.to._ or *.id__gebdp3k7bolalnd4.onion._’ or *.id__2irbar3mjvbap6gt.onion.to._ or *.id-_[qg6m5wo7h3id55ym.onion.to].63vc4Emsisoft
Cry9Instructions*.fgb45ft3pqamyji7.onion.to._, 8.id__gebdp3k7bolalnd4.onion._, *.id__2irbar3mjvbap6gt.onion.to._, *.id-_[qg6m5wo7h3id55ym.onion.to].63vc4Emsisoft
CrypBossInstructions*.crypt, *.R16M01D0Emsisoft
CryptInfiniteInstructions*.CRINFEmsisoft
CryptoDefenseInstructionsIdentifes as CryptoDefense leaves note HOW_DECRYPT.txtEmsisoft
CryptonInstructions*.id-_locked, *.id-_locked_by_krec, *.id-_locked_by_perfect, *.id-_x3m, *.id-_r9oj, *.id-_garryweber@protonmail.ch, *.id-_steaveiwalker@india.com_, *.id-_julia.crown@india.com_, *.id-_tom.cruz@india.com_, *.id-_CarlosBoltehero@india.com_,*.id-_maria.lopez1@india.com_Emsisoft
DamageInstructions*.damageEmsisoft
DMALockerInstructionsDMALocker with ID “DMALOCK 41:55:16:13:51:76:67:99Emsisoft
DMALocker2InstructionsDMALocker2 with ID “DMALOCK 43:41:90:35:25:13:61:92Emsisoft
FabiansomwareInstructions*.encryptedEmsisoft
FenixLockerInstructions*.centrumfr@india.com!!Emsisoft
GetCryptInstructionsAppends a random 4-character extension to filesEmsisoft
GlobeInstructions*.purge, *.globe, *.okean-1955@india.com.!dsvgdfvdDVGR3SsdvfEF75sddf#xbkNY45fg6}P{cg.xtbl.Emsisoft
Globe2Instructions*.raid10, *.blt, *.globe, *.encrypted,*[mia.kokers@aol.com]Emsisoft
Globe3Instructions*.decrypt2017, *.hnumkhotepEmsisoft
GlobeImposterInstructions*.cryptEmsisoft
GomasomInstructions*.cryptEmsisoft
HarasomInstructions*.html and note from Spamhaus or US Department of JusticeEmsisoft
HKCryptInstructions*.hackedEmsisoft
HydraCryptInstructions*.hyrdacrypt, *.umbrecryptEmsisoft
UmbreCryptInstructions*.hydracrypt, *.umbrecryptEmsisoft
ImS00rryInstructionsEmsisoft
JSWorm 4.0Instructions*.[ID-9LF5BNP][symmetries@tutamail.com].JSWRMEmsisoft
JSWormInstructions*.[ID.194958][remarkpaul77@cock.li].JSWORMEmsisoft
KeyBTCInstructionsLeaves ransom note called Decrypt_Your_Files.txt on your system that asks you to contact keybtc@inbox.com for decryption.Emsisoft
LeChiffreInstructions*.LeChiffre and the ransom note asks you to contact decrypt.my.files@gmail.com via email.Emsisoft
Instructions*.lcphrEmsisoft
MarlboroInstructions*.oopsEmsisoft
MegaLockerInstructions*.nampohyuEmsisoft
MRCR or Merry X-MasInstructions*.PEGS1, *.MRCR1, *.RARE1, *.MERRY, *.RMCM1Emsisoft
NemucodInstructions*.crypted and you find a ransom note named DECRYPT.txt on your desktop.Emsisoft
NemucodAESInstructionsDoes not change file extension and a ransom note named “DECRYPT.hta” can be found on your desktop.Emsisoft
NMoreiraInstructions*.maktub, *._AiraCropEncrypted!Emsisoft
OpenToYouInstructions*.-opentoyou@india.comEmsisoft
OzozaLockerInstructions*.locked With a ransom note named “HOW TO DECRYPT YOU FILES.txt” on your desktop. Note is from santa_helper@protonmail.comEmsisoft
PClockInstructionsDoesn’t change extension look for enc_files.txtEmsisoft
PewcryptInstructions*.PewCryptEmsisoft
PhiladelphiaInstructions*.lockedEmsisoft
PlanetaryInstructions*.miraEmsisoft
RadamantInstructions*.rdm, *.rrkEmsisoft
StampadoInstructions*.locked Known variants of this ransomware ask victims to contact  paytodecrypt@sigaint.org, getfiles@tutanota.com,  successl@qip.ru, clesline212@openmailbox.org or ransom64@sigaint.orgEmsisoft
SyrkInstructions*.SyrkEmsisoft
XoristInstructions*.EnCiPhErEd, *.0JELvV, *.p5tkjw, *.6FKR8d, *.UslJ6m, *.n1wLp0, *.5vypSa, *.YNhlv1Emsisoft
ZQInstructions*.zqEmsisoft
WannaCryFakeInstructions*.wannacryEmsisoft
AvestInstructions*.ckey().email().pack14Emsisoft
TeslaCryptInstructions*.xxx, *.ttt, *.micro, *.mp3ESET
VirlockInstructions*.exeESET
CrysisInstructions*.xtbl, *.crysis, *.crypt, *.lock, *.crypted, *.dharma, *.wallet, *.onionESET
SimplockerInstructionsESET
TrustezebInstructionsESET
MiraInstructions*.miraF-Secure
TeslaCryptInstructions*.vvv, *.ccc, *.zzz, *.aaa, *.abcGoogulator
7even-HONE$TPython Script{sequential number}.R4A or{sequential number}.R5Ahasherezade
BitcryptorInstructions.cvlstKaspersky
Agent.iihInstructionsKaspersky
AuraInstructionsKaspersky
AutoITInstructions{Original Filename}@<mail server>_.<random_set_of_characters>.Kaspersky
AutoLTInstructionsRenames files “<original_name>@<mail server>_.<random_set_of_characters>”Kaspersky
Bitman v.3Instructions*.xxx, *.ttt, *.micro, *.mp3Kaspersky
Bitman v.4InstructionsDoes not change file extension.Kaspersky
CerberInstructions{10 random characters}.cerberKaspersky
ChimeraInstructions{Original file name}.cryptKaspersky
CryptokluchenInstructionsKaspersky
CrysisInstructionsid}.{email address}.xtbl, cryptKaspersky
DemocryInstructions*._date-time_$address@domain$.777 OR *._date-time_$address@domain$.legionKaspersky
DharmaInstructions*.walletKaspersky
JaffInstructions*.JaffKaspersky
LamerInstructionsKaspersky
LobzikInstructions*.fun, *.gws, *.btc, *.AFD, *.porno, *.pornoransom, *.epic, *.encrypted, *.J, *.payransom, *.paybtcs, *.paymds, *.paymrss, *.paymrts, *.paymst, *.paymts, *.payrmsKaspersky
LortokInstructions*.crimeKaspersky
PletorInstructionsKaspersky
RakhniInstructions*.locked, *.krakenKaspersky
RotorInstructions*.!____GLOK9200@GMAIL.COM____.tar, *.!____cocoslim98@gmail.com____.tarKaspersky
TeslaCrypt v3Instructions{original file name}.XXX or TTT or MP3 or MICROKaspersky
TeslaCrypt v4InstructionsFile name and extension are unchangedKaspersky
XDataInstructions*.~xdata~Kaspersky
AutoLTInstructionsRenames files “<original_name>@<mail server>_.<random_set_of_characters>”Kaspersky
CryaklInstructionsInfected with Trojan-Ransom.Win32.Cryakl (also tags end of file name with{CRYPTENDBLACKDC})Kaspersky
CrybolaInstructionsInfected with Trojan-Ransom.Win32.CrybolaKaspersky
CryptXXX v1Instructions{original file name}.crypt, cryp1, crypz, or 5 hexadecimal charactersKaspersky
CryptXXX v2Instructions{original file name}.crypt, cryp1, crypz, or 5 hexadecimal charactersKaspersky
CryptXXX v3Instructions{original file name}.crypt, cryp1, crypz, or 5 hexadecimal charactersKaspersky
FuryInstructionsInfected with Trojan-Ransom.Win32.FuryKaspersky
MarsjokeInstructions*.a19 or *p19Kaspersky
PolyglotInstructionsInfected with Trojan-Ransom.Win32.PolyglotKaspersky
RannohInstructionsRenames files “locked-<original_name>.<four_random_letters>”Kaspersky
ShadeInstructions*.xtbl, *.ytbl, *.breaking_bad, *.heisenbergKaspersky
WildfireInstructions*.wflxKaspersky
XoristInstructions*.xorist (or adds a random extension)Kaspersky
RectorInstructionsTrojan-Ransom.Win32.RectorKaspersky
ScraperInstructionsTrojan-Ransom.Win32.ScraperKaspersky
CrysisInstructions*.johnycryptor@hackermail.com.xtbl, *.ecovector2@aol.com.xtbl, *.systemdown@india.com.xtbl, *.Vegclass@aol.com.xtbl, *.{milarepa.lotos@aol.com}.CrySiS, *.{Greg_blood@india.com}.xtbl, *.{savepanda@india.com}.xtbl, *.{arzamass7@163.com}.xtbl, *.{3angle@india.com}.dharma, *.{tombit@india.com}.dharma, *.walletKaspersky
CoinVaultInstructions*.cvlstKaspersky
FortuneCryptInstructionsKaspersky
YatronInstructions*.yatronKaspersky
PetyaInstructionsleo-stone
TeslaCryptInstructions*.xxx, *.ttt, *.micro, *.mp3McAfee
TeslaCrypt V3Instructions*.mp3, *.micro, *.xxx, *.tttMcAfee
PoshCoderPoshCoder*.lockypan-unit42
CryprenInstructions*.encryptedpekeinfo
AlmaInstructionsAdds 5 random characters at the end of each file and a unique 8 character victim IDPHISHLABS
Lock Screen USBInstructionsLockscreen ransomwareTrend Micro
Lock ScreenInstructionsLockscreen ransomwareTrend Micro
777Instructions{Original file name}.777Trend Micro
AutoLockyInstructions{Original file name}.lockyTrend Micro
Cerber .v1Instructions{10 random characters}.cerberTrend Micro
ChimeraInstructions{Original file name}.cryptTrend Micro
DemoToolInstructions*.demoadcTrend Micro
DXXD v.1Instructions{Original file name}.{Original extension}dxxdTrend Micro
Globe .v1Instructions{Original file name}.purgeTrend Micro
Globe .v2Instructions{Original file name}.{email address + random characters}Trend Micro
Globe v.3InstructionsExtension not fixed or file name encryptedTrend Micro
JigsawInstructions*.FUN, *.KKK, *.GWS, *.BTCTrend Micro
LeChiffreInstructions{Original file name}.LeChiffreTrend Micro
MirCopInstructionsLock.{Original file name}Trend Micro
NemucodInstructions{Original file name}.cryptedTrend Micro
Purge v.1Instructions{Original file name}.purgeTrend Micro
Purge v.2Instructions{Original file name}.{email address + random characters}Trend Micro
Purge v.3Instructions{Original file name}.{email address + random characters}Trend Micro
SNSLockerInstructions{Original file name}.RSNSLockedTrend Micro
StampadoInstructions*.lockedTrend Micro
TeamxratInstructions{Original filename}.__xratteamLuckedTrend Micro
TeleCryptInstructions{Original file name}Trend Micro
TeslaCrypt v3Instructions{original file name}.XXX or TTT or MP3 or MICROTrend Micro
TeslaCrypt v4InstructionsFile name and extension are unchangedTrend Micro
XORBATInstructions{Original file name}.cryptedTrend Micro
XoristInstructions*.xorist (or adds a random extension)Trend Micro
XpanInstructions{Original filename}.__xratteamLuckedTrend Micro
Instructions{original file name}.ECCTrend Micro
BadBlockInstructionsDoesn’t change file extension. Look for BadBlock in ransom noteTrend Micro
MacRansomInstructionsTrend Micro
777Instructions*.777Trend Micro
CryptXXX v1Instructions{original file name}.crypt, cryp1, crypz, or 5 hexadecimal charactersTrend Micro
CryptXXX v2Instructions{original file name}.crypt, cryp1, crypz, or 5 hexadecimal charactersTrend Micro
CryptXXX v3Instructions{original file name}.crypt, cryp1, crypz, or 5 hexadecimal charactersTrend Micro
CryptXXX v4Instructions*.5 hexadecimal charactersTrend Micro
CryptXXX v5Instructions*.5 hexadecimal charactersTrend Micro
CrysisInstructions*.johnycryptor@hackermail.com.xtbl, *.ecovector2@aol.com.xtbl,  *.systemdown@india.com.xtbl, *.Vegclass@aol.com.xtbl, *.{milarepa.lotos@aol.com}.CrySiS,  *.{Greg_blood@india.com}.xtbl, *.{savepanda@india.com}.xtbl, *.{arzamass7@163.com}.xtbl, *.{3angle@india.com}.dharma, *.{tombit@india.com}.dharma, *.walletTrend Micro
TeslaCrypt V2Instructions{original file name}.VVV, CCC, ZZZ, AAA, ABC, XYZTrend Micro
XRatTeamInstructions*.xratteamLuckedTrend Micro

One thought on “The Definitive Collection of Ransomware Decryption Tools on the Web”

  1. Pingback: What is Ransomware? – Computer Den Support Services
  2. Pingback: My Homepage

Leave a Reply

Your email address will not be published. Required fields are marked *