The Definitive Collection of Ransomware Decryption Tools on the Web
Ransomware attacks can be crippling if they happen to you. If you’re hit by ransomware, don’t just pay the ransom. Here is a list of steps you need to take:
- Download our ransomware response kit
- Utilize the free ransomware decrypter tools listed below
- Try to restore from a backup
- Protect yourself from future attacks with CryptoStopper™
WatchPoint has scoured the web and created the largest collection of ransomware decryptors and decryption tools available. These tools may help you to decrypt your files without having to pay the ransom. This list is updated regularly so if the decrypter or tool you need isn’t available check back in the future and it may be available.
Feel free to contact us if you have questions about these tools or have been subject to an attack and need help figuring out what to do next.
| Decryptor Download | Read Me | Encrypted File Extension | Creator/Contributor |
|---|---|---|---|
| Derialock | Instructions | .deria | Check Point |
| PHP | Instructions | Check Point | |
| BarRax | Instructions | Check Point | |
| PizzaCrypts | Bleeping Computer | ||
| ODCODC | Bleeping Computer | ||
| Cryptorbit | Instructions | locks files and creates HowDecrypt.txt and HowDecrypt.gif | Bleeping Computer |
| TorrentLocker | *.encrypted, *.enc | DecryptFixer | |
| TeslaCrypt | Instructions | *.xxx, *.ttt, *.micro, *.mp3 | ESET |
| Virlock | Instructions | ESET | |
| Apocalypse | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | AVG |
| ApocalypseVM | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | AVG |
| MirCop | Instructions | Lock.{Original file name} | AVG |
| Alcatraz Locker | Instructions | *.Alcatraz | Avast |
| Apocalypse | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | Avast |
| ApocalypseVM | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | Avast |
| BadBlock | 64-bit | Doesn't change file extension. Look for BadBlock in ransom note | Avast |
| BadBlock | 32-bit | Doesn't change file extension. Look for BadBlock in ransom note | |
| Bart | Instructions | *.bart.zip | Avast |
| Crypt888 | Instructions | This ransomware adds Lock. to the beginning of file names | Avast |
| CryptFile2 | *.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rscl | Avast | |
| CryptoMix | Instructions | *.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rscl | Avast |
| CryptoShield | Instructions | Avast | |
| Zeta | Instructions | *.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rscl | Avast |
| Zeta | Instructions | *.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rscl | Avast |
| Crysis | Instructions | id}.{email address}.xtbl, crypt | Avast |
| Globe | Instructions | *.ACRYPT, *.GSupport[0-9], *.blackblock, *.dll555, *.duhust, *.exploit, *.frozen, *.globe, *.gsupport, *.kyra, *.purged, *.raid[0-9], *[email protected], *.xtbl, *.zendrz, *.zendr[0-9], *.hnyear | Avast |
| HiddenTear | Instructions | *.locked, *.34xxx, *.bloccato, *.BUGSECCCC, *.Hollycrypt, *.lock, *.saeid, *.unlockit, *.razy, *.mecpt, *.monstro, *.lok, *.암호화됨, *.8lock8, *.fucked, *.flyper, *.kratos, *.krypted, *.CAZZO, *.doomed. | Avast |
| Jigsaw | Instructions | .FUN, .KKK, .GWS, .BTC | Avast |
| Legion | Instructions | [email protected]$.legion or [email protected]$.cbfto the end of filename | Avast |
| NoobCrypt | Instructions | Avast | |
| Stampado | Instructions | *.locked | Avast |
| SZFLocker | Instructions | *.szf | Avast |
| TeslaCrypt | Instructions | Avast | |
| Linux.Encoder.1 | BitDefender | ||
| Linux.Encoder.3 | BitDefender | ||
| AES_NI | Instructions | *.aes_ni, *.aes256, *.aes_ni_0day | Kaspersky |
| Agent.iih | Instructions | Kaspersky | |
| Aura | Instructions | Kaspersky | |
| AutoIT | Instructions | {Original Filename}@<mail server>_.<random_set_of_characters>. | Kaspersky |
| Bitman v.3 | Instructions | Kaspersky | |
| Bitman v.4 | Instructions | Kaspersky | |
| Cerber | Instructions | {10 random characters}.cerber | Kaspersky |
| Chimera | Instructions | {Original file name}.crypt | Kaspersky |
| Cryptokluchen | Instructions | Kaspersky | |
| Crysis | Instructions | id}.{email address}.xtbl, crypt | Kaspersky |
| Democry | Instructions | *[email protected]$.777 OR *[email protected]$.legion | Kaspersky |
| Dharma | Kaspersky | ||
| Dharma | Instructions | .wallet | Kaspersky |
| Jaff | Instructions | *.Jaff | Kaspersky |
| Lamer | Instructions | Kaspersky | |
| Lobzik | Instructions | .fun, .gws, .btc, .AFD, .porno, .pornoransom, .epic, .encrypted, .J, .payransom, .paybtcs, .paymds, .paymrss, .paymrts, .paymst, .paymts, .payrms | Kaspersky |
| Lortok | Instructions | Kaspersky | |
| Pletor | Instructions | Kaspersky | |
| Rakhni | Instructions | *.locked, *.kraken | Kaspersky |
| Rotor | Instructions | Kaspersky | |
| TeslaCrypt v3 | Instructions | {original file name}.XXX or TTT or MP3 or MICRO | Kaspersky |
| TeslaCrypt v4 | Instructions | File name and extension are unchanged | Kaspersky |
| XData | Instructions | *.~xdata~ | Kaspersky |
| AutoLT | Instructions | Renames files "<original_name>@<mail server>_.<random_set_of_characters>" | Kaspersky |
| Cryakl | Instructions | Infected with Trojan-Ransom.Win32.Cryakl also tags end of file name with {CRYPTENDBLACKDC} | Kaspersky |
| Crybola | Instructions | Infected with Trojan-Ransom.Win32.Crybola | Kaspersky |
| CryptXXX v.1-.v3 | Instructions | Infected with Trojan-Ransom.Win32.CryptXXX | Kaspersky |
| Fury | Instructions | Infected with Trojan-Ransom.Win32.Fury | Kaspersky |
| Marsjoke | Instructions | Kaspersky | |
| Polyglot | Instructions | Infected with Trojan-Ransom.Win32.Polyglot | Kaspersky |
| Rannoh | Instructions | Renames files "locked-<original_name>.<four_random_letters>" | Kaspersky |
| Shade | *.xtbl, *.ytbl, *.breaking_bad, *.heisenberg. | Kaspersky | |
| Troldesh | Kaspersky | ||
| Wildfire | *.wflx | Kaspersky | |
| WannaCry WCRY | Instructions | *.WNCRY, *.WCRY | Trend Micro |
| 777 | Instructions | {Original file name}.777 | Trend Micro |
| AutoLocky | Instructions | {Original file name}.locky | Trend Micro |
| Cerber .v1 | Instructions | {10 random characters}.cerber | Trend Micro |
| Chimera | Instructions | {Original file name}.crypt | Trend Micro |
| CryptXXX v.1-v.3 | Instructions | {original file name}.crypt, cryp1, crypz, or 5 hexadecimal characters | Trend Micro |
| CryptXXX v.4-.v5 | Instructions | {MD5 Hash}.5 hexadecimal characters | Trend Micro |
| DemoTool | Instructions | .demoadc | Trend Micro |
| DXXD v.1 | Instructions | {Original file name}.{Original extension}dxxd | Trend Micro |
| Globe .v1 | Instructions | {Original file name}.purge | Trend Micro |
| Globe .v2 | Instructions | {Original file name}.{email address + random characters} | Trend Micro |
| Globe v.3 | Instructions | Extension not fixed or file name encrypted | Trend Micro |
| Jigsaw | Instructions | .FUN, .KKK, .GWS, .BTC | Trend Micro |
| LeChiffre | Instructions | {Original file name}.LeChiffre | Trend Micro |
| MirCop | Instructions | Lock.{Original file name} | Trend Micro |
| Nemucod | Instructions | {Original file name}.crypted | Trend Micro |
| Purge v.1 | Instructions | {Original file name}.purge | Trend Micro |
| Purge v.2 | Instructions | {Original file name}.{email address + random characters} | Trend Micro |
| Purge v.3 | Instructions | {Original file name}.{email address + random characters} | Trend Micro |
| SNSLocker | Instructions | {Original file name}.RSNSLocked | Trend Micro |
| Stampado | Instructions | *.locked | Trend Micro |
| Teamxrat | Instructions | {Original filename}.__xratteamLucked | Trend Micro |
| TeleCrypt | Instructions | {Original file name} | Trend Micro |
| TeslaCrypt v3 | Instructions | {original file name}.XXX or TTT or MP3 or MICRO | Trend Micro |
| TeslaCrypt v4 | Instructions | File name and extension are unchanged | Trend Micro |
| XORBAT | Instructions | {Original file name}.crypted | Trend Micro |
| Xorist | Instructions | .xorist (or adds a random extension) | Trend Micro |
| Xpan | Instructions | {Original filename}.__xratteamLucked | Trend Micro |
| BadBlock | Instructions | Doesn't change file extension. Look for BadBlock in ransom note | Trend Micro |
| Vandev | .xorist (or adds a random extension) | Kaspersky | |
| Rector | Infected with Trojan-Ransom.Win32.Rector | Kaspersky | |
| Scatter | Infected with Trojan-Ransom.BAT.Scatter | Kaspersky | |
| Scraper | Infected with Trojan-Ransom.Win32.Scraper | Kaspersky | |
| Xorist | .xorist (or adds a random extension) | Kaspersky | |
| Decrypt Protect | Emsisoft | ||
| BadBlock | Instructions | Doesn't change file extension. Look for BadBlock in ransom note | AVG |
| Bart | Instructions | *.bart.zip | AVG |
| Crypt888 | Instructions | This ransomware adds Lock. to the beginning of file names | AVG |
| Legion | Instructions | Legion adds a variant of *[email protected]$.legion or *[email protected]$.cbf to end of filename | AVG |
| SZFLocker | Instructions | *.szf | AVG |
| TeslaCrypt | Instructions | Decryptor for variant that doesn't rename files | AVG |
| Troldesh | Intel | ||
| TeslaCrypt | *.xxx, *.ttt, *.micro, *.mp3 | Intel | |
| Wildfire | Instructions | *.wflx | Intel |
| TeslaCrypt | Talos | ||
| Crysis | Instructions | *.xtbl, *.crysis, *.crypt, *.lock, *.crypted, *.dharma, *.wallet, *.onion | ESET |
| Jigsaw | .FUN, .KKK, .GWS, .BTC | Check Point | |
| KimcilWare | Fortinet | ||
| Amnesia | Instructions | *.amnesia or [byd at india dot com].SON. | Emsisoft |
| 777 | Instructions | *.777 | Emsisoft |
| Al-Namrood | Instructions | *.unavailable, *.disappeared | Emisoft |
| Amnesia2 | Instructions | *.amnesia | Emisoft |
| Apocalypse | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | Emsisoft |
| ApocalypseVM | Instructions | *.encrypted, *.locked | Emsisoft |
| AutoLocky | Instructions | *.locky | Emsisoft |
| BadBlock | Instructions | Doesn't change file extension. Look for BadBlock in ransom note | Emsisoft |
| Cry9 | Instructions | ".<id>-juccy[a]protonmail.ch", ".id-<id>", ".id-<id>_[[email protected]].xj5v2", ".id-<id>_r9oj", ".id-<id>_x3m", ".id-<id>_[[email protected]]_[[email protected]].x3m", ".<id>", ".<id>-sofia_lobster[a]protonmail.ch" and ".<id>_[wqfhdgpdelcgww4g.onion.to].r2vy6" | Emsisoft |
| Cry128 | Instructions | *.fgb45ft3pqamyji7.onion.to._ or *.id_ | Emisoft |
| CrypBoss | Instructions | *.crypt, *.R16M01D0 | Emsisoft |
| CryptInfinite | Instructions | *.CRINF | Emsisoft |
| CryptoDefense | Instructions | Identifes as CryptoDefense leaves note HOW_DECRYPT.txt | Emsisoft |
| Crypton | Instructions | ".id-_locked", ".id-_locked_by_krec", ".id-_locked_by_perfect", ".id-_x3m", ".id-_r9oj", "[email protected]", "[email protected]_", "[email protected]_", "[email protected]_", "[email protected]_" and "[email protected]_" | Emsisoft |
| Damage | Instructions | ..damage | Emsisoft |
| DMALocker2 | Instructions | DMALocker2 with ID “DMALOCK 43:41:90:35:25:13:61:92 | Emsisoft |
| DMALocker | Instructions | DMALocker with ID “DMALOCK 41:55:16:13:51:76:67:99 | Emsisoft |
| Fabiansomware | Instructions | *.encrypted | Emsisoft |
| FenixLocker | Instructions | Emsisoft | |
| Globe2 | Instructions | *.raid10, *.blt, *.globe, *.encrypted,*[[email protected]] | Emsisoft |
| Globe3 | Instructions | *.decrypt2017, *.hnumkhotep | Emsisoft |
| Globe | Instructions | *.purge, *.globe, *[email protected]!dsvgdfvdDVGR3SsdvfEF75sddf#xbkNY45fg6}P{cg.xtbl. | Emsisoft |
| GlobeImposter | Instructions | *.crypt | Emsisoft |
| Gomasom | Instructions | *.crypt | Emsisoft |
| Harasom | Instructions | *.html and note from Spamhaus or US Department of Justice | Emsisoft |
| HydraCrypt | Instructions | *.hyrdacrypt, *.umbrecrypt | Emsisoft |
| UmbreCrypt | Instructions | *.hydracrypt, *.umbrecrypt | Emsisoft |
| KeyBTC | Instructions | Leaves ransom note called Decrypt_Your_Files.txt | Emsisoft |
| LeChiffre | Instructions | *.LeChiffre | Emsisoft |
| Marlboro | Instructions | *.oops | Emsisoft |
| MRCR or Merry X-Mas | Instructions | *.PEGS1, *.MRCR1, *.RARE1, *.MERRY, *.RMCM1 | Emsisoft |
| Nemucod | Instructions | *.crypted | Emsisoft |
| NemucodAES | Instructions | Does not change file extension | Emisoft |
| NMoreira | Instructions | *.maktub, *._AiraCropEncrypted! | Emsisoft |
| OpenToYou | Instructions | *[email protected] | Emsisoft |
| OzozaLocker | Instructions | *.locked | Emsisoft |
| PClock | Instructions | Doesn't change extension look for enc_files.txt | Emsisoft |
| Philadelphia | Instructions | *.locked | Emsisoft |
| Radamant | Instructions | *.rdm, *.rrk | Emsisoft |
| Stampado | Instructions | *.locked | Emsisoft |
| Xorist | Instructions | *.EnCiPhErEd, *.0JELvV, *.p5tkjw, *.6FKR8d, *.UslJ6m, *.n1wLp0, *.5vypSa, *.YNhlv1 | Emsisoft |
| BitStak | Instructions | *.bitstak | Bleeping Computer |
| GhostCrypt | Bleeping Computer | ||
| 8lock8 | Instructions | .8block8 | Bleeping Computer |
| Jigsaw | Instructions | .FUN, .KKK, .GWS, .BTC | Bleeping Computer |
| Crysis | id}.{email address}.xtbl, crypt | ESET | |
| Princess Locker | Instructions | Hasherezade | |
| Lock Screen | Trend Micro | ||
| MacRansom | Instructions | Trend Micro | |
| AES_NI | Instructions | *.aes_ni, *.aes256, *.aes_ni_0day | Avast |
| BTCWare | Instructions | *.btcware, *.cryptobyte, *.cryptowin, *.theva | Avast |
| EncrypTile | Instructions | *.EncrypTile | Avast |
| LambdaLocker | Instructions | *.lambda_locked | Avast |
| Cute | |||
| my-Little-Ransomware | |||
| Nanolocker | |||
| TeslaCrack | Googulator | ||
| 7even-HONE$T | Python Script | {sequential number}.R4A or {sequential number}.R5A | hasherezade |
| Petya | Leo Stone | ||
| Crypren | |||
| Alma | Instructions | Adds 5 random characters at the end of each file and a unique 8 character victim ID | PhishLabs |
| Vindows | MalwareBytes | ||
| TeslaCrypt | Malwarebytes | ||
| KeRanger | Dr. Web | ||
| TM | Instructions | Trend Micro | |
| Vandev | Instructions | .xorist (or adds a random extension) | Trend Micro |
| XRatTeam | .xratteamLucked | Trend Micro | |
| XRatTeam | .xratteamLucked | Trend Micro | |
| FindZip | Instructions | *.crypt | Avast |
| Alpha | Instructions | *.encrypt | Bleeping Computer |
| BitKangaroo | Instructions | *.bitkangaroo | BleepingComputer |
| Crypt38 | Instructions | *.crypt38 | BleepingComputer |
| DCry | Instructions | *.dcry | BleepingComputer |
| Hidden Tear | Instructions | BleepingComputer | |
| MicroCop | Instructions | Adds Locked to the beginning of your encrypted files | BleepingComputer |
| Mole02 | Instructions | BleepingComputer | |
| Offline CryptoMix | Instructions | *.CRYPTOSHIELD, *.scl, *.rscl, *.lesli, *.rdmk, *.code, *.rmd | BleepingComputer |
| PowerLocky | Instructions | *.locky | BleepingComputer |
| StrikedDecrypter | Instructions | *[email protected],*[email protected], *[email protected], *[email protected], *[email protected], *[email protected], *[email protected] | BleepingComputer |
| AnDROid | Instructions | *.android | BleepingComputer |
| Anti-DDos | Instructions | *.f*cked | BleepingComputer |
| Crypt0 | Instructions | *_crypt0 | BleepingComputer |
| Crypto-Blocker | Instructions | *.corrupted | BleepingComputer |
| CryptoDevil | Instructions | *.devil | BleepingComputer |
| CryptoLocker by NTK | Instructions | *.powned | BleepingComputer |
| CryptoSomware | Instructions | *.FailedAccess | |
| DeriaLock | Instructions | *.deria | BleepingComputer |
| DoNotOpen | Instructions | *.killedXXX | BleepingComputer |
| EnkripsiPC | Instructions | *.bleeped | BleepingComputer |
| F*ckTheSystem | Instructions | *.anon | BleepingComputer |
| Harzhuangzi | Instructions | *.Harzhuangzi | BleepingComputer |
| Haters | Instructions | *.haters | BleepingComputer |
| Hitler | Instructions | *.Nazi | BleepingComputer |
| JeepersCrypt | Instructions | *.jeepers | BleepingComputer |
| Manifestus | Instructions | *.f*cked | BleepingComputer |
| Mikoyan | Instructions | *.MIKOYAN | BleepingComputer |
| NullByte | Instructions | *._nullbyte | BleepingComputer |
| SnakeEye | Instructions | *.SnakeEye | BleepingComputer |
| Xncrypt | Instructions | *.xncrypt | BleepingComputer |
| Zyka | Instructions | *.lock | BleepingComputer |
| Unlock92 | Instructions | *.CRRRT | BleepingComputer |
| Operation Global III | *.exe | Nathan Scott aka DecrypterFixer | |
| CryptoTorLocker | Bleeping Computer | ||
| Locker | Bleeping Computer | ||
| CryptoHost | Michael Gillespie | ||
| Manamecrypt | |||
| Pompous | EDA2 | ||
| Popcorn | Instructions | Elevenpaths | |
| PoshCoder | Palo Alto Networks | ||
| Shade | *.xtbl, *.ytbl, *.breaking_bad, *.heisenberg. | Intel | |
| Bitcryptor | Instructions | *.clf | Kaspersky |
| CoinVault | Instructions | .cvlst | Kaspersky |
| Bandarchor | N/A | [filename].id-[ID][email protected] (Decryption currently not possible) | |
| Black Shades | N/A | *.silent (Decryption currently not possible) | |
| Booyah | N/A | (Decryption currently not possible) | |
| CryLocker | N/A | *.cry (Decryption currently not possible) | |
| Crypt0l0cker | N/A | *.encrypted or *.enc (Decryption currently not possible) | |
| CryptoLocker | Discontinued | *.encrypted, *.cryptolocker (Decryption currently not possible) | FireEye & Fox-IT |
| Cryptowall | N/A | (Decryption currently not possible) | |
| CryPy | N/A | *.cry (Decryption currently not possible) | |
| Crysis | Instructions | .{id}.{email address}.xtbl, crypt | Trend Micro |
| CTB-Locker | |||
| DynA-Crypt | N/A | Decryptor Not Available | N/A |
| Hermes | N/A | Decryptor Not Available | N/A |
| Kirk | N/A | Decryptor Not Available | N/A |
| Lockdroid | N/A | Decryptor Not Available | N/A |
| LockLock | (Decryption Currently Not Possible) | Bleeping Computer | |
| MacAndCheese | N/A | .locked | N/A |
| MafiaWare | N/A | ".Locked-by-Mafia" (or ".Locked-Mafiaware") | N/A |
| Mahasaraswati | N/A | .id-[UNIQUE USER’S ID].{mahasaraswati(@)india.com}.xtbl | N/A |
| Maktub Locker | N/A | adds a random extension | N/A |
| Mamba | N/A | Encrypts hard drives not files | N/A |
| Matrix | N/A | .matrix | N/A |
| Mole | N/A | .mole | N/A |
| NoobCrypt |
| Decypt keys are ZdZ8EcvP95ki6NWR2j or lsakhBVLIKAHg | Jakub Kroustek |
| Osiris | N/A | N/A | N/A |
| SamSam | N/A | adds a random string of characters to end of file | N/A |
| Satan | N/A | Decryptor Not Available | N/A |
| Serpent | N/A | Decryptor Not Available | N/A |
| TeslaCrypt v1 | Instructions | {original file name}.ECC | Trend Micro |
| TeslaCrypt v2 | Instructions | {original file name}.VVV, CCC, ZZZ, AAA, ABC, XYZ | Trend Micro |
| Zepto | N/A | .zepto | |
| Zepto | N/A | .zepto |
Find the latest decryption tools, ransomware decryptors, and information on ransomware protection.
What is ransomware? It’s a malware (a Trojan or another type of virus) that locks your device or encrypts your files, and then tells you that you have to pay ransom to get your data back. It’s not cheap, and there’s no guarantee of success. If you become a victim of ransomware, try our free decryption tools and get your digital life back.
These tools can be complicated, so feel free to contact us with any questions you have and we’ll be happy to help.
Click on each tool to read more about it and get instructions on how to download and use.