The Definitive Collection of Ransomware Decryption Tools on the Web
Ransomware attacks can be crippling if they happen to you. If you’re hit by ransomware, don’t just pay the ransom. Here is a list of steps you need to take:
- Download our ransomware response kit
- Utilize the free ransomware decryption tools listed below
- Try to restore from a backup
- Protect yourself from future attacks with CryptoStopper™
WatchPoint has scoured the web and created the largest collection of ransomware decryptors and decryption tools available. These tools may help you to decrypt your files without having to pay the ransom. This list is updated regularly so if the decrypter or tool you need isn’t available check back in the future and it may be available.
Feel free to contact us if you have questions about these tools or have been subject to an attack and need help figuring out what to do next.
| Decryptor Download | Read Me | Encrypted File Extension | Creator/Contributor |
|---|---|---|---|
| 777 | Instructions | *.777 | Emsisoft |
| 777 | Instructions | {Original file name}.777 | Trend Micro |
| 7even-HONE$T | Python Script | {sequential number}.R4A or {sequential number}.R5A | hasherezade |
| 8lock8 | Instructions | .8block8 | Bleeping Computer |
| Agent.iih | Instructions | Kaspersky | |
| Alcatraz Locker | Instructions | *.Alcatraz | Avast |
| Alfa | N/A | *.bin (Decryption currently not possible) | |
| Alma | Instructions | Adds 5 random characters at the end of each file and a unique 8 character victim ID | PhishLabs |
| Al-Namrood | Instructions | *.unavailable, *.disappeared | Emisoft |
| Alpha | N/A | *.bin (Decryption currently not possible) | |
| AlphaLocker | Instructions | *.encrypt | Bleeping Computer |
| Amnesia | Instructions | *.amnesia or [byd at india dot com].SON. | Emsisoft |
| Apocalypse | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | Emsisoft |
| Apocalypse | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | AVG |
| Apocalypse | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | Avast |
| ApocalypseVM | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | Avast |
| ApocalypseVM | Instructions | *.encrypted, *.locked | Emsisoft |
| ApocalypseVM | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | AVG |
| Aura | Instructions | Kaspersky | |
| AutoIT | Instructions | {Original Filename}@<mail server>_.<random_set_of_characters>. | Kaspersky |
| AutoLocky | Instructions | *.locky | Emsisoft |
| AutoLocky | Instructions | {Original file name}.locky | Trend Micro |
| AutoLT | Instructions | Renames files "<original_name>@<mail server>_.<random_set_of_characters>" | Kaspersky |
| BadBlock | Instructions | Doesn't change file extension. Look for BadBlock in ransom note | AVG |
| BadBlock | Instructions | Doesn't change file extension. Look for BadBlock in ransom note | Emsisoft |
| BadBlock | Instructions | Doesn't change file extension. Look for BadBlock in ransom note | Trend Micro |
| BadBlock | 32-bit | Doesn't change file extension. Look for BadBlock in ransom note | |
| BadBlock | 64-bit | Doesn't change file extension. Look for BadBlock in ransom note | Avast |
| Bandarchor | N/A | [filename].id-[ID]_fud@india.com (Decryption currently not possible) | |
| BarRax | Instructions | Check Point | |
| Bart | Instructions | *.bart.zip | AVG |
| Bart | Instructions | *.bart.zip | Avast |
| Bitcryptor | Instructions | *.clf | Kaspersky |
| Bitman v.3 | Instructions | Kaspersky | |
| Bitman v.4 | Instructions | Kaspersky | |
| BitStak | Instructions | *.bitstak | Bleeping Computer |
| Black Shades | N/A | *.silent (Decryption currently not possible) | |
| Booyah | N/A | (Decryption currently not possible) | |
| Cerber .v1 | Instructions | {10 random characters}.cerber | Trend Micro |
| Cerber | Instructions | {10 random characters}.cerber | Kaspersky |
| Chimera | Instructions | {Original file name}.crypt | Trend Micro |
| Chimera | Instructions | {Original file name}.crypt | Kaspersky |
| CoinVault | Instructions | .cvlst | Kaspersky |
| Cry9 | Instructions | ".<id>-juccy[a]protonmail.ch", ".id-<id>", ".id-<id>_[nemesis_decryptor@aol.com].xj5v2", ".id-<id>_r9oj", ".id-<id>_x3m", ".id-<id>_[x3m-pro@protonmail.com]_[x3m@usa.com].x3m", ".<id>", ".<id>-sofia_lobster[a]protonmail.ch" and ".<id>_[wqfhdgpdelcgww4g.onion.to].r2vy6" | Emsisoft |
| Cryakl | Instructions | Infected with Trojan-Ransom.Win32.Cryakl also tags end of file name with {CRYPTENDBLACKDC} | Kaspersky |
| Crybola | Instructions | Infected with Trojan-Ransom.Win32.Crybola | Kaspersky |
| CrypBoss | Instructions | *.crypt, *.R16M01D0 | Emsisoft |
| CryLocker | N/A | *.cry (Decryption currently not possible) | |
| Crypren | |||
| Crypt38 | |||
| Crypt888 | Instructions | This ransomware adds Lock. to the beginning of file names | AVG |
| Crypt888 | Instructions | This ransomware adds Lock. to the beginning of file names | Avast |
| CryptoHost | Michael Gillespie | ||
| Crysis | Instructions | .{id}.{email address}.xtbl, crypt | Trend Micro |
| Crysis | Instructions | id}.{email address}.xtbl, crypt | Kaspersky |
| Crysis | id}.{email address}.xtbl, crypt | ESET | |
| Crysis | Instructions | id}.{email address}.xtbl, crypt | Avast |
| CryptFile2 | *.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rscl | Avast | |
| CryptInfinite | Instructions | *.CRINF | Emsisoft |
| Crypt0l0cker | N/A | *.encrypted or *.enc (Decryption currently not possible) | |
| CryptoDefense | Instructions | Identifes as CryptoDefense leaves note HOW_DECRYPT.txt | Emsisoft |
| Cryptokluchen | Instructions | Kaspersky | |
| CryptoLocker | Discontinued | *.encrypted, *.cryptolocker (Decryption currently not possible) | FireEye & Fox-IT |
| CryptoMix | Instructions | *.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rscl | Avast |
| Crypton | Instructions | ".id-_locked", ".id-_locked_by_krec", ".id-_locked_by_perfect", ".id-_x3m", ".id-_r9oj", ".id-_garryweber@protonmail.ch", ".id-_steaveiwalker@india.com_", ".id-_julia.crown@india.com_", ".id-_tom.cruz@india.com_", ".id-_CarlosBoltehero@india.com_" and ".id-_maria.lopez1@india.com_" | Emsisoft |
| Cryptorbit | Instructions | locks files and creates HowDecrypt.txt and HowDecrypt.gif | Bleeping Computer |
| CryptoTorLocker | Bleeping Computer | ||
| CryptoShield | Instructions | Avast | |
| Cryptowall | N/A | (Decryption currently not possible) | |
| CryptXXX v.1-v.3 | Instructions | {original file name}.crypt, cryp1, crypz, or 5 hexadecimal characters | Trend Micro |
| CryptXXX v.1-.v3 | Instructions | Infected with Trojan-Ransom.Win32.CryptXXX | Kaspersky |
| CryptXXX v.4-.v5 | Instructions | {MD5 Hash}.5 hexadecimal characters | Trend Micro |
| CryPy | N/A | *.cry (Decryption currently not possible) | |
| CTB-Locker | |||
| Cute | |||
| Damage | Instructions | ..damage | Emsisoft |
| Decrypt Protect | Emsisoft | ||
| Derialock | Instructions | .deria | Check Point |
| Dharma | Instructions | .wallet | Kaspersky |
| DMALocker | Instructions | DMALocker with ID “DMALOCK 41:55:16:13:51:76:67:99 | Emsisoft |
| DMALocker2 | Instructions | DMALocker2 with ID “DMALOCK 43:41:90:35:25:13:61:92 | Emsisoft |
| Democry | Instructions | *._date-time_$address@domain$.777 OR *._date-time_$address@domain$.legion | Kaspersky |
| DemoTool | Instructions | .demoadc | Trend Micro |
| Dharma | Kaspersky | ||
| DXXD v.1 | Instructions | {Original file name}.{Original extension}dxxd | Trend Micro |
| DynA-Crypt | N/A | Decryptor Not Available | N/A |
| Fabiansomware | Instructions | *.encrypted | Emsisoft |
| FenixLocker | Instructions | *.centrumfr@india.com!! | Emsisoft |
| FindZip | Instructions | *.crypt | Avast |
| Fury | Instructions | Infected with Trojan-Ransom.Win32.Fury | Kaspersky |
| GhostCrypt | Bleeping Computer | ||
| Globe .v1 | Instructions | {Original file name}.purge | Trend Micro |
| Globe | Instructions | *.ACRYPT, *.GSupport[0-9], *.blackblock, *.dll555, *.duhust, *.exploit, *.frozen, *.globe, *.gsupport, *.kyra, *.purged, *.raid[0-9], *.siri-down@india.com, *.xtbl, *.zendrz, *.zendr[0-9], *.hnyear | Avast |
| Globe | Instructions | *.purge, *.globe, *.okean-1955@india.com.!dsvgdfvdDVGR3SsdvfEF75sddf#xbkNY45fg6}P{cg.xtbl. | Emsisoft |
| Globe2 | Instructions | *.raid10, *.blt, *.globe, *.encrypted,*[mia.kokers@aol.com] | Emsisoft |
| Globe .v2 | Instructions | {Original file name}.{email address + random characters} | Trend Micro |
| Globe3 | Instructions | *.decrypt2017, *.hnumkhotep | Emsisoft |
| Globe v.3 | Instructions | Extension not fixed or file name encrypted | Trend Micro |
| GlobeImposter | Instructions | *.crypt | Emsisoft |
| Gomasom | Instructions | *.crypt | Emsisoft |
| Harasom | Instructions | *.html and note from Spamhaus or US Department of Justice | Emsisoft |
| Hermes | N/A | Decryptor Not Available | N/A |
| HiddenTear | Instructions | *.locked, *.34xxx, *.bloccato, *.BUGSECCCC, *.Hollycrypt, *.lock, *.saeid, *.unlockit, *.razy, *.mecpt, *.monstro, *.lok, *.암호화됨, *.8lock8, *.fucked, *.flyper, *.kratos, *.krypted, *.CAZZO, *.doomed. | Avast |
| HydraCrypt | Instructions | *.hyrdacrypt, *.umbrecrypt | Emsisoft |
| Jigsaw | Instructions | .FUN, .KKK, .GWS, .BTC | Trend Micro |
| Jigsaw | .FUN, .KKK, .GWS, .BTC | Check Point | |
| Jigsaw | Instructions | .FUN, .KKK, .GWS, .BTC | Avast |
| Jigsaw | Instructions | .FUN, .KKK, .GWS, .BTC | Bleeping Computer |
| KeRanger | Dr. Web | ||
| KeyBTC | Instructions | Leaves ransom note called Decrypt_Your_Files.txt | Emsisoft |
| KimcilWare | Fortinet | ||
| Kirk | N/A | Decryptor Not Available | N/A |
| Lamer | Instructions | Kaspersky | |
| LeChiffre | Instructions | *.LeChiffre | Emsisoft |
| LeChiffre | Instructions | {Original file name}.LeChiffre | Trend Micro |
| Legion | Instructions | Legion adds a variant of *._23-06-2016-20-27-23_$f_tactics@aol.com$.legion or *.$centurion_legion@aol.com$.cbf to end of filename | AVG |
| Legion | Instructions | ._23-06-2016-20-27-23_$f_tactics@aol.com$.legion or .$centurion_legion@aol.com$.cbfto the end of filename | Avast |
| Linux.Encoder.1 | BitDefender | ||
| Linux.Encoder.3 | BitDefender | ||
| Lobzik | Instructions | .fun, .gws, .btc, .AFD, .porno, .pornoransom, .epic, .encrypted, .J, .payransom, .paybtcs, .paymds, .paymrss, .paymrts, .paymst, .paymts, .payrms | Kaspersky |
| Lockdroid | N/A | Decryptor Not Available | N/A |
| LockLock | (Decryption Currently Not Possible) | Bleeping Computer | |
| Locker | Bleeping Computer | ||
| Lock Screen | Trend Micro | ||
| Lortok | Instructions | Kaspersky | |
| MacAndCheese | N/A | .locked | N/A |
| MafiaWare | N/A | ".Locked-by-Mafia" (or ".Locked-Mafiaware") | N/A |
| Mahasaraswati | N/A | .id-[UNIQUE USER’S ID].{mahasaraswati(@)india.com}.xtbl | N/A |
| Maktub Locker | N/A | adds a random extension | N/A |
| Mamba | N/A | Encrypts hard drives not files | N/A |
| Manamecrypt | |||
| Marlboro | Instructions | *.oops | Emsisoft |
| Marsjoke | Instructions | Kaspersky | |
| Matrix | N/A | .matrix | N/A |
| MirCop | Instructions | Lock.{Original file name} | AVG |
| MirCop | Instructions | Lock.{Original file name} | Trend Micro |
| Mole | N/A | .mole | N/A |
| MRCR or Merry X-Mas | Instructions | *.PEGS1, *.MRCR1, *.RARE1, *.MERRY, *.RMCM1 | Emsisoft |
| my-Little-Ransomware | |||
| Nanolocker | |||
| Nemucod | Instructions | *.crypted | Emsisoft |
| Nemucod | Instructions | {Original file name}.crypted | Trend Micro |
| NMoreira | Instructions | *.maktub, *._AiraCropEncrypted! | Emsisoft |
| NoobCrypt |
| Decypt keys are ZdZ8EcvP95ki6NWR2j or lsakhBVLIKAHg | Jakub Kroustek |
| NoobCrypt | Instructions | Avast | |
| ODCODC | Bleeping Computer | ||
| OpenToYou | Instructions | *.-opentoyou@india.com | Emsisoft |
| Operation Global III | *.exe | Nathan Scott aka DecrypterFixer | |
| Osiris | N/A | N/A | N/A |
| OzozaLocker | Instructions | *.locked | Emsisoft |
| PClock | Instructions | Doesn't change extension look for enc_files.txt | Emsisoft |
| Petya | Leo Stone | ||
| Philadelphia | Instructions | *.locked | Emsisoft |
| PHP | Instructions | Check Point | |
| PizzaCrypts | Bleeping Computer | ||
| Pletor | Instructions | Kaspersky | |
| Polyglot | Instructions | Infected with Trojan-Ransom.Win32.Polyglot | Kaspersky |
| Pompous | EDA2 | ||
| Popcorn | Instructions | Elevenpaths | |
| PoshCoder | Palo Alto Networks | ||
| Princess Locker | Instructions | Hasherezade | |
| Purge v.1 | Instructions | {Original file name}.purge | Trend Micro |
| Purge v.2 | Instructions | {Original file name}.{email address + random characters} | Trend Micro |
| Purge v.3 | Instructions | {Original file name}.{email address + random characters} | Trend Micro |
| Radamant | Instructions | *.rdm, *.rrk | Emsisoft |
| Rakhni | Instructions | *.locked, *.kraken | Kaspersky |
| Rannoh | Instructions | Renames files "locked-<original_name>.<four_random_letters>" | Kaspersky |
| Rector | Infected with Trojan-Ransom.Win32.Rector | Kaspersky | |
| Rotor | Instructions | Kaspersky | |
| SamSam | N/A | adds a random string of characters to end of file | N/A |
| Satan | N/A | Decryptor Not Available | N/A |
| Scatter | Infected with Trojan-Ransom.BAT.Scatter | Kaspersky | |
| Scraper | Infected with Trojan-Ransom.Win32.Scraper | Kaspersky | |
| Serpent | N/A | Decryptor Not Available | N/A |
| Shade | *.xtbl, *.ytbl, *.breaking_bad, *.heisenberg. | Intel | |
| Shade | *.xtbl, *.ytbl, *.breaking_bad, *.heisenberg. | Kaspersky | |
| SNSLocker | Instructions | {Original file name}.RSNSLocked | Trend Micro |
| Stampado | Instructions | *.locked | Emsisoft |
| Stampado | Instructions | *.locked | Trend Micro |
| Stampado | Instructions | *.locked | Avast |
| SZFLocker | Instructions | *.szf | AVG |
| SZFLocker | Instructions | *.szf | Avast |
| Teamxrat | Instructions | {Original filename}.__xratteamLucked | Trend Micro |
| TeleCrypt | Instructions | {Original file name} | Trend Micro |
| TeslaCrack | Googulator | ||
| TeslaCrypt | Instructions | Decryptor for variant that doesn't rename files | AVG |
| TeslaCrypt | *.xxx, *.ttt, *.micro, *.mp3 | ESET | |
| TeslaCrypt v1 | Instructions | {original file name}.ECC | Trend Micro |
| TeslaCrypt v2 | Instructions | {original file name}.VVV, CCC, ZZZ, AAA, ABC, XYZ | Trend Micro |
| TeslaCrypt v3 | Instructions | {original file name}.XXX or TTT or MP3 or MICRO | Trend Micro |
| TeslaCrypt v3 | Instructions | {original file name}.XXX or TTT or MP3 or MICRO | Kaspersky |
| TeslaCrypt v4 | Instructions | File name and extension are unchanged | Trend Micro |
| TeslaCrypt v4 | Instructions | File name and extension are unchanged | Kaspersky |
| TeslaCrypt | *.xxx, *.ttt, *.micro, *.mp3 | Intel | |
| TeslaCrypt | Malwarebytes | ||
| TeslaCrypt | Talos | ||
| TeslaCrypt | Instructions | Avast | |
| TM | Instructions | Trend Micro | |
| TorrentLocker | *.encrypted, *.enc | DecryptFixer | |
| Troldesh | Kaspersky | ||
| Troldesh | Intel | ||
| UmbreCrypt | Instructions | *.hydracrypt, *.umbrecrypt | Emsisoft |
| Vandev | .xorist (or adds a random extension) | Kaspersky | |
| Vandev | Instructions | .xorist (or adds a random extension) | Trend Micro |
| Vindows | MalwareBytes | ||
| Wildfire | *.wflx | Kaspersky | |
| Wildfire | Instructions | *.wflx | Intel |
| XORBAT | Instructions | {Original file name}.crypted | Trend Micro |
| Xorist | Instructions | *.EnCiPhErEd, *.0JELvV, *.p5tkjw, *.6FKR8d, *.UslJ6m, *.n1wLp0, *.5vypSa, *.YNhlv1 | Emsisoft |
| Xorist | .xorist (or adds a random extension) | Kaspersky | |
| Xorist | Instructions | .xorist (or adds a random extension) | Trend Micro |
| Xpan | Instructions | {Original filename}.__xratteamLucked | Trend Micro |
| XRatTeam | .xratteamLucked | Trend Micro | |
| Zepto | N/A | .zepto | |
| Zeta | Instructions | *.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rscl | Avast |
Find the latest decryption tools, ransomware decryptors, and information on ransomware protection.
What is ransomware? It’s a malware (a Trojan or another type of virus) that locks your device or encrypts your files, and then tells you that you have to pay ransom to get your data back. It’s not cheap, and there’s no guarantee of success. If you become a victim of ransomware, try our free decryption tools and get your digital life back.
These tools can be complicated, so feel free to contact us with any questions you have and we’ll be happy to help.
Click on each tool to read more about it and get instructions on how to download and use.