Free Ransomware Decryptors Collection 2018

The Definitive Collection of Ransomware Decryption Tools on the Web

Ransomware attacks can be crippling if they happen to you. If you’re hit by ransomware, don’t just pay the ransom. Here is a list of steps you need to take:

  1. Download our ransomware response kit
  2. Utilize the free ransomware decrypter tools listed below
  3. Try to restore from a backup
  4. Protect yourself from future attacks with CryptoStopper™

WatchPoint has scoured the web and created the largest collection of ransomware decryptors and decryption tools available. These tools may help you to decrypt your files without having to pay the ransom. This list is updated regularly so if the decrypter or tool you need isn’t available check back in the future and it may be available.

Feel free to contact us if you have questions about these tools or have been subject to an attack and need help figuring out what to do next.

Decryptor DownloadRead MeEncrypted File ExtensionCreator/Contributor
DerialockInstructions  .deriaCheck Point
PHPInstructions  Check Point
BarRaxInstructions Check Point
PizzaCrypts  Bleeping Computer
ODCODC  Bleeping Computer
CryptorbitInstructionslocks files and creates HowDecrypt.txt and HowDecrypt.gifBleeping Computer
TorrentLocker  *.encrypted, *.encDecryptFixer
TeslaCryptInstructions  *.xxx, *.ttt, *.micro, *.mp3 ESET
VirlockInstructionsESET
ApocalypseInstructions*.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCryptedAVG
ApocalypseVMInstructions  *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCryptedAVG
MirCopInstructionsLock.{Original file name}AVG
Alcatraz LockerInstructions*.AlcatrazAvast
ApocalypseInstructions*.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCryptedAvast
ApocalypseVM  Instructions *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCryptedAvast
BadBlock64-bit Doesn't change file extension. Look for BadBlock in ransom noteAvast
BadBlock32-bitDoesn't change file extension. Look for BadBlock in ransom note 
BartInstructions *.bart.zipAvast
Crypt888InstructionsThis ransomware adds Lock. to the beginning of file namesAvast
CryptFile2 *.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rsclAvast
CryptoMixInstructions*.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rsclAvast
CryptoShieldInstructions  Avast
ZetaInstructions*.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rsclAvast
ZetaInstructions*.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rsclAvast
CrysisInstructions id}.{email address}.xtbl, cryptAvast
GlobeInstructions

*.ACRYPT, *.GSupport[0-9], *.blackblock, *.dll555, *.duhust, *.exploit, *.frozen, *.globe, *.gsupport,


*.kyra, *.purged, *.raid[0-9], *[email protected], *.xtbl, *.zendrz, *.zendr[0-9], *.hnyear

Avast
HiddenTearInstructions

*.locked, *.34xxx, *.bloccato, *.BUGSECCCC, *.Hollycrypt, *.lock, *.saeid, *.unlockit,


*.razy, *.mecpt, *.monstro, *.lok, *.암호화됨, *.8lock8, *.fucked, *.flyper, *.kratos, *.krypted, *.CAZZO, *.doomed.

Avast
JigsawInstructions .FUN, .KKK,  .GWS, .BTCAvast
LegionInstructions

[email protected]$.legion


or [email protected]$.cbfto the end of filename

Avast
NoobCryptInstructions Avast
StampadoInstructions*.lockedAvast
SZFLockerInstructions *.szfAvast
TeslaCryptInstructions Avast
Linux.Encoder.1  BitDefender
Linux.Encoder.3  BitDefender
AES_NIInstructions*.aes_ni, *.aes256, *.aes_ni_0dayKaspersky
Agent.iihInstructions Kaspersky
AuraInstructions  Kaspersky
AutoITInstructions {Original Filename}@<mail server>_.<random_set_of_characters>.Kaspersky
Bitman v.3Instructions  Kaspersky
Bitman v.4Instructions Kaspersky
CerberInstructions {10 random characters}.cerberKaspersky
ChimeraInstructions  {Original file name}.cryptKaspersky
CryptokluchenInstructions  Kaspersky
CrysisInstructions id}.{email address}.xtbl, cryptKaspersky
DemocryInstructions  *[email protected]$.777 OR *[email protected]$.legionKaspersky
Dharma  Kaspersky
DharmaInstructions

.wallet

Kaspersky
JaffInstructions*.JaffKaspersky
LamerInstructions  Kaspersky
LobzikInstructions .fun, .gws, .btc, .AFD, .porno, .pornoransom, .epic, .encrypted, .J, .payransom, .paybtcs, .paymds, .paymrss, .paymrts, .paymst, .paymts, .payrmsKaspersky
LortokInstructions  Kaspersky
PletorInstructions  Kaspersky
RakhniInstructions*.locked, *.krakenKaspersky
RotorInstructions  Kaspersky
TeslaCrypt v3Instructions {original file name}.XXX or TTT or MP3 or MICROKaspersky
TeslaCrypt v4Instructions File name and extension are unchangedKaspersky
XDataInstructions*.~xdata~Kaspersky
AutoLTInstructions Renames files "<original_name>@<mail server>_.<random_set_of_characters>"Kaspersky
CryaklInstructions Infected with Trojan-Ransom.Win32.Cryakl also tags end of file name with {CRYPTENDBLACKDC}Kaspersky
CrybolaInstructions Infected with Trojan-Ransom.Win32.CrybolaKaspersky
CryptXXX v.1-.v3InstructionsInfected with Trojan-Ransom.Win32.CryptXXXKaspersky
FuryInstructions Infected with  Trojan-Ransom.Win32.FuryKaspersky
MarsjokeInstructions  Kaspersky
PolyglotInstructions Infected with Trojan-Ransom.Win32.PolyglotKaspersky
RannohInstructions Renames files "locked-<original_name>.<four_random_letters>"Kaspersky
Shade *.xtbl, *.ytbl, *.breaking_bad, *.heisenberg.Kaspersky
Troldesh  Kaspersky
Wildfire *.wflxKaspersky
WannaCry WCRYInstructions*.WNCRY, *.WCRYTrend Micro
777Instructions{Original file name}.777Trend Micro
AutoLockyInstructions {Original file name}.lockyTrend Micro
Cerber .v1Instructions{10 random characters}.cerberTrend Micro
ChimeraInstructions {Original file name}.cryptTrend Micro
CryptXXX v.1-v.3Instructions{original file name}.crypt, cryp1, crypz, or 5 hexadecimal charactersTrend Micro
CryptXXX v.4-.v5Instructions {MD5 Hash}.5 hexadecimal charactersTrend Micro
DemoToolInstructions .demoadcTrend Micro
DXXD v.1Instructions {Original file name}.{Original extension}dxxdTrend Micro
Globe .v1Instructions

{Original file name}.purge

Trend Micro
Globe .v2Instructions

{Original file name}.{email address + random characters}

Trend Micro
Globe v.3Instructions Extension not fixed or file name encryptedTrend Micro
JigsawInstructions.FUN, .KKK,  .GWS, .BTCTrend Micro
LeChiffreInstructions {Original file name}.LeChiffreTrend Micro
MirCopInstructions Lock.{Original file name}Trend Micro
NemucodInstructions {Original file name}.cryptedTrend Micro
Purge v.1Instructions{Original file name}.purgeTrend Micro
Purge v.2Instructions{Original file name}.{email address + random characters}Trend Micro
Purge v.3Instructions{Original file name}.{email address + random characters}Trend Micro
SNSLockerInstructions {Original file name}.RSNSLockedTrend Micro
StampadoInstructions*.lockedTrend Micro
TeamxratInstructions {Original filename}.__xratteamLuckedTrend Micro
TeleCryptInstructions{Original file name}Trend Micro
TeslaCrypt v3Instructions{original file name}.XXX or TTT or MP3 or MICROTrend Micro
TeslaCrypt v4InstructionsFile name and extension are unchangedTrend Micro
XORBATInstructions {Original file name}.cryptedTrend Micro
XoristInstructions.xorist (or adds a random extension)Trend Micro
XpanInstructions{Original filename}.__xratteamLuckedTrend Micro
BadBlockInstructionsDoesn't change file extension. Look for BadBlock in ransom noteTrend Micro
Vandev .xorist (or adds a random extension)Kaspersky
Rector Infected with Trojan-Ransom.Win32.RectorKaspersky
Scatter Infected with Trojan-Ransom.BAT.ScatterKaspersky
Scraper Infected with Trojan-Ransom.Win32.ScraperKaspersky
Xorist .xorist (or adds a random extension)Kaspersky
Decrypt Protect    Emsisoft
BadBlockInstructions Doesn't change file extension. Look for BadBlock in ransom noteAVG
BartInstructions *.bart.zipAVG
Crypt888Instructions This ransomware adds Lock. to the beginning of file namesAVG
LegionInstructions 

Legion adds a variant of *[email protected]$.legion


or *[email protected]$.cbf to end of filename

AVG
SZFLockerInstructions *.szfAVG
TeslaCryptInstructions Decryptor for variant that doesn't rename filesAVG
Troldesh  Intel
TeslaCrypt *.xxx, *.ttt, *.micro, *.mp3 Intel
WildfireInstructions  *.wflxIntel
TeslaCrypt  Talos
CrysisInstructions*.xtbl, *.crysis, *.crypt, *.lock, *.crypted, *.dharma, *.wallet, *.onionESET
Jigsaw  .FUN, .KKK,  .GWS, .BTCCheck Point
KimcilWare  Fortinet
AmnesiaInstructions*.amnesia or [byd at india dot com].SON.Emsisoft
777Instructions*.777Emsisoft
Al-NamroodInstructions*.unavailable, *.disappearedEmisoft
Amnesia2Instructions*.amnesiaEmisoft
ApocalypseInstructions*.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCryptedEmsisoft
ApocalypseVMInstructions*.encrypted, *.lockedEmsisoft
AutoLockyInstructions*.lockyEmsisoft
BadBlockInstructionsDoesn't change file extension. Look for BadBlock in ransom noteEmsisoft
Cry9Instructions".<id>-juccy[a]protonmail.ch", ".id-<id>", ".id-<id>_[[email protected]].xj5v2", ".id-<id>_r9oj", ".id-<id>_x3m", ".id-<id>_[[email protected]]_[[email protected]].x3m", ".<id>", ".<id>-sofia_lobster[a]protonmail.ch" and ".<id>_[wqfhdgpdelcgww4g.onion.to].r2vy6"Emsisoft
Cry128Instructions*.fgb45ft3pqamyji7.onion.to._ or *.id__gebdp3k7bolalnd4.onion._' or *.id__2irbar3mjvbap6gt.onion.to._ or *.id-_[qg6m5wo7h3id55ym.onion.to].63vc4Emisoft
CrypBossInstructions*.crypt, *.R16M01D0Emsisoft
CryptInfiniteInstructions*.CRINFEmsisoft
CryptoDefenseInstructionsIdentifes as CryptoDefense leaves note HOW_DECRYPT.txtEmsisoft
CryptonInstructions".id-_locked", ".id-_locked_by_krec", ".id-_locked_by_perfect", ".id-_x3m", ".id-_r9oj", "[email protected]", "[email protected]_", "[email protected]_", "[email protected]_", "[email protected]_" and "[email protected]_"Emsisoft
DamageInstructions..damageEmsisoft
DMALocker2InstructionsDMALocker2 with ID “DMALOCK 43:41:90:35:25:13:61:92Emsisoft
DMALockerInstructions

DMALocker with ID “DMALOCK 41:55:16:13:51:76:67:99

Emsisoft
FabiansomwareInstructions

*.encrypted

Emsisoft
FenixLockerInstructions

*[email protected]!!

Emsisoft
Globe2Instructions

*.raid10, *.blt, *.globe, *.encrypted,*[[email protected]]

Emsisoft
Globe3Instructions*.decrypt2017, *.hnumkhotepEmsisoft
GlobeInstructions

*.purge, *.globe, *[email protected]!dsvgdfvdDVGR3SsdvfEF75sddf#xbkNY45fg6}P{cg.xtbl.

Emsisoft
GlobeImposterInstructions*.cryptEmsisoft
GomasomInstructions*.cryptEmsisoft
HarasomInstructions*.html and note from Spamhaus or US Department of JusticeEmsisoft
HydraCryptInstructions *.hyrdacrypt, *.umbrecryptEmsisoft
UmbreCryptInstructions *.hydracrypt, *.umbrecryptEmsisoft
KeyBTCInstructionsLeaves ransom note called Decrypt_Your_Files.txtEmsisoft
LeChiffreInstructions*.LeChiffreEmsisoft
MarlboroInstructions*.oopsEmsisoft
MRCR or Merry X-MasInstructions*.PEGS1, *.MRCR1, *.RARE1, *.MERRY, *.RMCM1Emsisoft
NemucodInstructions*.cryptedEmsisoft
NemucodAESInstructionsDoes not change file extensionEmisoft
NMoreiraInstructions*.maktub, *._AiraCropEncrypted!Emsisoft
OpenToYouInstructions*[email protected]Emsisoft
OzozaLockerInstructions*.lockedEmsisoft
PClockInstructionsDoesn't change extension look for enc_files.txtEmsisoft
PhiladelphiaInstructions*.lockedEmsisoft
RadamantInstructions*.rdm, *.rrkEmsisoft
StampadoInstructions*.lockedEmsisoft
XoristInstructions *.EnCiPhErEd, *.0JELvV, *.p5tkjw, *.6FKR8d, *.UslJ6m, *.n1wLp0, *.5vypSa, *.YNhlv1 Emsisoft
BitStakInstructions *.bitstakBleeping Computer
GhostCrypt  Bleeping Computer
8lock8Instructions .8block8Bleeping Computer
JigsawInstructions .FUN, .KKK,  .GWS, .BTCBleeping Computer
Crysis  id}.{email address}.xtbl, cryptESET
Princess LockerInstructions Hasherezade
Lock Screen  Trend Micro
MacRansomInstructionsTrend Micro
AES_NIInstructions*.aes_ni, *.aes256, *.aes_ni_0dayAvast
BTCWareInstructions*.btcware, *.cryptobyte, *.cryptowin, *.thevaAvast
EncrypTileInstructions*.EncrypTileAvast
LambdaLockerInstructions*.lambda_lockedAvast
Cute   
my-Little-Ransomware   
Nanolocker   
TeslaCrack  Googulator
7even-HONE$TPython Script{sequential number}.R4A or {sequential number}.R5Ahasherezade
Petya  Leo Stone
Crypren   
AlmaInstructionsAdds 5 random characters at the end of each file and a unique 8 character victim IDPhishLabs
Vindows  MalwareBytes
TeslaCrypt  Malwarebytes
KeRanger  Dr. Web
TM Instructions Trend Micro
VandevInstructions.xorist (or adds a random extension)Trend Micro
XRatTeam .xratteamLuckedTrend Micro
XRatTeam .xratteamLuckedTrend Micro
FindZipInstructions*.cryptAvast
AlphaInstructions*.encryptBleeping Computer
BitKangarooInstructions*.bitkangarooBleepingComputer
Crypt38Instructions*.crypt38BleepingComputer
DCryInstructions*.dcryBleepingComputer
Hidden TearInstructionsBleepingComputer
MicroCopInstructionsAdds Locked to the beginning of your encrypted filesBleepingComputer
Mole02InstructionsBleepingComputer
Offline CryptoMixInstructions*.CRYPTOSHIELD, *.scl, *.rscl, *.lesli, *.rdmk, *.code, *.rmdBleepingComputer
PowerLockyInstructions*.lockyBleepingComputer
StrikedDecrypterInstructions*[email protected],*[email protected], *[email protected], *[email protected], *[email protected], *[email protected], *[email protected]BleepingComputer
AnDROidInstructions*.androidBleepingComputer
Anti-DDosInstructions*.f*ckedBleepingComputer
Crypt0Instructions*_crypt0BleepingComputer
Crypto-BlockerInstructions*.corruptedBleepingComputer
CryptoDevilInstructions*.devilBleepingComputer
CryptoLocker by NTKInstructions*.pownedBleepingComputer
CryptoSomwareInstructions*.FailedAccess
DeriaLockInstructions*.deriaBleepingComputer
DoNotOpenInstructions*.killedXXXBleepingComputer
EnkripsiPCInstructions*.bleepedBleepingComputer
F*ckTheSystemInstructions*.anonBleepingComputer
HarzhuangziInstructions*.HarzhuangziBleepingComputer
HatersInstructions*.hatersBleepingComputer
HitlerInstructions*.NaziBleepingComputer
JeepersCryptInstructions*.jeepersBleepingComputer
ManifestusInstructions*.f*ckedBleepingComputer
MikoyanInstructions*.MIKOYANBleepingComputer
NullByteInstructions*._nullbyteBleepingComputer
SnakeEyeInstructions*.SnakeEyeBleepingComputer
XncryptInstructions*.xncryptBleepingComputer
ZykaInstructions*.lockBleepingComputer
Unlock92Instructions*.CRRRTBleepingComputer
Operation Global III  *.exeNathan Scott aka DecrypterFixer
CryptoTorLocker  Bleeping Computer
Locker  Bleeping Computer
CryptoHost  Michael Gillespie
Manamecrypt   
Pompous  EDA2
PopcornInstructions Elevenpaths
PoshCoder  Palo Alto Networks
Shade *.xtbl, *.ytbl, *.breaking_bad, *.heisenberg.Intel
BitcryptorInstructions *.clfKaspersky
CoinVaultInstructions  .cvlstKaspersky
BandarchorN/A[filename].id-[ID][email protected] (Decryption currently not possible) 
Black ShadesN/A*.silent (Decryption currently not possible) 
BooyahN/A(Decryption currently not possible) 
CryLockerN/A*.cry (Decryption currently not possible) 
Crypt0l0ckerN/A*.encrypted or *.enc (Decryption currently not possible) 
CryptoLockerDiscontinued*.encrypted, *.cryptolocker (Decryption currently not possible)FireEye & Fox-IT
CryptowallN/A(Decryption currently not possible) 
CryPyN/A*.cry (Decryption currently not possible) 
CrysisInstructions.{id}.{email address}.xtbl, cryptTrend Micro
CTB-Locker   
DynA-CryptN/A

Decryptor Not Available

N/A
HermesN/A

Decryptor Not Available

N/A
KirkN/ADecryptor Not AvailableN/A
LockdroidN/ADecryptor Not AvailableN/A
LockLock (Decryption Currently Not Possible)Bleeping Computer
MacAndCheeseN/A.lockedN/A
MafiaWareN/A".Locked-by-Mafia" (or ".Locked-Mafiaware")N/A
MahasaraswatiN/A.id-[UNIQUE USER’S ID].{mahasaraswati(@)india.com}.xtblN/A
Maktub LockerN/Aadds a random extensionN/A
MambaN/AEncrypts hard drives not filesN/A
MatrixN/A.matrixN/A
MoleN/A.moleN/A
NoobCrypt

 

 Decypt keys are ZdZ8EcvP95ki6NWR2j or lsakhBVLIKAHgJakub Kroustek
OsirisN/AN/AN/A
SamSamN/Aadds a random string of characters to end of fileN/A
SatanN/ADecryptor Not AvailableN/A
SerpentN/ADecryptor Not AvailableN/A
TeslaCrypt v1Instructions {original file name}.ECCTrend Micro
TeslaCrypt v2Instructions{original file name}.VVV, CCC, ZZZ, AAA, ABC, XYZTrend Micro
ZeptoN/A.zepto 
ZeptoN/A.zepto 

Find the latest decryption tools, ransomware decryptors, and information on ransomware protection.

What is ransomware? It’s a malware (a Trojan or another type of virus) that locks your device or encrypts your files, and then tells you that you have to pay ransom to get your data back. It’s not cheap, and there’s no guarantee of success. If you become a victim of ransomware, try our free decryption tools and get your digital life back.

These tools can be complicated, so feel free to contact us with any questions you have and we’ll be happy to help.

Click on each tool to read more about it and get instructions on how to download and use.

Menu