The Definitive Collection of Ransomware Decryptors on the Web
WatchPoint has scoured the web and created the largest collection of ransomware decryptors available. This list is updated regularly so if the decryptor you need isn’t available check back in the future and it may be available.
| Decryptor Download | Read Me | Encrypted File Extension | Creator/Contributor |
|---|---|---|---|
| 777 | Instructions | *.777 | Emsisoft |
| 777 | Instructions | {Original file name}.777 | Trend Micro |
| 7even-HONE$T | Python Script | {sequential number}.R4A or {sequential number}.R5A | hasherezade |
| 8lock8 | Instructions | .8block8 | Bleeping Computer |
| Agent.iih | Instructions | Kaspersky | |
| Alcatraz Locker | Instructions | *.Alcatraz | Avast |
| Alfa | N/A | *.bin (Decryption currently not possible) | |
| Alma | Instructions | Adds 5 random characters at the end of each file and a unique 8 character victim ID | PhishLabs |
| Al-Namrood | Instructions | *.unavailable, *.disappeared | Emisoft |
| Alpha | N/A | *.bin (Decryption currently not possible) | |
| AlphaLocker | Instructions | *.encrypt | Bleeping Computer |
| Amnesia | Instructions | *.amnesia or [byd at india dot com].SON. | Emsisoft |
| Apocalypse | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | Emsisoft |
| Apocalypse | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | AVG |
| Apocalypse | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | Avast |
| ApocalypseVM | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | Avast |
| ApocalypseVM | Instructions | *.encrypted, *.locked | Emsisoft |
| ApocalypseVM | Instructions | *.encrypted, *.FuckYourData, *.Encryptedfile, *.SecureCrypted | AVG |
| Aura | Instructions | Kaspersky | |
| AutoIT | Instructions | {Original Filename}@<mail server>_.<random_set_of_characters>. | Kaspersky |
| AutoLocky | Instructions | *.locky | Emsisoft |
| AutoLocky | Instructions | {Original file name}.locky | Trend Micro |
| AutoLT | Instructions | Renames files "<original_name>@<mail server>_.<random_set_of_characters>" | Kaspersky |
| BadBlock | Instructions | Doesn't change file extension. Look for BadBlock in ransom note | AVG |
| BadBlock | Instructions | Doesn't change file extension. Look for BadBlock in ransom note | Emsisoft |
| BadBlock | Instructions | Doesn't change file extension. Look for BadBlock in ransom note | Trend Micro |
| BadBlock | 32-bit | Doesn't change file extension. Look for BadBlock in ransom note | |
| BadBlock | 64-bit | Doesn't change file extension. Look for BadBlock in ransom note | Avast |
| Bandarchor | N/A | [filename].id-[ID][email protected] (Decryption currently not possible) | |
| BarRax | Instructions | Check Point | |
| Bart | Instructions | *.bart.zip | AVG |
| Bart | Instructions | *.bart.zip | Avast |
| Bitcryptor | Instructions | *.clf | Kaspersky |
| Bitman v.3 | Instructions | Kaspersky | |
| Bitman v.4 | Instructions | Kaspersky | |
| BitStak | Instructions | *.bitstak | Bleeping Computer |
| Black Shades | N/A | *.silent (Decryption currently not possible) | |
| Booyah | N/A | (Decryption currently not possible) | |
| Cerber .v1 | Instructions | {10 random characters}.cerber | Trend Micro |
| Cerber | Instructions | {10 random characters}.cerber | Kaspersky |
| Chimera | Instructions | {Original file name}.crypt | Trend Micro |
| Chimera | Instructions | {Original file name}.crypt | Kaspersky |
| CoinVault | Instructions | .cvlst | Kaspersky |
| Cry9 | Instructions | ".<id>-juccy[a]protonmail.ch", ".id-<id>", ".id-<id>_[[email protected]].xj5v2", ".id-<id>_r9oj", ".id-<id>_x3m", ".id-<id>_[[email protected]]_[[email protected]].x3m", ".<id>", ".<id>-sofia_lobster[a]protonmail.ch" and ".<id>_[wqfhdgpdelcgww4g.onion.to].r2vy6" | Emsisoft |
| Cryakl | Instructions | Infected with Trojan-Ransom.Win32.Cryakl also tags end of file name with {CRYPTENDBLACKDC} | Kaspersky |
| Crybola | Instructions | Infected with Trojan-Ransom.Win32.Crybola | Kaspersky |
| CrypBoss | Instructions | *.crypt, *.R16M01D0 | Emsisoft |
| CryLocker | N/A | *.cry (Decryption currently not possible) | |
| Crypren | |||
| Crypt38 | |||
| Crypt888 | Instructions | This ransomware adds Lock. to the beginning of file names | AVG |
| Crypt888 | Instructions | This ransomware adds Lock. to the beginning of file names | Avast |
| CryptoHost | Michael Gillespie | ||
| Crysis | Instructions | .{id}.{email address}.xtbl, crypt | Trend Micro |
| Crysis | Instructions | id}.{email address}.xtbl, crypt | Kaspersky |
| Crysis | id}.{email address}.xtbl, crypt | ESET | |
| Crysis | Instructions | id}.{email address}.xtbl, crypt | Avast |
| CryptFile2 | *.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rscl | Avast | |
| CryptInfinite | Instructions | *.CRINF | Emsisoft |
| Crypt0l0cker | N/A | *.encrypted or *.enc (Decryption currently not possible) | |
| CryptoDefense | Instructions | Identifes as CryptoDefense leaves note HOW_DECRYPT.txt | Emsisoft |
| Cryptokluchen | Instructions | Kaspersky | |
| CryptoLocker | Discontinued | *.encrypted, *.cryptolocker (Decryption currently not possible) | FireEye & Fox-IT |
| CryptoMix | Instructions | *.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rscl | Avast |
| Crypton | Instructions | ".id-_locked", ".id-_locked_by_krec", ".id-_locked_by_perfect", ".id-_x3m", ".id-_r9oj", ".[email protected]", ".[email protected]_", ".[email protected]_", ".[email protected]_", ".[email protected]_" and ".[email protected]_" | Emsisoft |
| Cryptorbit | Instructions | locks files and creates HowDecrypt.txt and HowDecrypt.gif | Bleeping Computer |
| CryptoTorLocker | Bleeping Computer | ||
| CryptoShield | Instructions | Avast | |
| Cryptowall | N/A | (Decryption currently not possible) | |
| CryptXXX v.1-v.3 | Instructions | {original file name}.crypt, cryp1, crypz, or 5 hexadecimal characters | Trend Micro |
| CryptXXX v.1-.v3 | Instructions | Infected with Trojan-Ransom.Win32.CryptXXX | Kaspersky |
| CryptXXX v.4-.v5 | Instructions | {MD5 Hash}.5 hexadecimal characters | Trend Micro |
| CryPy | N/A | *.cry (Decryption currently not possible) | |
| CTB-Locker | |||
| Cute | |||
| Damage | Instructions | ..damage | Emsisoft |
| Decrypt Protect | Emsisoft | ||
| Derialock | Instructions | .deria | Check Point |
| Dharma | Instructions | .wallet | Kaspersky |
| DMALocker | Instructions | DMALocker with ID “DMALOCK 41:55:16:13:51:76:67:99 | Emsisoft |
| DMALocker2 | Instructions | DMALocker2 with ID “DMALOCK 43:41:90:35:25:13:61:92 | Emsisoft |
| Democry | Instructions | [email protected]$.777 OR [email protected]$.legion | Kaspersky |
| DemoTool | Instructions | .demoadc | Trend Micro |
| Dharma | Kaspersky | ||
| DXXD v.1 | Instructions | {Original file name}.{Original extension}dxxd | Trend Micro |
| DynA-Crypt | N/A | Decryptor Not Available | N/A |
| Fabiansomware | Instructions | *.encrypted | Emsisoft |
| FenixLocker | Instructions | Emsisoft | |
| FindZip | Instructions | *.crypt | Avast |
| Fury | Instructions | Infected with Trojan-Ransom.Win32.Fury | Kaspersky |
| GhostCrypt | Bleeping Computer | ||
| Globe .v1 | Instructions | {Original file name}.purge | Trend Micro |
| Globe | Instructions | *.ACRYPT, *.GSupport[0-9], *.blackblock, *.dll555, *.duhust, *.exploit, *.frozen, *.globe, *.gsupport, *.kyra, *.purged, *.raid[0-9], [email protected], *.xtbl, *.zendrz, *.zendr[0-9], *.hnyear | Avast |
| Globe | Instructions | *.purge, *.globe, [email protected]!dsvgdfvdDVGR3SsdvfEF75sddf#xbkNY45fg6}P{cg.xtbl. | Emsisoft |
| Globe2 | Instructions | *.raid10, *.blt, *.globe, *.encrypted,*[[email protected]] | Emsisoft |
| Globe .v2 | Instructions | {Original file name}.{email address + random characters} | Trend Micro |
| Globe3 | Instructions | *.decrypt2017, *.hnumkhotep | Emsisoft |
| Globe v.3 | Instructions | Extension not fixed or file name encrypted | Trend Micro |
| GlobeImposter | Instructions | *.crypt | Emsisoft |
| Gomasom | Instructions | *.crypt | Emsisoft |
| Harasom | Instructions | *.html and note from Spamhaus or US Department of Justice | Emsisoft |
| Hermes | N/A | Decryptor Not Available | N/A |
| HiddenTear | Instructions | *.locked, *.34xxx, *.bloccato, *.BUGSECCCC, *.Hollycrypt, *.lock, *.saeid, *.unlockit, *.razy, *.mecpt, *.monstro, *.lok, *.암호화됨, *.8lock8, *.fucked, *.flyper, *.kratos, *.krypted, *.CAZZO, *.doomed. | Avast |
| HydraCrypt | Instructions | *.hyrdacrypt, *.umbrecrypt | Emsisoft |
| Jigsaw | Instructions | .FUN, .KKK, .GWS, .BTC | Trend Micro |
| Jigsaw | .FUN, .KKK, .GWS, .BTC | Check Point | |
| Jigsaw | Instructions | .FUN, .KKK, .GWS, .BTC | Avast |
| Jigsaw | Instructions | .FUN, .KKK, .GWS, .BTC | Bleeping Computer |
| KeRanger | Dr. Web | ||
| KeyBTC | Instructions | Leaves ransom note called Decrypt_Your_Files.txt | Emsisoft |
| KimcilWare | Fortinet | ||
| Kirk | N/A | Decryptor Not Available | N/A |
| Lamer | Instructions | Kaspersky | |
| LeChiffre | Instructions | *.LeChiffre | Emsisoft |
| LeChiffre | Instructions | {Original file name}.LeChiffre | Trend Micro |
| Legion | Instructions | Legion adds a variant of [email protected]$.legion or [email protected]$.cbf to end of filename | AVG |
| Legion | Instructions | .[email protected]$.legion or .[email protected]$.cbfto the end of filename | Avast |
| Linux.Encoder.1 | BitDefender | ||
| Linux.Encoder.3 | BitDefender | ||
| Lobzik | Instructions | .fun, .gws, .btc, .AFD, .porno, .pornoransom, .epic, .encrypted, .J, .payransom, .paybtcs, .paymds, .paymrss, .paymrts, .paymst, .paymts, .payrms | Kaspersky |
| Lockdroid | N/A | Decryptor Not Available | N/A |
| LockLock | (Decryption Currently Not Possible) | Bleeping Computer | |
| Locker | Bleeping Computer | ||
| Lock Screen | Trend Micro | ||
| Lortok | Instructions | Kaspersky | |
| MacAndCheese | N/A | .locked | N/A |
| MafiaWare | N/A | ".Locked-by-Mafia" (or ".Locked-Mafiaware") | N/A |
| Mahasaraswati | N/A | .id-[UNIQUE USER’S ID].{mahasaraswati(@)india.com}.xtbl | N/A |
| Maktub Locker | N/A | adds a random extension | N/A |
| Mamba | N/A | Encrypts hard drives not files | N/A |
| Manamecrypt | |||
| Marlboro | Instructions | *.oops | Emsisoft |
| Marsjoke | Instructions | Kaspersky | |
| Matrix | N/A | .matrix | N/A |
| MirCop | Instructions | Lock.{Original file name} | AVG |
| MirCop | Instructions | Lock.{Original file name} | Trend Micro |
| Mole | N/A | .mole | N/A |
| MRCR or Merry X-Mas | Instructions | *.PEGS1, *.MRCR1, *.RARE1, *.MERRY, *.RMCM1 | Emsisoft |
| my-Little-Ransomware | |||
| Nanolocker | |||
| Nemucod | Instructions | *.crypted | Emsisoft |
| Nemucod | Instructions | {Original file name}.crypted | Trend Micro |
| NMoreira | Instructions | *.maktub, *._AiraCropEncrypted! | Emsisoft |
| NoobCrypt |
| Decypt keys are ZdZ8EcvP95ki6NWR2j or lsakhBVLIKAHg | Jakub Kroustek |
| NoobCrypt | Instructions | Avast | |
| ODCODC | Bleeping Computer | ||
| OpenToYou | Instructions | [email protected] | Emsisoft |
| Operation Global III | *.exe | Nathan Scott aka DecrypterFixer | |
| Osiris | N/A | N/A | N/A |
| OzozaLocker | Instructions | *.locked | Emsisoft |
| PClock | Instructions | Doesn't change extension look for enc_files.txt | Emsisoft |
| Petya | Leo Stone | ||
| Philadelphia | Instructions | *.locked | Emsisoft |
| PHP | Instructions | Check Point | |
| PizzaCrypts | Bleeping Computer | ||
| Pletor | Instructions | Kaspersky | |
| Polyglot | Instructions | Infected with Trojan-Ransom.Win32.Polyglot | Kaspersky |
| Pompous | EDA2 | ||
| Popcorn | Instructions | Elevenpaths | |
| PoshCoder | Palo Alto Networks | ||
| Princess Locker | Instructions | Hasherezade | |
| Purge v.1 | Instructions | {Original file name}.purge | Trend Micro |
| Purge v.2 | Instructions | {Original file name}.{email address + random characters} | Trend Micro |
| Purge v.3 | Instructions | {Original file name}.{email address + random characters} | Trend Micro |
| Radamant | Instructions | *.rdm, *.rrk | Emsisoft |
| Rakhni | Instructions | *.locked, *.kraken | Kaspersky |
| Rannoh | Instructions | Renames files "locked-<original_name>.<four_random_letters>" | Kaspersky |
| Rector | Infected with Trojan-Ransom.Win32.Rector | Kaspersky | |
| Rotor | Instructions | Kaspersky | |
| SamSam | N/A | adds a random string of characters to end of file | N/A |
| Satan | N/A | Decryptor Not Available | N/A |
| Scatter | Infected with Trojan-Ransom.BAT.Scatter | Kaspersky | |
| Scraper | Infected with Trojan-Ransom.Win32.Scraper | Kaspersky | |
| Serpent | N/A | Decryptor Not Available | N/A |
| Shade | *.xtbl, *.ytbl, *.breaking_bad, *.heisenberg. | Intel | |
| Shade | *.xtbl, *.ytbl, *.breaking_bad, *.heisenberg. | Kaspersky | |
| SNSLocker | Instructions | {Original file name}.RSNSLocked | Trend Micro |
| Stampado | Instructions | *.locked | Emsisoft |
| Stampado | Instructions | *.locked | Trend Micro |
| Stampado | Instructions | *.locked | Avast |
| SZFLocker | Instructions | *.szf | AVG |
| SZFLocker | Instructions | *.szf | Avast |
| Teamxrat | Instructions | {Original filename}.__xratteamLucked | Trend Micro |
| TeleCrypt | Instructions | {Original file name} | Trend Micro |
| TeslaCrack | Googulator | ||
| TeslaCrypt | Instructions | Decryptor for variant that doesn't rename files | AVG |
| TeslaCrypt | *.xxx, *.ttt, *.micro, *.mp3 | ESET | |
| TeslaCrypt v1 | Instructions | {original file name}.ECC | Trend Micro |
| TeslaCrypt v2 | Instructions | {original file name}.VVV, CCC, ZZZ, AAA, ABC, XYZ | Trend Micro |
| TeslaCrypt v3 | Instructions | {original file name}.XXX or TTT or MP3 or MICRO | Trend Micro |
| TeslaCrypt v3 | Instructions | {original file name}.XXX or TTT or MP3 or MICRO | Kaspersky |
| TeslaCrypt v4 | Instructions | File name and extension are unchanged | Trend Micro |
| TeslaCrypt v4 | Instructions | File name and extension are unchanged | Kaspersky |
| TeslaCrypt | *.xxx, *.ttt, *.micro, *.mp3 | Intel | |
| TeslaCrypt | Malwarebytes | ||
| TeslaCrypt | Talos | ||
| TeslaCrypt | Instructions | Avast | |
| TM | Instructions | Trend Micro | |
| TorrentLocker | *.encrypted, *.enc | DecryptFixer | |
| Troldesh | Kaspersky | ||
| Troldesh | Intel | ||
| UmbreCrypt | Instructions | *.hydracrypt, *.umbrecrypt | Emsisoft |
| Vandev | .xorist (or adds a random extension) | Kaspersky | |
| Vandev | Instructions | .xorist (or adds a random extension) | Trend Micro |
| Vindows | MalwareBytes | ||
| Wildfire | *.wflx | Kaspersky | |
| Wildfire | Instructions | *.wflx | Intel |
| XORBAT | Instructions | {Original file name}.crypted | Trend Micro |
| Xorist | Instructions | *.EnCiPhErEd, *.0JELvV, *.p5tkjw, *.6FKR8d, *.UslJ6m, *.n1wLp0, *.5vypSa, *.YNhlv1 | Emsisoft |
| Xorist | .xorist (or adds a random extension) | Kaspersky | |
| Xorist | Instructions | .xorist (or adds a random extension) | Trend Micro |
| Xpan | Instructions | {Original filename}.__xratteamLucked | Trend Micro |
| XRatTeam | .xratteamLucked | Trend Micro | |
| Zepto | N/A | .zepto | |
| Zeta | Instructions | *.CRYPTOSHIELD, *.rdmk, *.lesli, *.scl, *.code, *.rmd *.rscl | Avast |