Ransomware Decryptor (Entschlüsselungs-Tools)
Ransomware
Unsere Liste enthält aktuell 214 Ransomware-Varianten und dokumentiert die jeweils verwendeten Dateierweiterungen (aktuell über 250 Erweiterungen). Soweit verfügbar gibt es Links zu Decryptor (Entschlüsselungs-Tools), weiteren Informationen und Screenshots.
Bei Fragen stehen wir jederzeit kostenlos per E-Mail zur Verfügung.
Letzte Änderung am: 20.01.2020
Tipp: Alternativ können Sie mit der Web-App ID Ransomware herausfinden, von welcher bösartigen Ransomware-Variante sie betroffen sind.
| Ransomware | Dateiendungen | Lösegeldforderung | Merkmale | Kryptierung | Decryptor | Info | Screenshots |
| $ ucyLocker | .WINDOWS | READ_IT.txt |  |
||||
| 777 | .777 | read_this_file.txt | Lösegeld: 500 Dollar oder 1500 Dollar | XOR | Emsisoft Decrypter | |
|
| 7ev3n | .R4A .R5A |
FILES_BACK.txt | Ändert das Desktop-Hintergrundbild | Decoder | |
||
| 7h9r | .7h9r | README_.TXT | 7h9r341@gmail.com | AES | |
||
| 8lock8 | .8lock8 | READ_IT.txt | Basiert auf HiddenTear | AES (256) | HT Bruteforcer | |
|
| AiraCrop | ._AiraCropEncrypted | How to decrypt your files.txt | |
||||
| Al-Namrood | .unavailable .disappeared |
How to decrypt your files.txt | Emsisoft Decrypter | |
|||
| Alfa Ransomware | .bin | README HOW TO DECRYPT | Vom Hersteller der Cerber Ransomware | |
|||
| Alpha Ransomware | .encrypt | Read Me (How Decrypt)! | Eine neue Version der TeslaCrypt Ransomware. Lösegeld: 500 Dollar | AES (256) | Alpha Decrypter | |
|
| AMBA | .amba .R5A |
ПРОЧТИ_МЕНЯ.txt READ_ (Russisch) |
|
||||
| Apocalypse | .encrypted .SecureCrypted .FuckYourDat |
*.How_To_Decrypt.txt | decryptionservice@ mail.ru recoveryhelp@bk.ru |
Emsisoft Decrypter | |
||
| ApocalypseVM | .encrypted .locked |
*.How_To_Get_Back.txt | Die Ransomware nutzt VMprotect | Emsisoft Decrypter | |
||
| AutoLocky | .locky .locked |
info.txt info.html |
Programmiersprache AutoIt. Lösegeld: 0,75 Bitcoins | AES (128) | Emsisoft Decrypter | |
|
| BadBlock | Help Decrypt.html | Fügt verschlüsselten Dateien keine Erweiterung hinzu | RSA | Emsisoft Decrypter | |
||
| Bandarchor | Dateien werden teilweise verschlüsselt | AES (256) | Emsisoft Decrypter | |
|||
| Bart | .bart.zip | recover.txt recover.bmp |
AES (256) | AVG Decrypter | |
||
| BitCryptor | .clf | Neue CoinVault Variante | Kaspersky Decrypter | |
|||
| BitStak | .bitstak | BitStak Decrypter | |
||||
| BlackShades Crypter | .Silent | Hacked_Read_me_ to-decrypt_files.html YourID.txt |
AES (256) | |
|||
| Blocatto | .blocatto | Basiert auf HiddenTear | AES (256) | |
|||
| Booyah | .bitstak | |
|||||
| Brazilian | .lock | MENSAGEM.txt | Basiert auf EDA2 | AES (256) | |
||
| BrLock | .lock | AES | |
||||
| Browlock | .lock | keine lokale Verschlüsselung, gesperrter Browser | |
||||
| Bucbi | .lock | Ändert keine Dateinamen | GOST | |
|||
| BuyUnlockCode | BUYUNLOCKCODE.txt | Löscht keine Schattenkopien | |
||||
| Cerber | .cerber | # DECRYPT MY FILES #.html # DECRYPT MY FILES #.txt # DECRYPT MY FILES #.vbs |
AES | |
|||
| Cerber 2 | .cerber2 | Spricht mit den Opfern und ändert das Desktop-Hintergrundbild | |
||||
| Cerber 3 | .cerber3 | # HELP DECRYPT #.txt | Spricht mit den Opfern | |
|||
| Chimera | .crypt | YOUR_FILES_ARE_ ENCRYPTED.HTML YOUR_FILES_ARE_ ENCRYPTED.TXT |
Chimera Decryptor | |
|||
| CoinVault | .clf | wallpaper.jpg | Base64 + String Replacement | Kaspersky Decrypter | |
||
| Coverton | .coverton .enigma .czvxce |
!!!-WARNING-!!!.html !!!-WARNING-!!!.txt |
AES (256) | |
|||
| Creeper | .rag2hdst .creeper .cripper |
DECRIPT_Files.txt | Bezahlung per Monero Mail-Adresse: skgrhk2118 |
AES (CBC) | |
||
| CrypBoss | .crypt R16M01D05 |
Mail-Adresse: @dr.com | Emsisoft Decrypter | |
|||
| Cryaki | .{CRYPTEN DBLACKDC} |
Kaspersky Decrypter | |
||||
| Crybola | Kaspersky Decrypter | |
|||||
| CryFile | .criptiko .criptoko .criptokod .cripttt .aga |
SHTODELATVAM.txt Instructionaga.txt |
Moves bytes | |
|||
| Crypren | .ENCRYPTED | READ_THIS_TO_ DECRYPT.html |
Decrypt Crypren | |
|||
| Crypt38 | .crypt38 | AES | Crypt38 Keygen | |
|||
| Cryptear | AES (256) | Recovering Anleitung | |
||||
| CryptFIle2 | .scl | RSA | |
||||
| CryptInfinite | .crinf | ReadDecrypt FilesHere.txt |
Emsisoft Decrypter | |
|||
| CryptoBit | .crinf | OKSOWATHAPPEND TOYOURFILES.TXT |
AES & RSA | |
|||
| CryptoDefense | .crinf | HOW_DECRYPT.TXT HOW_DECRYPT.HTML HOW_DECRYPT.URL |
Emsisoft Decrypter | |
|||
| CryptoFinancial | |
||||||
| CryptoFortress | READ IF YOU WANT YOUR FILES BACK.html | Verschlüsselt 50% einer Datei. Maximale Dateigröße: 5 MB | AES (256), RSA (1024) | |
|||
| CryptoGraphic Locker | wallpaper.jpg | AES (128) | |
||||
| CryptoHasYou | .enc | YOUR_FILES_ARE_LOCKED | Der Entschlüsselungs-Preis erhöht sich alle 3 Tage um 150 Dollar | AES (256) | |
||
| CryptoHost | Verbreitung per µ-Torrent-Client | AES (256) (RAR Implementierung) | Passwort Generator | |
|||
| CryptoJoker | README!!!.txt GetYouFiles.txt crjoker.html |
AES (256) | |
||||
| CryptoLocker | RSA (2048) | Decryption Anleitung | |
||||
| CryptoMix | HELP_YOUR_FILES.html (CryptXXX) HELP_YOUR_FILES.txt (CryptoWall 3.0, 4.0) |
RSA (2048) | |
||||
| CryptoRoger | !Where_are_my_ files!.html |
AES | |
||||
| CryptoShocker | ATTENTION.url | AES | |
||||
| CryptoTor Locker2115 |
HOW TO DECRYPT FILES.txt %Temp%\ |
AES | Decryption Anleitung | |
|||
| CryptoWall 1 | DECRYPT_INSTRUCTION .HTML DECRYPT_INSTRUCTION .TXT DECRYPT_INSTRUCTION .URL INSTALL_TOR.URL |
|
|||||
| CryptoWall 2 | HELP_DECRYPT.TXT HELP_DECRYPT.PNG HELP_DECRYPT.URL HELP_DECRYPT.HTML |
|
|||||
| CryptoWall 3 | HELP_DECRYPT.TXT HELP_DECRYPT.PNG HELP_DECRYPT.URL HELP_DECRYPT.HTML |
|
|||||
| CryptoWall 4 | HELP_YOUR_FILES.HTML HELP_YOUR_FILES.PNG |
|
|||||
| CryptXXX | .crypt | de_crypt_readme.bmp .txt .html |
Kaspersky Decrypter | |
|||
| CryptXXX 2.0 | .crypt | .html .bmp |
Kaspersky Decrypter | |
|||
| CryptXXX 3.0 | .crypt .cryp1 .crypz .cryptz random |
|
|||||
| CrySiS | .crysis .crypt .xtbl |
Eset CrySiS Decryptor | |
||||
| CTB-Faker | |
||||||
| CTB-Locker | .ctbl | AllFilesAreLocked-user_id-.bmp DecryptAllFiles-user_id-.txt |
Zufällige Dateierweiterungen | RSA (2048) | |
||
| CTB-Locker WEB |
AES (256) | |
|||||
| DeCrypt Protect | .html | |
|||||
| DEDCryptor | .ded | Basiert auf EDA2 | AES-256 | |
|||
| DirtyDecrypt | Emsisoft Decrypter | |
|||||
| DMALocker | cryptinfo.txt decrypting.txt start.txt |
Die verschlüsselten Dateien enthalten die folgenden Präfixe: Version 1: ABCXYZ11 Version 2: !DMALOCK Version 3: !DMALOCK3.0 Version 4: !DMALOCK4.0 |
AES (256) Version 2-4 auch RSA |
|
|||
| DMALocker 3.0 |
Dateityp wird nicht geändert | AES (256) | Emsisoft Decrypter | |
|||
| EDA2 / HiddenTear | .locked | AES (256) | |
||||
| EduCrypt | .isis .locked |
README.txt | Basiert auf Hidden Tear | |
|||
| El-Polocker | .ha3 | qwer.html qwer2.html locked.bmp |
|
||||
| Enigma | .enigma | enigma.hta enigma_encr.txt |
AES (128) | |
|||
| Fakben | .locked | READ ME FOR DECRYPT.txt | Basiert auf Hidden Tear | |
|||
| Fonco | Mailkontakt: safefiles32@mail.ru | |
|||||
| Fury | Kaspersky Decrypter | |
|||||
| GhostCrypt | .Z81928819 | AES (256) | GhostCrypt Decrypter | |
|||
| GNL Locker | .locked | UNLOCK_FILES_ INSTRUCTIONS.html |
AES (256) | |
|||
| Gomasom | .crypt | Mail-Adresse im Dateinamen | Emsisoft Decrypter | |
|||
| Goopic | Your files have been crypted.html | |
|||||
| Gopher | OS X ransomware (PoC) | |
|||||
| Harasom | .html | Emsisoft Decrypter | |
||||
| Herbst | .herbst | |
|||||
| Hi Buddy! | .cry | AES (256) | |
||||
| HydraCrypt | README_DECRYPT_ HYRDA_ID_ [ID number].txt |
CrypBoss Familie | Emsisoft Decrypter | |
|||
| iLock | .crime | |
|||||
| iLockLight | .crime | |
|||||
| International Police Association |
%Temp%-random-.bmp | |
|||||
| Jeiphoos | |
||||||
| Jigsaw | .btc, .kkk, .fun, .gws .porno, .payransom .payms, .paymst .AFD, .paybtcs, .epic |
AES (256) | Jigsaw Decrypter | |
|||
| Job Crypter | .locked .css |
Comment débloquer mes fichiers.txt Readme.txt |
TripleDES | |
|||
| KeRanger | .encrypted | OS X Ransomware | AES | Decryption Anleitung | |
||
| KeyBTC | keybtc@inbox_com | DECRYPT_YOUR_FILES.txt READ.txt readme.txt |
Emsisoft Decrypter | |
|||
| KEYHolder | how_decrypt.gif how_decrypt.html |
tuyuljahat@hotmail .com |
|
||||
| KimcilWare | .kimcilware .locked |
Infiziert Webseiten | AES | |
|||
| Kozy.Jozy | .31392E30362E 32303136 _[ID-KEY]_LSBJ1 |
w.jpg | RSA (2048) | |
|||
| KratosCrypt | .kratos | README_ALL.html | |
||||
| KryptoLocker | KryptoLocker_ README.txt |
AES (256) | |
||||
| LeChiffre | .LeChiffre | How to decrypt LeChiffre files.html | Mail-Adresse: decrypt.my.files@ gmail.com |
Emsisoft Decrypter | |
||
| Linux.Encoder | Linux Ransomware | |
|||||
| Locker | Ändert den Dateityp nicht | |
|||||
| Locky | .locky .zepto |
_Locky_recover_ instructions.txt _Locky_recover_ instructions.bmp _HELP_instructions.txt _HELP_instructions.bmp |
AES(128) | |
|||
| Lortok | .crime | |
|||||
| LowLevel04 | oor. | |
|||||
| Mabouia | OS X ransomware (PoC) | |
|||||
| Magic | .magic | DECRYPT_ReadMe1.TXT DECRYPT_ReadMe.TXT |
Basiert auf EDA2 | AES (256) | |
||
| MaktubLocker | _DECRYPT_INFO_ [extension pattern].html |
AES (256) RSA (2048) |
|
||||
| MIRCOP | Lock. | Verlangt 48.48 BTC | AES | |
|||
| MireWare | .fucked, .fuck | READ_IT.txt | AES (256) | |
|||
| Mischa | 3P7m .arpT .eQTz .3RNu |
YOUR_FILES_ARE _ENCRYPTED.HTML YOUR_FILES_ARE _ENCRYPTED.TXT |
|
||||
| MM Locker | .locked | READ_IT.txt | AES (256) | |
|||
| Mobef | .KEYZ .KEYH0LES |
4-14-2116- INFECTION.TXT IMPORTANT.README |
|
||||
| NanoLocker | ATTENTION.RTF | Ändert den Dateityp nicht | AES (256) RSA |
|
|||
| Nemucod | .crypted | Decrypted.txt | XOR (255) 7zip |
Emsisoft Decrypter | |
||
| ODCODC | .odcodc | XOR | |
||||
| Offline ransomware | .cbf | desk.bmp desk.jpg |
.777 E-Mail Adresse | |
|||
| OMG! Ransomware | .LOL! .OMG! |
how to get data.txt | |
||||
| Operation Global III | .EXE | |
|||||
| Pashka | .pashka | HELP_ME_RECOVER _MY_FILES.txt |
AES | |
|||
| PadCrypt | .padcrypt | IMPORTANT READ ME.txt File Decrypt Help.html |
Enthält einen Live Support Chat | |
|||
| Petya | Sperrt den kompletten Computer | Passwort Decrypter | |
||||
| PizzaCrypts | .id-[victim_id]- maestro@pizzacrypts .info |
|
|||||
| PowerWare | |
||||||
| PRISM | |
||||||
| RAA encryptor | .locked | !!!README!!![id].rtf | |
||||
| Radamant | .RDM .RRK .RAD .RADAMANT |
YOUR_FILES.url | AES (256) | Emsisoft Decrypter | |
||
| Rannoh | Kaspersky Decrypter | |
|||||
| Ransom32 | |
||||||
| Rector | .vscrypt .infected .bloc .korrektor |
Kaspersky Decrypter | |
||||
| RemindMe | .remind | decypt_your_files.html | |
||||
| Rokku | .rokku | README_HOW_TO_ UNLOCK.TXT README_HOW_TO_ UNLOCK.HTML |
Curve 25519 + ChaCha | |
|||
| Samas-Samsam | .encryptedAES .encryptedRSA .encedRSA .justbtcwillhelpyou .btcbtcbtc .btc-help-you .only-we_can-help_you .iwanthelpuuu |
HELP_DECRYPT_YOUR _FILES.html |
AES (256) + RSA (2096) | |
|||
| Sanction | .sanction | DECRYPT_YOUR_ FILES.HTML |
AES (256) + RSA (2096) | |
|||
| Sanctions | .wallet | RESTORE_ALL |
AES (256) + RSA (2048) |
|
|||
| Sardoninir | .enc |
|
|||||
| Satan | .stn | HELP_DECRYPT |
RaaS | AES (256) + RSA (2096) |
|
||
| Satana | Sarah_G@ |
!satana!.txt | |
||||
| Scraper | Ändert den Dateityp nicht | Scraper Decryptor | |
||||
| SerbRansom | .velikasrbija |
|
|||||
| Serpent | .serpent | HOW_TO_DECRYPT_ HOW_TO_DECRYPT_ |
Batch-Datei Passcode: RSA1014DJW2048 | AES(256) |
|
||
| Serpico | DetoxCrypto Variante | AES |
|
||||
| Shark | .locked | Readme.txt | AES(256) |
|
|||
| ShellLocker | .L0cked |
|
|||||
| ShinoLocker | .shino |
|
|||||
| Shujin | 文件解密帮助.txt | |
|||||
| Simple_Encoder | .~ | _RECOVER_ |
AES |
|
|||
| SkidLocker / Pompous | .locked | READ_IT.txt | AES (256) | Decryption Anleitung | |
||
| SkyName | Basierta auf HiddenTear |
|
|||||
| Smash! |
|
||||||
| Smrss32 | .encrypted | _HOW_TO_Decrypt.bmp |
|
||||
| SNSLocker | .RSNSlocked .RSplited |
READ_Me.txt | AES (256) | |
|||
| Somik1 | . somik1 .arnoldmichel2 @ tutanota.com |
WARNING.txt, WARNING2.txt, WARNING3.txt ... | AES | |
|||
| Spora | [Infection-ID] |
|
|||||
| Sport | .sport | |
|||||
| Stampado | .locked | Zufällige Nachricht enthält eine Bitcoin-Adresse mit Anweisungen | Coded by "The_Rainmaker". Löscht zufällig alle 6 Stunden eine Datei und löscht nach 96 Stunden den Entschlüsselungsschlüssel. | AES(256) | Bleeping |
|
|
| Strictor | .locked | AES (256) | |
||||
| Surprise | .surprise .tzu |
DECRYPTION_HOWTO .Notepad |
AES (256) | |
|||
| Survey | ThxForYur |
|
|||||
| SynoLocker | |
||||||
| SZFLocker | .szf | AVG Decryptor | |
||||
| TeamXrat | .___xratteam |
Como descriptografar os seus arquivos.txt | AES(256) |
|
|||
| TeleCrypt | .xcri | Telecrypt erzeugt eine zufällige Zeichenfolge, die zwischen 10 und 20 Zeichen lang ist und nur die Buchstaben vo,pr,bm,xu,zt,dq enthält. | Malwarebytes Decrypter |
|
|||
| TeslaCrypt0+ | .vvv .ecc .exx .ezz .abc .aaa .zzz .xyz |
HELP_TO_SAVE_ FILES.txt Howto_RESTORE _FILES.html |
TeslaCrypt Decryptor | |
|||
| TeslaCrypt 3.0+ | .micro .xxx .ttt .mp3 |
AES (256) + ECHD + SHA1 | ESET TeslaCrypt Decryptor | |
|||
| Thanksgiving |
|
||||||
| Threat Finder |
HELP_DECRYPT.HTML | |
|||||
| TorrentLocker | .Encrypted .enc |
HOW_TO_ DECRYPT_ DESIFROVANI_ INSTRUCCIONES_ ISTRUZIONI_ ENTSCHLUSSELN_ ONTSLEUTELINGS_ INSTRUCTIONS_DE_ SIFRE_COZME_ wie_zum_Wiederherstellen |
AES(256) | Bleeping |
|
||
| TowerWeb | Payment_ Instructions.jpg |
|
|||||
| Toxcrypt | .toxcrypt | tox.html | |
||||
| Trojan | .braincrypt | !!! HOW TO DECRYPT FILES !!!.txt | Bleeping |
|
|||
| Troldesh | .better_call_saul .xtbl .da_vinci_code .windows10 |
READMEnumber.txt | AES (256) | |
|||
| TrueCrypter | .enc | AES (256) | |
||||
| Trump Locker | .TheTrumpLockerf .TheTrumpLockerfp |
What happen to my files.txt |
|
||||
| Turkish | .sifreli |
|
|||||
| Turkish (Fake CTB-Locker) | .encrypted | Beni Oku.txt | keys in '%name%.manifest.xml |
|
|||
| Turkish Ransom | .locked | DOSYALARINIZA ULAŞMAK İÇİN AÇINIZ.html | AES(256) |
|
|||
| UltraLocker | Basiert auf der Open-Source-Ransomware CryptoWire | AES(256) |
|
||||
| UmbreCrypt | .umbrecrypt | Emsisoft Decrypter | |
||||
| UnblockUPC | Files encrypted.txt |
|
|||||
| Ungluk | .H3LL .0x0 .1999 |
READTHISNOW!!!.txt Hellothere.txt YOUGOTHACKED.TXT |
Die Opfer sollen per Bitmessage Kontakt zum Betrüger aufnehmen | AES |
|
||
| Unlock26 | .locked-[XXX] | ReadMe-XXX.html |
|
||||
| Unlock92 | .CRRRT .CCCRRRPPP |
|
|||||
| Vanguard | GO Ransomware |
|
|||||
| VapeLauncher | CryptoWire Variante |
|
|||||
| VaultCrypt | .vault .xort .trun |
VAULT.txt xort.txt trun.txt random.hta | VAULT.hta |
Benutzt eine gpg.exe | |
|||
| VBRANSOM 7 | .VBRANSOM | Verschlüsselt nicht wirklich |
|
||||
| Venis Ransomware | VenisRansom |
|
|||||
| VenusLocker | .Venusf .Venusp |
ReadMe.txt | Basiert auf EDA2 | AES(256) |
|
||
| Vindows Locker | .vindows | AES | Malwarebytes Decrypter |
|
|||
| Virlock | .exe | |
|||||
| Virus-Encoder | .CrySiS .xtbl |
How to decrypt your data.txt |
AES (256) | |
|||
| Vortex | .aes |
|
|||||
| vxLock | .vxLock |
|
|||||
| WannaCry | .wcry .wncry .WNCRY .WCRY |
@Please_ |
|
||||
| WildFire Locker | .wflx | HOW_TO_UNLOCK_ FILES_README_(ID.txt |
WildFire Decryptor | |
|||
| Winnix Cryptor | .wnx | YOUR FILES ARE ENCRYPTED!.txt | GPG |
|
|||
| XCrypt | Xhelp.jpg |
|
|||||
| XData | .~xdata~ | HOW_CAN_I_DECRYPT |
|
||||
| Xorist | .EnCiPhErEd .73i87A .p5tkjw .PoAr2w .fileiscryptedhard .0JELvV .6FKR8d .UslJ6m .n1wLp0 .5vypSa |
HOW TO DECRYPT FILES.TXT | XOR TEA |
Kaspersky Decrypter | |
||
| XRTN | .xrtn | VaultCrypt Familie | |
||||
| XYZWare | Basiert auf HiddenTear |
|
|||||
| You Have Been Hacked!!! | .Locked | Versucht Passwörter zu stehlen |
|
||||
| YourRansom | .yourransom | README.txt |
|
||||
| Zcrypt | .zcrypt | |
|||||
| Zeta | .code .scl .rmd |
# HELP_DECRYPT_ |
|
||||
| Zimbra | .crypto | how.txt | mpritsken@ priest.com |
|
|||
| ZinoCrypt | .ZINO | ZINO_NOTE.TXT |
|
||||
| Zlader / Russian | .vault | VaultCrypt Familie | RSA | |
|||
| Zorro | .zorro | Take_Seriously (Your saving grace).txt |
|
||||
| zScreenLocker |
|
||||||
| Zyka | .locked | Bleeping |
|
||||
| Zyklon | .zyklon | |