Ransomware Decryptor (Entschlüsselungs-Tools)
Ransomware
Unsere Liste enthält aktuell 214 Ransomware-Varianten und dokumentiert die jeweils verwendeten Dateierweiterungen (aktuell über 250 Erweiterungen). Soweit verfügbar gibt es Links zu Decryptor (Entschlüsselungs-Tools), weiteren Informationen und Screenshots.
Bei Fragen stehen wir jederzeit kostenlos per E-Mail zur Verfügung.
Letzte Änderung am: 20.02.2020
Tipp: Alternativ können Sie mit der Web-App ID Ransomware herausfinden, von welcher bösartigen Ransomware-Variante Sie betroffen sind.
| Ransomware | Dateiendungen | Lösegeldforderung | Merkmale | Kryptierung | Decryptor | Info |
| $ ucyLocker | .WINDOWS | READ_IT.txt | ||||
| 777 | .777 | read_this_file.txt | Lösegeld: 500 Dollar oder 1500 Dollar | XOR | Emsisoft Decrypter | |
| 7ev3n | .R4A .R5A |
FILES_BACK.txt | Ändert das Desktop-Hintergrundbild | Decoder | ||
| 7h9r | .7h9r | README_.TXT | 7h9r341@gmail.com | AES | ||
| 8lock8 | .8lock8 | READ_IT.txt | Basiert auf HiddenTear | AES (256) | HT Bruteforcer | |
| AiraCrop | ._AiraCropEncrypted | How to decrypt your files.txt | ||||
| Al-Namrood | .unavailable .disappeared |
How to decrypt your files.txt | Emsisoft Decrypter | |||
| Alfa Ransomware | .bin | README HOW TO DECRYPT | Vom Hersteller der Cerber Ransomware | |||
| Alpha Ransomware | .encrypt | Read Me (How Decrypt)! | Eine neue Version der TeslaCrypt Ransomware. Lösegeld: 500 Dollar | AES (256) | Alpha Decrypter | |
| AMBA | .amba .R5A |
ПРОЧТИ_МЕНЯ.txt READ_ (Russisch) |
||||
| Apocalypse | .encrypted .SecureCrypted .FuckYourDat |
*.How_To_Decrypt.txt | decryptionservice@ mail.ru recoveryhelp@bk.ru |
Emsisoft Decrypter | ||
| ApocalypseVM | .encrypted .locked |
*.How_To_Get_Back.txt | Die Ransomware nutzt VMprotect | Emsisoft Decrypter | ||
| AutoLocky | .locky .locked |
info.txt info.html |
Programmiersprache AutoIt. Lösegeld: 0,75 Bitcoins | AES (128) | Emsisoft Decrypter | |
| BadBlock | Help Decrypt.html | Fügt verschlüsselten Dateien keine Erweiterung hinzu | RSA | Emsisoft Decrypter | ||
| Bandarchor | Dateien werden teilweise verschlüsselt | AES (256) | Emsisoft Decrypter | |||
| Bart | .bart.zip | recover.txt recover.bmp |
AES (256) | AVG Decrypter | ||
| BitCryptor | .clf | Neue CoinVault Variante | Kaspersky Decrypter | |||
| BitStak | .bitstak | BitStak Decrypter | ||||
| BlackShades Crypter | .Silent | Hacked_Read_me_ to-decrypt_files.html YourID.txt |
AES (256) | |||
| Blocatto | .blocatto | Basiert auf HiddenTear | AES (256) | |||
| Booyah | .bitstak | |||||
| Brazilian | .lock | MENSAGEM.txt | Basiert auf EDA2 | AES (256) | ||
| BrLock | .lock | AES | ||||
| Browlock | .lock | keine lokale Verschlüsselung, gesperrter Browser | ||||
| Bucbi | .lock | Ändert keine Dateinamen | GOST | |||
| BuyUnlockCode | BUYUNLOCKCODE.txt | Löscht keine Schattenkopien | ||||
| Cerber | .cerber | # DECRYPT MY FILES #.html # DECRYPT MY FILES #.txt # DECRYPT MY FILES #.vbs |
AES | |||
| Cerber 2 | .cerber2 | Spricht mit den Opfern und ändert das Desktop-Hintergrundbild | ||||
| Cerber 3 | .cerber3 | # HELP DECRYPT #.txt | Spricht mit den Opfern | |||
| Chimera | .crypt | YOUR_FILES_ARE_ ENCRYPTED.HTML YOUR_FILES_ARE_ ENCRYPTED.TXT |
Chimera Decryptor | |||
| CoinVault | .clf | wallpaper.jpg | Base64 + String Replacement | Kaspersky Decrypter | ||
| Coverton | .coverton .enigma .czvxce |
!!!-WARNING-!!!.html !!!-WARNING-!!!.txt |
AES (256) | |||
| Creeper | .rag2hdst .creeper .cripper |
DECRIPT_Files.txt | Bezahlung per Monero Mail-Adresse: skgrhk2118 |
AES (CBC) | ||
| CrypBoss | .crypt R16M01D05 |
Mail-Adresse: @dr.com | Emsisoft Decrypter | |||
| Cryaki | .{CRYPTEN DBLACKDC} |
Kaspersky Decrypter | ||||
| Crybola | Kaspersky Decrypter | |||||
| CryFile | .criptiko .criptoko .criptokod .cripttt .aga |
SHTODELATVAM.txt Instructionaga.txt |
Moves bytes | |||
| Crypren | .ENCRYPTED | READ_THIS_TO_ DECRYPT.html |
Decrypt Crypren | |||
| Crypt38 | .crypt38 | AES | Crypt38 Keygen | |||
| Cryptear | AES (256) | Recovering Anleitung | ||||
| CryptFIle2 | .scl | RSA | ||||
| CryptInfinite | .crinf | ReadDecrypt FilesHere.txt |
Emsisoft Decrypter | |||
| CryptoBit | .crinf | OKSOWATHAPPEND TOYOURFILES.TXT |
AES & RSA | |||
| CryptoDefense | .crinf | HOW_DECRYPT.TXT HOW_DECRYPT.HTML HOW_DECRYPT.URL |
Emsisoft Decrypter | |||
| CryptoFinancial | ||||||
| CryptoFortress | READ IF YOU WANT YOUR FILES BACK.html | Verschlüsselt 50% einer Datei. Maximale Dateigröße: 5 MB | AES (256), RSA (1024) | |||
| CryptoGraphic Locker | wallpaper.jpg | AES (128) | ||||
| CryptoHasYou | .enc | YOUR_FILES_ARE_LOCKED | Der Entschlüsselungs-Preis erhöht sich alle 3 Tage um 150 Dollar | AES (256) | ||
| CryptoHost | Verbreitung per µ-Torrent-Client | AES (256) (RAR Implementierung) | Passwort Generator | |||
| CryptoJoker | README!!!.txt GetYouFiles.txt crjoker.html |
AES (256) | ||||
| CryptoLocker | RSA (2048) | Decryption Anleitung | ||||
| CryptoMix | HELP_YOUR_FILES.html (CryptXXX) HELP_YOUR_FILES.txt (CryptoWall 3.0, 4.0) |
RSA (2048) | ||||
| CryptoRoger | !Where_are_my_ files!.html |
AES | ||||
| CryptoShocker | ATTENTION.url | AES | ||||
| CryptoTor Locker2115 |
HOW TO DECRYPT FILES.txt %Temp%\ |
AES | Decryption Anleitung | |||
| CryptoWall 1 | DECRYPT_INSTRUCTION .HTML DECRYPT_INSTRUCTION .TXT DECRYPT_INSTRUCTION .URL INSTALL_TOR.URL |
|||||
| CryptoWall 2 | HELP_DECRYPT.TXT HELP_DECRYPT.PNG HELP_DECRYPT.URL HELP_DECRYPT.HTML |
|||||
| CryptoWall 3 | HELP_DECRYPT.TXT HELP_DECRYPT.PNG HELP_DECRYPT.URL HELP_DECRYPT.HTML |
|||||
| CryptoWall 4 | HELP_YOUR_FILES.HTML HELP_YOUR_FILES.PNG |
|||||
| CryptXXX | .crypt | de_crypt_readme.bmp .txt .html |
Kaspersky Decrypter | |||
| CryptXXX 2.0 | .crypt | .html .bmp |
Kaspersky Decrypter | |||
| CryptXXX 3.0 | .crypt .cryp1 .crypz .cryptz random |
|||||
| CrySiS | .crysis .crypt .xtbl |
Eset CrySiS Decryptor | ||||
| CTB-Faker | ||||||
| CTB-Locker | .ctbl | AllFilesAreLocked-user_id-.bmp DecryptAllFiles-user_id-.txt |
Zufällige Dateierweiterungen | RSA (2048) | ||
| CTB-Locker WEB |
AES (256) | |||||
| DeCrypt Protect | .html | |||||
| DEDCryptor | .ded | Basiert auf EDA2 | AES-256 | |||
| DirtyDecrypt | Emsisoft Decrypter | |||||
| DMALocker | cryptinfo.txt decrypting.txt start.txt |
Die verschlüsselten Dateien enthalten die folgenden Präfixe: Version 1: ABCXYZ11 Version 2: !DMALOCK Version 3: !DMALOCK3.0 Version 4: !DMALOCK4.0 |
AES (256) Version 2-4 auch RSA |
|||
| DMALocker 3.0 |
Dateityp wird nicht geändert | AES (256) | Emsisoft Decrypter | |||
| EDA2 / HiddenTear | .locked | AES (256) | ||||
| EduCrypt | .isis .locked |
README.txt | Basiert auf Hidden Tear | |||
| El-Polocker | .ha3 | qwer.html qwer2.html locked.bmp |
||||
| Enigma | .enigma | enigma.hta enigma_encr.txt |
AES (128) | |||
| Fakben | .locked | READ ME FOR DECRYPT.txt | Basiert auf Hidden Tear | |||
| Fonco | Mailkontakt: safefiles32@mail.ru | |||||
| Fury | Kaspersky Decrypter | |||||
| GhostCrypt | .Z81928819 | AES (256) | GhostCrypt Decrypter | |||
| GNL Locker | .locked | UNLOCK_FILES_ INSTRUCTIONS.html |
AES (256) | |||
| Gomasom | .crypt | Mail-Adresse im Dateinamen | Emsisoft Decrypter | |||
| Goopic | Your files have been crypted.html | |||||
| Gopher | OS X ransomware (PoC) | |||||
| Harasom | .html | Emsisoft Decrypter | ||||
| Herbst | .herbst | |||||
| Hi Buddy! | .cry | AES (256) | ||||
| HydraCrypt | README_DECRYPT_ HYRDA_ID_ [ID number].txt |
CrypBoss Familie | Emsisoft Decrypter | |||
| iLock | .crime | |||||
| iLockLight | .crime | |||||
| International Police Association |
%Temp%-random-.bmp | |||||
| Jeiphoos | ||||||
| Jigsaw | .btc, .kkk, .fun, .gws .porno, .payransom .payms, .paymst .AFD, .paybtcs, .epic |
AES (256) | Jigsaw Decrypter | |||
| Job Crypter | .locked .css |
Comment débloquer mes fichiers.txt Readme.txt |
TripleDES | |||
| KeRanger | .encrypted | OS X Ransomware | AES | Decryption Anleitung | ||
| KeyBTC | keybtc@inbox_com | DECRYPT_YOUR_FILES.txt READ.txt readme.txt |
Emsisoft Decrypter | |||
| KEYHolder | how_decrypt.gif how_decrypt.html |
tuyuljahat@hotmail .com |
||||
| KimcilWare | .kimcilware .locked |
Infiziert Webseiten | AES | |||
| Kozy.Jozy | .31392E30362E 32303136 _[ID-KEY]_LSBJ1 |
w.jpg | RSA (2048) | |||
| KratosCrypt | .kratos | README_ALL.html | ||||
| KryptoLocker | KryptoLocker_ README.txt |
AES (256) | ||||
| LeChiffre | .LeChiffre | How to decrypt LeChiffre files.html | Mail-Adresse: decrypt.my.files@ gmail.com |
Emsisoft Decrypter | ||
| Linux.Encoder | Linux Ransomware | |||||
| Locker | Ändert den Dateityp nicht | |||||
| Locky | .locky .zepto |
_Locky_recover_ instructions.txt _Locky_recover_ instructions.bmp _HELP_instructions.txt _HELP_instructions.bmp |
AES(128) | |||
| Lortok | .crime | |||||
| LowLevel04 | oor. | |||||
| Mabouia | OS X ransomware (PoC) | |||||
| Magic | .magic | DECRYPT_ReadMe1.TXT DECRYPT_ReadMe.TXT |
Basiert auf EDA2 | AES (256) | ||
| MaktubLocker | _DECRYPT_INFO_ [extension pattern].html |
AES (256) RSA (2048) |
||||
| MIRCOP | Lock. | Verlangt 48.48 BTC | AES | |||
| MireWare | .fucked, .fuck | READ_IT.txt | AES (256) | |||
| Mischa | 3P7m .arpT .eQTz .3RNu |
YOUR_FILES_ARE _ENCRYPTED.HTML YOUR_FILES_ARE _ENCRYPTED.TXT |
||||
| MM Locker | .locked | READ_IT.txt | AES (256) | |||
| Mobef | .KEYZ .KEYH0LES |
4-14-2116- INFECTION.TXT IMPORTANT.README |
||||
| NanoLocker | ATTENTION.RTF | Ändert den Dateityp nicht | AES (256) RSA |
|||
| Nemucod | .crypted | Decrypted.txt | XOR (255) 7zip |
Emsisoft Decrypter | ||
| ODCODC | .odcodc | XOR | ||||
| Offline ransomware | .cbf | desk.bmp desk.jpg |
.777 E-Mail Adresse | |||
| OMG! Ransomware | .LOL! .OMG! |
how to get data.txt | ||||
| Operation Global III | .EXE | |||||
| Pashka | .pashka | HELP_ME_RECOVER _MY_FILES.txt |
AES | |||
| PadCrypt | .padcrypt | IMPORTANT READ ME.txt File Decrypt Help.html |
Enthält einen Live Support Chat | |||
| Petya | Sperrt den kompletten Computer | Passwort Decrypter | ||||
| PizzaCrypts | .id-[victim_id]- maestro@pizzacrypts .info |
|||||
| PowerWare | ||||||
| PRISM | ||||||
| RAA encryptor | .locked | !!!README!!![id].rtf | ||||
| Radamant | .RDM .RRK .RAD .RADAMANT |
YOUR_FILES.url | AES (256) | Emsisoft Decrypter | ||
| Rannoh | Kaspersky Decrypter | |||||
| Ransom32 | ||||||
| Rector | .vscrypt .infected .bloc .korrektor |
Kaspersky Decrypter | ||||
| RemindMe | .remind | decypt_your_files.html | ||||
| Rokku | .rokku | README_HOW_TO_ UNLOCK.TXT README_HOW_TO_ UNLOCK.HTML |
Curve 25519 + ChaCha | |||
| Samas-Samsam | .encryptedAES .encryptedRSA .encedRSA .justbtcwillhelpyou .btcbtcbtc .btc-help-you .only-we_can-help_you .iwanthelpuuu |
HELP_DECRYPT_YOUR _FILES.html |
AES (256) + RSA (2096) | |||
| Sanction | .sanction | DECRYPT_YOUR_ FILES.HTML |
AES (256) + RSA (2096) | |||
| Sanctions | .wallet | RESTORE_ALL |
AES (256) + RSA (2048) | |||
| Sardoninir | .enc | |||||
| Satan | .stn | HELP_DECRYPT |
RaaS | AES (256) + RSA (2096) | ||
| Satana | Sarah_G@ |
!satana!.txt | ||||
| Scraper | Ändert den Dateityp nicht | Scraper Decryptor | ||||
| SerbRansom | .velikasrbija | |||||
| Serpent | .serpent | HOW_TO_DECRYPT_ HOW_TO_DECRYPT_ |
Batch-Datei Passcode: RSA1014DJW2048 | AES(256) | ||
| Serpico | DetoxCrypto Variante | AES | ||||
| Shark | .locked | Readme.txt | AES(256) | |||
| ShellLocker | .L0cked | |||||
| ShinoLocker | .shino | |||||
| Shujin | 文件解密帮助.txt | |||||
| Simple_Encoder | .~ | _RECOVER_ |
AES | |||
| SkidLocker / Pompous | .locked | READ_IT.txt | AES (256) | Decryption Anleitung | ||
| SkyName | Basierta auf HiddenTear | |||||
| Smash! | ||||||
| Smrss32 | .encrypted | _HOW_TO_Decrypt.bmp | ||||
| SNSLocker | .RSNSlocked .RSplited |
READ_Me.txt | AES (256) | |||
| Somik1 | . somik1 .arnoldmichel2 @ tutanota.com |
WARNING.txt, WARNING2.txt, WARNING3.txt ... | AES | |||
| Spora | [Infection-ID] |
|||||
| Sport | .sport | |||||
| Stampado | .locked | Zufällige Nachricht enthält eine Bitcoin-Adresse mit Anweisungen | Coded by "The_Rainmaker". Löscht zufällig alle 6 Stunden eine Datei und löscht nach 96 Stunden den Entschlüsselungsschlüssel. | AES(256) | Bleeping |
|
| Strictor | .locked | AES (256) | ||||
| Surprise | .surprise .tzu |
DECRYPTION_HOWTO .Notepad |
AES (256) | |||
| Survey | ThxForYur |
|||||
| SynoLocker | ||||||
| SZFLocker | .szf | AVG Decryptor | ||||
| TeamXrat | .___xratteam |
Como descriptografar os seus arquivos.txt | AES(256) | |||
| TeleCrypt | .xcri | Telecrypt erzeugt eine zufällige Zeichenfolge, die zwischen 10 und 20 Zeichen lang ist und nur die Buchstaben vo,pr,bm,xu,zt,dq enthält. | Malwarebytes Decrypter | |||
| TeslaCrypt0+ | .vvv .ecc .exx .ezz .abc .aaa .zzz .xyz |
HELP_TO_SAVE_ FILES.txt Howto_RESTORE _FILES.html |
TeslaCrypt Decryptor | |||
| TeslaCrypt 3.0+ | .micro .xxx .ttt .mp3 |
AES (256) + ECHD + SHA1 | ESET TeslaCrypt Decryptor | |||
| Thanksgiving | ||||||
| Threat Finder |
HELP_DECRYPT.HTML | |||||
| TorrentLocker | .Encrypted .enc |
HOW_TO_ DECRYPT_ DESIFROVANI_ INSTRUCCIONES_ ISTRUZIONI_ ENTSCHLUSSELN_ ONTSLEUTELINGS_ INSTRUCTIONS_DE_ SIFRE_COZME_ wie_zum_Wiederherstellen |
AES(256) | Bleeping |
||
| TowerWeb | Payment_ Instructions.jpg |
|||||
| Toxcrypt | .toxcrypt | tox.html | ||||
| Trojan | .braincrypt | !!! HOW TO DECRYPT FILES !!!.txt | Bleeping |
|||
| Troldesh | .better_call_saul .xtbl .da_vinci_code .windows10 |
READMEnumber.txt | AES (256) | |||
| TrueCrypter | .enc | AES (256) | ||||
| Trump Locker | .TheTrumpLockerf .TheTrumpLockerfp |
What happen to my files.txt | ||||
| Turkish | .sifreli | |||||
| Turkish (Fake CTB-Locker) | .encrypted | Beni Oku.txt | keys in '%name%.manifest.xml | |||
| Turkish Ransom | .locked | DOSYALARINIZA ULAŞMAK İÇİN AÇINIZ.html | AES(256) | |||
| UltraLocker | Basiert auf der Open-Source-Ransomware CryptoWire | AES(256) | ||||
| UmbreCrypt | .umbrecrypt | Emsisoft Decrypter | ||||
| UnblockUPC | Files encrypted.txt | |||||
| Ungluk | .H3LL .0x0 .1999 |
READTHISNOW!!!.txt Hellothere.txt YOUGOTHACKED.TXT |
Die Opfer sollen per Bitmessage Kontakt zum Betrüger aufnehmen | AES | ||
| Unlock26 | .locked-[XXX] | ReadMe-XXX.html | ||||
| Unlock92 | .CRRRT .CCCRRRPPP |
|||||
| Vanguard | GO Ransomware | |||||
| VapeLauncher | CryptoWire Variante | |||||
| VaultCrypt | .vault .xort .trun |
VAULT.txt xort.txt trun.txt random.hta | VAULT.hta |
Benutzt eine gpg.exe | |||
| VBRANSOM 7 | .VBRANSOM | Verschlüsselt nicht wirklich | ||||
| Venis Ransomware | VenisRansom |
|||||
| VenusLocker | .Venusf .Venusp |
ReadMe.txt | Basiert auf EDA2 | AES(256) | ||
| Vindows Locker | .vindows | AES | Malwarebytes Decrypter | |||
| Virlock | .exe | |||||
| Virus-Encoder | .CrySiS .xtbl |
How to decrypt your data.txt |
AES (256) | |||
| Vortex | .aes | |||||
| vxLock | .vxLock | |||||
| WannaCry | .wcry .wncry .WNCRY .WCRY |
@Please_ |
||||
| WildFire Locker | .wflx | HOW_TO_UNLOCK_ FILES_README_(ID.txt |
WildFire Decryptor | |||
| Winnix Cryptor | .wnx | YOUR FILES ARE ENCRYPTED!.txt | GPG | |||
| XCrypt | Xhelp.jpg | |||||
| XData | .~xdata~ | HOW_CAN_I_DECRYPT |
||||
| Xorist | .EnCiPhErEd .73i87A .p5tkjw .PoAr2w .fileiscryptedhard .0JELvV .6FKR8d .UslJ6m .n1wLp0 .5vypSa |
HOW TO DECRYPT FILES.TXT | XOR TEA |
Kaspersky Decrypter | ||
| XRTN | .xrtn | VaultCrypt Familie | ||||
| XYZWare | Basiert auf HiddenTear | |||||
| You Have Been Hacked!!! | .Locked | Versucht Passwörter zu stehlen | ||||
| YourRansom | .yourransom | README.txt | ||||
| Zcrypt | .zcrypt | |||||
| Zeta | .code .scl .rmd |
# HELP_DECRYPT_ |
||||
| Zimbra | .crypto | how.txt | mpritsken@ priest.com |
|||
| ZinoCrypt | .ZINO | ZINO_NOTE.TXT | ||||
| Zlader / Russian | .vault | VaultCrypt Familie | RSA | |||
| Zorro | .zorro | Take_Seriously (Your saving grace).txt | ||||
| zScreenLocker | ||||||
| Zyka | .locked | Bleeping |
||||
| Zyklon | .zyklon |