Ransomware Decryptor (Entschlüsselungs-Tools)

Ransomware
Unsere Liste enthält aktuell über 400 Ransomware-Varianten und dokumentiert die jeweils verwendeten Dateierweiterungen. Soweit verfügbar gibt es Links zu Decryptor (Entschlüsselungs-Tools), weiteren Informationen und Screenshots.
Bei Fragen stehen wir jederzeit kostenlos per E-Mail zur Verfügung.
Letzte Änderung am: 18.10.2020
Tipp: Alternativ können Sie mit der Web-App ID Ransomware herausfinden, von welcher bösartigen Ransomware-Variante Sie betroffen sind.
Ransomware | Dateiendungen | Lösegeldforderung | Merkmale | Verschlüsselung | Decryptor |
---|---|---|---|---|---|
.CryptoHasYou. | .enc | YOUR_FILES_ARE |
AES (256) | ||
$ ucyLocker | .WINDOWS | READ_IT.txt | |||
777 | .777 | read_this_file.txt | Lösegeld: 500 Dollar oder 1500 Dollar | XOR | Emsisoft Decrypter |
7ev3n | .R4A .R5A |
FILES_BACK.txt | Ändert das Desktop-Hintergrundbild | 7ev3n Decoder | |
7h9r | .7h9r | README_.TXT | 7h9r341@ |
AES | |
8lock8 | .8lock8 | READ_IT.txt | Basiert auf HiddenTear | AES (256) | HT Bruteforcer |
AESMewLocker AESMew |
.locked | READ_IT.txt | CONTACT_ME |
AES | |
AES_NI | .aes_ni .aes256 .aes_ni_0day |
!!! READ THIS - IMPORTANT !!!.txt | AES (256) | Avast Decryption Tool | |
AiraCrop | ._AiraCropEncrypted | How to decrypt your files.txt | |||
Alcatraz Locker | .Alcatraz | ransomed.html | AES (256) + Base64 | Avast Decryption Tool | |
Al-Namrood | .unavailable .disappeared |
How to decrypt your files.txt | Emsisoft Decrypter | ||
Alfa Ransomware | .bin | README HOW TO DECRYPT | Vom Hersteller der Cerber Ransomware | ||
Alma Ransomware | random | Unlock_files_randomx5.html | AES (128) | ||
Alphabet | Verschlüsselt keine Dateien / liefert Ihnen den Schlüssel | ||||
Alpha Ransomware | .encrypt | Read Me (How Decrypt)! | Eine neue Version der TeslaCrypt Ransomware. Lösegeld: 500 Dollar | AES (256) | Bleeping |
AMBA | .amba .R5A |
ПРОЧТИ_МЕНЯ.txt READ_ (Russisch) |
|||
Amnesia | .amnesia .CRYPTBOSS .01 .02 |
HOW TO RECOVER ENCRYPTED FILES.TXT | s1an1er111 |
Emsisoft Decrypter | |
Annabelle | .ANNABELLE | AES (256) | Bitdefender Decrypt Tool | ||
AnDROid | .android | Kaspersky Decrypter | |||
Angela Merkel | .angelamerkel | ||||
AngleWare | .AngleWare | READ_ME.txt | |||
Angry Duck | .adk | Fordert 10 BTC | |||
Anony | |||||
Anti-DDos | .f*cked | Bleeping |
|||
Anubis | .coded | Decryption Instructions.txt | EDA2 | AES (256) | |
Aura | Rakhni erstellt die Datei exit.hhr.oshit, die ein verschlüsseltes Kennwort enthält | Kaspersky Decrypter | |||
Apocalypse | .encrypted .SecureCrypted .FuckYourDat |
.How_To_Decrypt.txt | decryptionservice@ mail.ru recoveryhelp@bk.ru |
Emsisoft Decrypter | |
ApocalypseVM | .encrypted .locked .FuckYourData .Encryptedfile .SecureCrypted |
.How_To_Get_Back.txt | Die Ransomware nutzt VMprotect | Emsisoft Decrypter Avast Decryption Tool |
|
ASN1 | !!!!!readme!!!!!.htm | ||||
AutoLocky | .locky .locked |
info.txt info.html |
Programmiersprache AutoIt. Lösegeld: 0,75 Bitcoins | AES (128) | Emsisoft Decrypter |
Aurora | .Nano .animus .Aurora .desu .ONI .aurora | Emsisoft Decrypter | |||
AutoIt | Kaspersky Decrypter | ||||
AutoLocky | (Original Dateiname).locky | Info.html Info.txt |
AES (128) | Trend Micro File Decryptor | |
Aw3s0m3Sc0t7 | .enc | ||||
BadBlock | Die Dateierweiterung wird nicht geändert. | Help Decrypt.html | Fügt verschlüsselten Dateien keine Erweiterung hinzu | RSA | Emsisoft Decrypter Avast Decryption Tool |
BadEncript | .bript | More.html | |||
BaksoCrypt | .adr | Basiert auf my-Little-Ransomware | |||
Bandarchor | Dateien werden teilweise verschlüsselt | AES (256) | Emsisoft Decrypter | ||
BarRax | .BarRax | Basiert auf HiddenTear | BarRax Decryptor | ||
Bart | .bart.zip | recover.txt recover.bmp |
AES (256) | AVG Decrypter | |
BitCryptor | .clf | Neue CoinVault Variante | Kaspersky Decrypter | ||
BigBobRoss | .encryptedALL .djvu .obfuscated .cheetah |
Read Me.txt | RobSmithMba@ support@ |
AES (128) | Avast Decryption Tool |
BitKangaroo | .bitkangaroo | Bleeping |
|||
BitStak | .bitstak | Bleeping |
|||
BlackShades Crypter | .Silent | Hacked_Read_me_ to-decrypt_files.html YourID.txt |
AES (256) | ||
Blocatto | .blocatto | Basiert auf HiddenTear | AES (256) | ||
Booyah | .bitstak | ||||
Brazilian | .lock | MENSAGEM.txt | Basiert auf EDA2 | AES (256) | |
Brazilian Globe | HOW_OPEN_FILES.html | ||||
BrLock | .lock | AES | |||
Browlock | .lock | keine lokale Verschlüsselung, gesperrter Browser | |||
BTCWare | .btcware .cryptobyte .cryptowin .theva .onyon |
#_HOW_TO_FIX_!.hta | Verwandt mit / neue Version von CryptXXX | Avast Decryption Tool | |
Bucbi | .lock | Ändert keine Dateinamen | GOST | ||
BuyUnlockCode | BUYUNLOCKCODE.txt | Löscht keine Schattenkopien | |||
Central Security Treatment Organization | .cry | !Recovery_[random_ |
|||
Cerber 1 | .cerber | # DECRYPT MY FILES #.html # DECRYPT MY FILES #.txt # DECRYPT MY FILES #.vbs |
AES | Trend Micro File Decryptor | |
Cerber 2 | .cerber2 | Spricht mit den Opfern und ändert das Desktop-Hintergrundbild | |||
Cerber 3 | .cerber3 | # HELP DECRYPT #.txt | Spricht mit den Opfern | ||
CerberTear | |||||
Chernolocker | .CHERNOLOCKER .djvu .obfuscated .cheetah |
filelocker |
AES (256) | Emsisoft Decrypter | |
Chimera | .crypt | YOUR_FILES_ARE_ ENCRYPTED.HTML YOUR_FILES_ARE_ ENCRYPTED.TXT (random).gif |
Kaspersky Decrypter | ||
CHIP | .CHIP .DALE |
CHIP_FILES.txt DALE_FILES.TXT | |||
Click Me Game | |||||
Clock | Verschlüsselt nichts | ||||
CloudSword | Warning警告.html | ||||
Cockblocker | .hannah | ||||
CoinVault | .clf | wallpaper.jpg | Base64 + String Replacement | Kaspersky Decrypter | |
Coverton | .coverton .enigma .czvxce |
!!!-WARNING-!!!.html !!!-WARNING-!!!.txt |
AES (256) | ||
Creeper | .rag2hdst .creeper .cripper |
DECRIPT_Files.txt | Bezahlung per Monero Mail-Adresse: skgrhk2118 |
AES (CBC) | |
Cryptorbit | HowDecrypt.txt HowDecrypt.gif |
Bleeping |
|||
Crptxxx | .crptxxx | HOW_TO_FIX_!.txt | Verwendet den UAC-Bypass von @enigma0x3 | ||
CrypBoss | .crypt R16M01D05 |
Mail-Adresse: @dr.com | Emsisoft Decrypter | ||
Cryaki | .{CRYPTEN DBLACKDC} |
Kaspersky Decrypter | |||
Crybola | Kaspersky Decrypter | ||||
CryFile | .criptiko .criptoko .criptokod .cripttt .aga |
SHTODELATVAM.txt Instructionaga.txt |
Moves bytes | ||
CryLocker | .cry | !Recovery_ |
Identifiziert Opferstandorte mit der Google Maps API | ||
CrypMIC | README.TXT README.HTML README.BMP | CryptXXX clone/spinoff | AES (256) | ||
Crypren | .ENCRYPTED | READ_THIS_TO_ DECRYPT.html |
Decrypt Crypren | ||
Crypt38 | .crypt38 | AES | Bleeping |
||
CryptConsole | random | How decrypt files.hta | Gibt sich als Globe Ransomware aus. Verschlüsselt die Dateien nicht. | CryptConsole Decrypter | |
Cryptear | AES (256) | Recovering Anleitung | |||
Crypter | Verschlüsselt die Dateien nicht wirklich, sondern benennt sie lediglich um. | ||||
CryptFIle2 | .CRYPTOSHIELD .rdmk .lesli .scl .code .rmd .rscl |
RSA | Avast Decryption Tool | ||
CryptInfinite | .crinf | ReadDecrypt FilesHere.txt |
Emsisoft Decrypter | ||
CryptoBit | .crinf | OKSOWATHAPPEND TOYOURFILES.TXT |
AES & RSA | ||
CryptoBlock | RaaS | ||||
CryptoDefense | .crinf | HOW_DECRYPT.TXT HOW_DECRYPT.HTML HOW_DECRYPT.URL |
Emsisoft Decrypter | ||
CryptoDevil | .devil | ||||
CryptoFinancial | |||||
CryptoFortress | READ IF YOU WANT YOUR FILES BACK.html | Verschlüsselt 50% einer Datei. Maximale Dateigröße: 5 MB | AES (256), RSA (1024) | ||
CryptoGraphic Locker | wallpaper.jpg | AES (128) | |||
CryptoHasYou | .enc | YOUR_FILES_ARE_LOCKED | Der Entschlüsselungs-Preis erhöht sich alle 3 Tage um 150 Dollar | AES (256) | |
CryptoHost | Verbreitung per µ-Torrent-Client | AES (256) (RAR Implementierung) | Passwort Generator | ||
CryptoJoker | README!!!.txt GetYouFiles.txt crjoker.html |
AES (256) | |||
CryptoLocker | RSA (2048) | Kaspersky Decrypter (Rakhni Decryptor) | |||
CryptoLocker 1.0.0 | |||||
CryptoLocker 5.1 | |||||
CryptoLuck / YafunnLocker | .[victim_id]_luck | %AppData%\@WARNING_ |
via RIG EK | AES (256) | |
CryptoMix | HELP_YOUR_FILES.html (CryptXXX) HELP_YOUR_FILES.txt (CryptoWall 3.0, 4.0) |
RSA (2048) | CryptoMix Decryptor | ||
CryptON | _crypt .id-_locked .id-_locked_by_krec .id-_locked_by_perfect .id-_x3m .id-_r9oj .id-_garryweber .id-_steaveiwalker .id-_julia.crown .id-_tom.cruz .id-_CarlosBoltehero .id-_maria.lopez1 |
RSA, AES-256 and SHA-256 | Emsisoft Decrypter | ||
Crypto |
|||||
Cryptorium | .ENC | Benennt Dateien nur um und verschlüsselt sie nicht. | |||
CryptoRoger | !Where_are_my_ files!.html |
AES | |||
CryptoShadow | .doomed | LEER_INMEDIATAMENTE.txt | |||
CryptoShield | .CRYPTOSHIELD .rdmk .lesli .scl .code .rmd .rscl .MOLE |
# RESTORING FILES #.HTML # RESTORING FILES #.TXT | CryptoMix Variante | AES (256) / ROT-13 | Avast Decryption Tool |
CryptoShocker | ATTENTION.url | AES | |||
CryptoTor Locker2115 |
HOW TO DECRYPT FILES.txt %Temp%\(random).bmp |
AES | Decryption Anleitung | ||
CryptoTrooper | AES | ||||
CryptoWall 1 | DECRYPT_INSTRUCTION .HTML DECRYPT_INSTRUCTION .TXT DECRYPT_INSTRUCTION .URL INSTALL_TOR.URL |
||||
CryptoWall 2 | HELP_DECRYPT.TXT HELP_DECRYPT.PNG HELP_DECRYPT.URL HELP_DECRYPT.HTML |
||||
CryptoWall 3 | HELP_DECRYPT.TXT HELP_DECRYPT.PNG HELP_DECRYPT.URL HELP_DECRYPT.HTML |
||||
CryptoWall 4 | HELP_YOUR_FILES.HTML HELP_YOUR_FILES.PNG |
||||
CryptoWire | AES (256) | ||||
CryptXXX | .crypt | de_crypt_readme.bmp .txt .html |
Kaspersky Decrypter | ||
CryptXXX 2.0 | .crypt | personal-ID.txt .html .bmp |
Kaspersky Decrypter | ||
CryptXXX 3.0 | .crypt .cryp1 .crypz .cryptz random |
Kaspersky Decrypter | |||
CryptXXX 3.1 | .cryp1 | StilerX credential stealing | Kaspersky Decrypter | ||
Crypt888 | Lock. | Lösegeld |
AES | Microcop Decryptor | |
CryPy | .cry | README_FOR_DECRYPT.txt | AES | ||
CrySiS | .crysis .crypt .xtbl |
Eset CrySiS Decryptor | |||
CTB-Faker | |||||
CTB-Locker | .ctbl | AllFilesAreLocked-user_id-.bmp DecryptAllFiles-user_id-.txt (random).html |
Zufällige Dateierweiterungen | RSA (2048) | |
CTB-Locker WEB |
AES (256) | ||||
Cute |
.已加密 .encrypted | 你的檔案被我們加密啦!!!.txt Your files encrypted by our friends !!! txt | Basiert auf my-Little-Ransomware | AES (128) | Cute |
Cyber SpLiTTer Vbs | Basiert auf HiddenTear | ||||
Damage | .damage | Geschrieben in Delphi | SHA-1 und Blowfish | Emsisoft Decrypter | |
Dharma | .dharma .wallet .zzzzz .adobe |
README.txt README.jpg Info.hta | CrySiS Variante | Kaspersky Decrypter | |
Deadly for a Good Purpose | |||||
Death Bitches | .locked | READ_IT.txt | |||
DeCrypt Protect | .html | Decrypt_ |
|||
DEDCryptor | .ded | Basiert auf EDA2 | AES-256 | ||
Demo | .encrypted | HELP_YOUR_FILES.txt | Verschlüsselt nur .jpg-Dateien | ||
Depsex | .Locked-by-Mafia | READ_ME.txt | Basiert auf HiddenTear | ||
DeriaLock | .deria | unlock-everybody.txt | "Unlock All" Anleitung | ||
DetoxCrypto | AES | ||||
Digisom | Digisom Readme0.txt (0 to 9) | ||||
DirtyDecrypt | Emsisoft Decrypter | ||||
DMALocker | cryptinfo.txt decrypting.txt start.txt |
Die verschlüsselten Dateien enthalten die folgenden Präfixe: Version 1: ABCXYZ11 Version 2: !DMALOCK Version 3: !DMALOCK3.0 Version 4: !DMALOCK4.0 |
AES (256) Version 2-4 auch RSA |
Emsisoft Decrypter | |
DMALocker 3.0 |
Dateityp wird nicht geändert | AES (256) | Emsisoft Decrypter | ||
DNRansomware | .fucked | Code zum entschlüsseln: 83KYG9NW-3K39V-2T3HJ-93F3Q-GT | |||
Domino | .domino | README_TO_RECURE_ |
Basiert auf Hidden Tear | AES (256) | |
Donald Trump | .ENCRYPTED | AES | |||
DoNotChange | .id-7ES642406.cry .Do_not_change_ |
HOW TO DECODE FILES!!!.txt КАК РАСШИФРОВАТЬ ФАЙЛЫ!!!.txt | AES (128) | ||
DummyLocker | .dCrypt | ||||
DXXD | .dxxd | ReadMe.TxT | Trend Micro File Decryptor | ||
DynA-Crypt | .crypt | ||||
HiddenTear | .locked .34xxx .bloccato .BUGSECCCC .Hollycrypt .lock .saeid .unlockit .razy .mecpt .monstro .lok .암호화됨 .8lock8 .fucked .flyper .kratos .drypted .CAZZO .doomed |
READ_IT.txt MSG_FROM_SITULA.txt DECRYPT_YOUR_ |
AES (256) | Avast Decryption Tool | |
EdgeLocker | .edgel | ||||
EduCrypt | .isis .locked |
README.txt | Basiert auf Hidden Tear | ||
EiTest | .crypted | ||||
El-Polocker | .ha3 | qwer.html qwer2.html locked.bmp |
|||
Encoder.xxxx | Instructions.html | Coded in GO | |||
encryptoJJS | .enc | How to recover.enc | |||
Enigma | .enigma | enigma.hta enigma_encr.txt |
AES (128) | ||
Enjey | Basiert auf RemindMe | ||||
EnkripsiPC | .fucked | Das Verschlüsselungs-Passwort basiert auf dem Computernamen | |||
EncrypTile | (Dateiname) |
Decrypt_[victim's_id].txt Decrypt_[victim's_id].html Decrypt_[victim's_id].bmp How to buy bitcoin_[victim's_id].txt |
deposithere@ |
AES | Avast Decryption Tool |
Erebus | README.HTML | AES | |||
Everbe | .insane .DUESCRYPT .deuscrypt .Tornado .twist .everbe .embrace .pain .volcano |
Bleeping |
|||
Evil | .file0locked .evillock | In Javascript programmiert | |||
Exotic | .exotic | Verschlüsselt auch ausführbare Dateien | AES (128) | ||
Fabiansomware | .encrypted | How_To_Decrypt.txt | Emsisoft Decrypter | ||
FabSysCrypto | Basiert auf HiddenTear | ||||
Fadesoft | |||||
Fairware | Attackiert Linux O.S. | ||||
Fakben | .locked | READ ME FOR DECRYPT.txt | Basiert auf Hidden Tear | ||
FakeGlobe aka GlobeImposter | .crypt | HOW_OPEN_FILES.hta | Emsisoft Decrypter | ||
FakeCrypto |
.cryptolocker | ||||
Fantom | .fantom .comrade |
DECRYPT_YOUR_FILES.HTML RESTORE-FILES![id] | Basiert auf EDA2 | AES (128) | |
FenixLocker | .FenixIloveyou!! | Help to decrypt.txt | Emsisoft Decrypter | ||
FILE FROZR | RaaS | ||||
FileLocker | .ENCR | ||||
FindZip | .crypt | DECRYPT.txt HOW_TO_DECRYPT.txt README.txt |
Avast Decryption Tool | ||
FireCrypt | .firecrypt | [random_chars]- |
AES (256) | ||
Flyper | .locked | Basiert auf EDA2 / HiddenTear | |||
Fonco | Mailkontakt: safefiles32@mail.ru | ||||
FortuneCookie | |||||
Free-Freedom | .madebyadam | Code zur ENtschlüsselung lautet: adam or adamdude9 | |||
FSociety | .fs0ciety .dll |
fs0ciety.html DECRYPT_YOUR_ |
Basiert auf EDA2 und auf RemindMe | ||
Fury | Kaspersky Decrypter | ||||
Geneve | Zufällig (Beispiel: .fezmm) | DECRYPT.html | AES (256) + RSA (2048) | ||
GhostCrypt | .Z81928819 | AES (256) | Bleeping |
||
Gingerbread | |||||
Globe v1 | .purge | How to restore files.hta | Blowfish | Trend Micro File Decryptor | |
Globe v2 | .lovewindows .openforyou |
Blowfish | Trend Micro File Decryptor | ||
Globe v3 | .[random].blt .[random].encrypted .[random].raid10 .[mia.kokers@ .[random].globe .unlockvt@india.com .rescuers@ .lock .locked .decrypt2017 .hnumkhotep |
Extesion depends on the config file. It seems Globe is a ransomware kit. | RC4 AES (256) | Emsisoft Decrypter | |
GNL Locker | .locked | UNLOCK_FILES_ INSTRUCTIONS.html |
AES (256) | ||
GOG | .L0CKED | DecryptFile.txt | |||
Gomasom | .crypt | Mail-Adresse im Dateinamen | Emsisoft Decrypter | ||
Goopic | Your files have been crypted.html | ||||
Gopher | OS X ransomware (PoC) | ||||
GandCrab | .GDCB .CRAB .KRAB .%Random |
GDCB-DECRYPT.txt CRAB-DECRYPT.txt KRAB_DECRYPT.txt %RandomLetters%-DECRYPT.txt %RandomLetters%-MANUAL.txt |
Avast Decryption Tool | ||
GetCrypt | # DECRYPT MY FILES #.txt | Hängt eine zufällige 4-Zeichen-Erweiterung an Dateien an. | Emsisoft Decrypter | ||
Gremit | .rnsmwr | ||||
Guster | .locked | ||||
Hacked | .versiegelt .encrypted .payrmts .locked .Locked |
Jigsaw Ransomware Variante | |||
HappyDayzz | 3DES AES (128) AES (192) AES (256) DES RC2 RC4 | ||||
Harasom | .html | Emsisoft Decrypter | |||
HDDCryptor | Verwendet diskcryptor.net für die vollständige Festplatten-Verschlüsselung | Custom (net shares), XTS-AES (disk) | |||
Heimdall | File marker: Heimdall--- | AES-128-CBC | |||
Help_dcfile | .XXX | help_dcfile.txt | |||
Herbst | .herbst | ||||
Hermes | DECRYPT_INFORMATION.html UNIQUE_ID_DO_ |
Filemarker: "HERMES" | AES | ||
Hi Buddy! | .cry | AES (256) | |||
Hitler | Löscht Dateien | ||||
HKCrypt | .hacked | @readme_English.txt How_to_decrypt_files.txt |
RSA (4096) | Emsisoft Decrypter | |
HolyCrypt | (encrypted) | AES | |||
HTCryptor | Enthält eine Funktion zur Deaktivierung der Windows-Firewall | ||||
Hucky | .locky | _Adatok_visszaallitasahoz_ |
Basiert auf Locky | AES, RSA | |
HydraCrypt | README_DECRYPT_ HYRDA_ID_ [ID number].txt |
CrypBoss Familie | Emsisoft Decrypter | ||
IFN643 | |||||
iLock | .crime | ||||
iLockLight | .crime | ||||
ImS00rry | Fügt keine Erweiterung hinzu. | README | Das Opfer wird gebeten, die Kriminellen über Telegramm (@Ims00rybot) zu kontaktieren. | AES (128) | Emsisoft Decrypter |
InsaneCrypt | .[everbe@airmail.cc] .everbe .embrace .pain |
!=How_recovery |
Bleeping |
||
International Police Association |
%Temp%-random-.bmp | Bleeping |
|||
iRansom | .Locked | ||||
Jack.Pot | |||||
Jager |
!ENC | Important_Read_Me.html | Dateinamen werden vorangestellt | ||
JapanLocker | Base64-Kodierung, ROT13 und Top-Bottom-Swapping | ||||
Jeiphoos | |||||
Jhon Woddy | .killedXXX | Der selbe Code wie bei der der DNRansomware. Sperrbildschirm-Kennwort lautet: M3VZ>5BwGGVVH | Bleeping |
||
Jigsaw | .kkk .btc .gws .J .encrypted .porno .payransom .pornoransom .epic .xyz .versiegelt .encrypted .payb .payb .pays .payms .paymds ,paymts .payrms .payrmts .paymrts .paybtcs .fun .hush .uk-dealer@sigaint.org .gefickt |
AES (256) | Avast Decryption Tool | ||
Job Crypter | .locked .css |
Comment débloquer mes fichiers.txt Readme.txt |
TripleDES | ||
JohnyCryptor | |||||
Juicy Lemon | .id-{number}_maestro |
Bleeping |
|||
Kaandsona | .kencf | Stürzt ab, bevor es verschlüsselt | |||
Kangaroo | .crypted_file | filename.Instructions_ |
Von den Entwicklern hinter der Apokalypse Ransomware, Fabiansomware und Esmeralda | ||
Karma | .karma | # DECRYPT MY FILES #.html # DECRYPT MY FILES #.txt | Gibt vor, das Windows-Programm Windows-TuneUp zu sein | AES | |
Karmen | .grt | RaaS basiert auf HiddenTear | |||
Kasiski | [KASISKI] | INSTRUCCIONES.txt | |||
KawaiiLocker | How Decrypt Files.txt | Kawaii Decrypter | |||
KeRanger | .encrypted | OS X Ransomware | AES | Decryption Anleitung | |
KeyBTC | keybtc@inbox_com | DECRYPT_YOUR_FILES.txt READ.txt readme.txt |
Emsisoft Decrypter | ||
KEYHolder | how_decrypt.gif how_decrypt.html |
tuyuljahat@hotmail .com |
|||
KillDisk | AES (256) | ||||
KillerLocker | .rip | Möglicherweise ein portugiesischer Entwickler | |||
KimcilWare | .kimcilware .locked |
Infiziert Webseiten | AES | ||
Kirk | .Kirked | RANSOM_NOTE.txt | Bezahlung in Monero | ||
Koolova | Italienischer Text, der es nur auf den Ordner "Test" auf dem Desktop des Benutzers abzielt | ||||
Korean | .암호화됨 | ReadMe.txt | Basiert auf HiddenTear | AES (256) | |
Kostya | .kostya | ||||
Kozy.Jozy | .31392E30362E 32303136 _[ID-KEY]_LSBJ1 |
w.jpg | RSA (2048) | ||
Kraken | .kraken | _HELP_YOUR_FILES.html | |||
KratosCrypt | .kratos | README_ALL.html | |||
KRider | .kr3 | ||||
KryptoLocker | KryptoLocker_ README.txt |
AES (256) | |||
Lambda |
.lambda_l0cked .MyChemical |
READ_IT.hTmL | Python Ransomware | AES (256) | Avast Decryption Tool |
LanRan | @__help__@ | Variante der Open-Source Ransomware MyLittle |
|||
LeChiffre | .LeChiffre | How to decrypt LeChiffre files.html | Mail-Adresse: decrypt.my.files@ gmail.com |
Emsisoft Decrypter | |
Legion | ._23-06-2016-20-27-23_$f .$centurion_ |
Ändert das Desktop-Hintergrundbild | Avast Decryption Tool | ||
Lick | .Licked | RANSOM_NOTE.txt | Variant of Kirk | ||
Linux.Encoder | Linux Ransomware | Bit |
|||
LK Encryption | Basiert auf HiddenTear | ||||
LLTP Locker | .ENCRYPTED_ .ENCRYPTED_ |
LEAME.txt | Zielgruppe: Spanisch sprechende Opfer | AES-256 | |
LockCrypt | .lock | ReadMe.TxT | |||
Locked-In | RESTORE_CORUPTED_ |
Basiert auf RemindMe | Anleitung | ||
Locker | Ändert den Dateityp nicht | Locker |
|||
LockerAdmin | .$$$ | readme.txt | AES | ||
LockLock | .locklock | READ_ME.TXT | AES (256) | ||
Locky | .locky .zepto |
_Locky_recover_ instructions.txt _Locky_recover_ instructions.bmp _HELP_instructions.txt _HELP_instructions.bmp |
AES (128) | ||
Lock93 | .lock93 | ||||
Lomix | Basiert auf die Open-Source Ransomware CryptoWire | ||||
Lortok | .crime | ||||
LowLevel04 | oor. | ||||
M4N1F3STO | Verschlüsselt nicht. Freischaltcode: suckmydicknigga | ||||
Mabouia | OS X ransomware (PoC) | ||||
MacAndChess | Basiert auf HiddenTear | ||||
Magic | .magic | DECRYPT_ReadMe1.TXT DECRYPT_ReadMe.TXT |
Basiert auf EDA2 | AES (256) | |
MaktubLocker | _DECRYPT_INFO_ [extension pattern].html |
AES (256) RSA (2048) |
|||
Marlboro | .oops | _HELP_Recover_Files_.html | XOR | Emsisoft Decrypter | |
MarsJoke | .a19 .ap19 |
!!! Readme For Decrypt !!!.txt ReadMeFilesDecrypt!!!.txt | Kaspersky Anleitung | ||
MasterBuster | CreatesReadThis |
||||
Matrix | [5 numbers]- |
GnuPG | |||
Meister | Hat Französische Nutzer im Visier | ||||
Merry X-Mas! | .PEGS1 .MRCR1 .RARE1 .MERRY .RMCM1 |
YOUR_FILES_ |
Geschrieben in Delphi | Emsisoft Decrypter | |
Meteoritan | where_are_your_files.txt readme_your_files_ |
||||
MIRCOP | Lock. | Lösegeld |
AES | Microcop Decryptor | |
MireWare | .fucked .fuck |
READ_IT.txt | AES (256) | ||
Mischa | 3P7m .arpT .eQTz .3RNu |
YOUR_FILES_ARE _ENCRYPTED.HTML YOUR_FILES_ARE _ENCRYPTED.TXT |
|||
MM Locker | .locked | READ_IT.txt | AES (256) | ||
Mobef | .KEYZ .KEYH0LES |
4-14-2116- INFECTION.TXT IMPORTANT.README |
|||
Mole | .mole .mole02 |
INSTRUCTION_FOR_ |
Mole02 Decryptor | ||
Monument | |||||
MOTD | .enc | motd.txt | |||
MSN CryptoLocker | RESTORE_YOUR_FILES.txt | ||||
n1n1n1 | decrypt explanations.html | Filemaker: "333333333333" | |||
N-Splitter | .кибер разветвитель | Russische Koolova-Variante | |||
Nagini | |||||
NanoLocker | ATTENTION.RTF | Ändert den Dateityp nicht | AES (256) RSA |
NanoLocker Decrypter | |
Nemucod | .crypted | Decrypted.txt | XOR (255) 7zip |
Emsisoft Decrypter | |
Nemucod | .crypted | Decrypted.txt | 7zip (a0.exe)-Variante kann nicht entschlüsselt werden. Verschlüsselt die ersten 2048 Bytes | XOR(255) 7zip | |
Netix | AES (256) | ||||
Nhtnwcuf | !_RECOVERY_HELP_!.txt HELP_ME_PLEASE.txt | Verschlüsselt die Dateien nicht / Dateien werden zerstört | |||
NMoreira | .maktub .__AiraCrop .aac |
Recupere seus arquivos. Leia-me!.txt Learn how to recover your files.txt | RSA und AES-256 | Emsisoft Decrypter | |
NoobCrypt | ransomed.html | Avast Decryption Tool | |||
Nuke | .nuclear55 | !!_RECOVERY_ |
AES | ||
Nullbyte | _nullbyte | Bleeping |
|||
Ocelot | Verschlüsselt nichts | ||||
ODCODC | .odcodc | XOR | Bleeping |
||
Offline ransomware | .cbf | desk.bmp desk.jpg |
.777 E-Mail Adresse | Kaspersky Decrypter | |
OMG! Ransomware | .LOL! .OMG! |
how to get data.txt | |||
Onyx | Georgische Ransomware | ||||
Operation Global III | .EXE | Decryption Tool | |||
Owl | dummy_ |
log.txt | |||
OzozaLocker | .Locked | HOW TO DECRYPT YOU FILES.txt | Emsisoft Decrypter | ||
Pashka | .pashka | HELP_ME_RECOVER _MY_FILES.txt |
AES | ||
PadCrypt | .padcrypt | IMPORTANT READ ME.txt File Decrypt Help.html |
Enthält einen Live Support Chat | ||
Padlock Screenlocker | Ensperr-Code: ajVr/G\RJz0R | ||||
Patcher | .crypt | README!.txt | Ausgerichtet auf MacOS-Benutzer | Anleitung | |
PayDay | .sexy | !!!!!ATENÇÃO!!!!!.html | Basiert auf Hidden-Tear | ||
PayDOS | Batch-Datei Passcode: AES1014DW256" | ||||
Paysafecard Generator 2016 | .cry_ | ||||
PClock | Your files are locked !.txt Your files are locked !!.txt Your files are locked !!!.txt Your files are locked !!!!.txt %AppData%\WinCL\ |
CryptoLocker-Nachahmer | XOR | Emsisoft Decrypter | |
PetrWrap | |||||
Petya | Sperrt den kompletten Computer | Passwort Decrypter | |||
Philadelphia | .locked | Programmiert von "The_Rainmaker" | AES (256) | Emsisoft Decrypter | |
Phobos | .phobos | Überarbeitete Dharma Ransomware | |||
Phoenix | .R.i.P | Important!.txt | Basiert auf HiddenTear | ||
Pickles | .EnCrYpTeD | READ_ME_TO_DECRYPT.txt | Python Ransomware | ||
PizzaCrypts | .id-[victim_id]- maestro@pizzacrypts .info |
Bleeping |
|||
PokemonGO | .locked | Basiert auf Hidden Tear | AES (256) | ||
Popcorn Time | .filock | restore_your_files.html restore_your_files.txt | AES (256) | ||
Polyglot | Immitates CTB-Locker | AES (256) | Kaspersky Decrypter | ||
Potato | .potato | README.png README.html | AES (256) | ||
PowerWare | Bleeping |
||||
PowerWorm | DECRYPT_INSTRUCTION.html looks like CryptoWall 3, but with additional warnings at the bottom that ransom price will go up after some time | keine Entschlüsselung möglich | AES, wirft aber die Schlüssel weg und vernichtet die Dateien | ||
Princess Locker | !_HOW_TO_RESTORE_ |
Princess Locker Decryptor | |||
PRISM | |||||
Project34 | ПАРОЛЬ.txt | ||||
ProposalCrypt | .crypted | Proposal |
|||
Ps2exe | |||||
PyL33T | .d4nk | Python Ransomware | |||
Pylocky | RANSOM_PYLOCKY.A | PyLocky Decryptor | |||
R | Ransomware.txt | ||||
R980 | .crypt | DECRYPTION INSTRUCTIONS.txt rtext.txt | |||
RAA encryptor | .locked | !!!README!!![id].rtf | |||
Rabion | RaaS-Kopie von Ranion RaaS | ||||
Radamant | .RDM .RRK .RAD .RADAMANT |
YOUR_FILES.url | AES (256) | Emsisoft Decrypter | |
Rakhni | .locked .kraken .darkness .nochance .oshit .oplata@qq_com .relock@qq_com .crypto .helpdecrypt@ukr.net .pizda@qq_com .dyatel@qq_com _ryp .nalog@qq_com .chifrator@qq_com .gruzin@qq_com .troyancoder .encrypted .cry .AES256 .enc .hb15 |
startup folder\fud.bmp startup folder\paycrypt.bmp startup folder\strongcrypt.bmp startup folder\maxcrypt.bmp or a similar named bmp in the startup folder %APPDATA%\Roaming\ random name.bmp is set as wallpaper | Files might be partially encrypted | Kaspersky Decrypter | |
Ramsomeer | Basiert auf DUMB | ||||
Ranion | RaaS Service | AES (256) | |||
Rannoh | Kaspersky Decrypter | ||||
RanRan | .zXz | VictemKey_ |
RanRan Decryption | ||
Ransoc | Verschlüsselt keine Benutzerdateien | ||||
Ransom32 | |||||
Rector | .vscrypt .infected .bloc .korrektor |
Kaspersky Decrypter | |||
RedRum | .id-.[].redrum | decryption.txt | RSA (1024) | Emsisoft Decrypter | |
RemindMe | .remind | decypt_your_files.html | |||
Rokku | .rokku | README_HOW_TO_ UNLOCK.TXT README_HOW_TO_ UNLOCK.HTML |
Curve 25519 + ChaCha | ||
Samas-Samsam | .encryptedAES .encryptedRSA .encedRSA .justbtcwillhelpyou .btcbtcbtc .btc-help-you .only-we_can-help_you .iwanthelpuuu |
HELP_DECRYPT_YOUR _FILES.html |
AES (256) + RSA (2096) | Bleeping |
|
Sanction | .sanction | DECRYPT_YOUR_ FILES.HTML |
AES (256) + RSA (2096) | ||
Sanctions | .wallet | RESTORE_ALL |
AES (256) + RSA (2048) | ||
Sardoninir | .enc | ||||
Satan | .stn | HELP_DECRYPT |
RaaS | AES (256) + RSA (2096) | |
Satana | Sarah_G@ |
!satana!.txt | |||
Scraper | Ändert den Dateityp nicht | Scraper Decryptor | |||
SerbRansom | .velikasrbija | ||||
Serpent | .serpent | HOW_TO_DECRYPT_ HOW_TO_DECRYPT_ |
Batch-Datei Passcode: RSA1014DJW2048 | AES (256) | |
Serpico | DetoxCrypto Variante | AES | |||
Shade (Troldesh) | xtbl ytbl breaking_bad heisenberg better_call_saul los_pollos da_vinci_code magic_software_ windows10 windows8 no_more_ransom tyson crypted000007 crypted000078 rsa3072 decrypt_it dexter miami_california. |
README{1-10}.txt | AES (256) | Kaspersky Decrypter | |
Shark | .locked | Readme.txt | AES (256) | ||
ShellLocker | .L0cked | ||||
ShinoLocker | .shino | ||||
Shujin | 文件解密帮助.txt | ||||
Simple_ |
.~ | _RECOVER_ |
AES | ||
SkidLocker / Pompous | .locked | READ_IT.txt | AES (256) | Decryption Anleitung | |
SkyName | Basiert auf HiddenTear | ||||
Smash! | |||||
Smrss32 | .encrypted | _HOW_TO_Decrypt.bmp | |||
SNSLocker | .RSNSlocked .RSplited |
READ_Me.txt | AES (256) | ||
Somik1 | . somik1 .arnoldmichel2 @ tutanota.com |
WARNING.txt, WARNING2.txt, WARNING3.txt ... | AES | ||
SpartCrypt | .SpartCrypt .CoronaCrypt |
Emsisoft Decrypter | |||
Spora | [Infection-ID] |
||||
Sport | .sport | ||||
Stampado | .locked | Zufällige Nachricht enthält eine Bitcoin-Adresse mit Anweisungen | Coded by "The_Rainmaker". Löscht zufällig alle 6 Stunden eine Datei und löscht nach 96 Stunden den Entschlüsselungschlüssel. | AES (256) | Bleeping |
Strictor | .locked | AES (256) | |||
Striked |
.Andrey.gorlachev .nukem .rap .m.pirat .duk .jekabro .bitcoin |
Bleeping |
|||
Surprise | .surprise .tzu |
DECRYPTION_HOWTO .Notepad |
AES (256) | ||
Survey | ThxForYur |
||||
SynoLocker | |||||
SZFLocker | .szf | AVG Decryptor | |||
TeamXrat | .___xratteam |
Como descriptografar os seus arquivos.txt | AES (256) | ||
TeleCrypt | .xcri | Telecrypt erzeugt eine zufällige Zeichenfolge, die zwischen 10 und 20 Zeichen lang ist und nur die Buchstaben vo,pr,bm,xu,zt,dq enthält. | Malwarebytes Decrypter | ||
TeslaCrypt0+ | .vvv .ecc .exx .ezz .abc .aaa .zzz .xyz |
HELP_TO_SAVE_ FILES.txt Howto_RESTORE _FILES.html |
TeslaCrypt Decryptor | ||
TeslaCrypt 3.0+ | .micro .xxx .ttt .mp3 |
AES (256) + ECHD + SHA1 | ESET TeslaCrypt Decryptor | ||
Thanatos | .THANATOS | AES (256) | Thanatos Decryptor | ||
Thanksgiving | |||||
Threat Finder |
HELP_DECRYPT.HTML | ||||
TorrentLocker | .Encrypted .enc |
HOW_TO_ DECRYPT_ DESIFROVANI_ INSTRUCCIONES_ ISTRUZIONI_ ENTSCHLUSSELN_ ONTSLEUTELINGS_ INSTRUCTIONS_DE_ SIFRE_COZME_ wie_zum_Wiederherstellen |
AES (256) | Bleeping |
|
TowerWeb | Payment_ Instructions.jpg |
||||
Toxcrypt | .toxcrypt | tox.html | |||
Trojan | .braincrypt | !!! HOW TO DECRYPT FILES !!!.txt | Bleeping |
||
Troldesh | .better_call_saul .xtbl .da_vinci_code .windows10 |
READMEnumber.txt | AES (256) | ||
TrueCrypter | .enc | AES (256) | |||
Trump Locker | .TheTrumpLockerf .TheTrumpLockerfp |
What happen to my files.txt | |||
Turkish | .sifreli | ||||
Turkish (Fake CTB-Locker) | .encrypted | Beni Oku.txt | keys in '%name%. |
||
Turkish Ransom | .locked | DOSYALARINIZA ULAŞMAK İÇİN AÇINIZ.html | AES (256) | ||
UltraLocker | Basiert auf der Open-Source-Ransomware CryptoWire | AES (256) | |||
UmbreCrypt | .umbrecrypt | Emsisoft Decrypter | |||
UnblockUPC | Files encrypted.txt | ||||
Ungluk | .H3LL .0x0 .1999 |
READTHISNOW!!!.txt Hellothere.txt YOUGOTHACKED.TXT |
Die Opfer sollen per Bitmessage Kontakt zum Betrüger aufnehmen | AES | |
Unlock26 | .locked-[XXX] | ReadMe-XXX.html | |||
Unlock92 | .CRRRT .CCCRRRPPP |
||||
Vanguard | GO Ransomware | ||||
VapeLauncher | CryptoWire Variante | ||||
VaultCrypt | .vault .xort .trun |
VAULT.txt xort.txt trun.txt random.hta | VAULT.hta |
Benutzt eine gpg.exe | ||
VBRANSOM 7 | .VBRANSOM | Verschlüsselt nicht wirklich | |||
Venis Ransomware | VenisRansom |
||||
VenusLocker | .Venusf .Venusp |
ReadMe.txt | Basiert auf EDA2 | AES (256) | |
Vindows Locker | .vindows | AES | Malwarebytes Decrypter | ||
Virlock | .exe | ||||
Virus-Encoder | .CrySiS .xtbl |
How to decrypt your data.txt |
AES (256) | ||
Vortex | .aes | ||||
vxLock | .vxLock | ||||
WannaCry | .wcry .wncry .WNCRY .WCRY |
@Please_ |
|||
WildFire Locker | .wflx | HOW_TO_UNLOCK_ FILES_README_(ID.txt |
Kaspersky Decrypter | ||
Winnix Cryptor | .wnx | YOUR FILES ARE ENCRYPTED!.txt | GPG | ||
XCrypt | Xhelp.jpg | ||||
XData | .~xdata~ | HOW_CAN_I_DECRYPT |
Avast Decryption Tool | ||
Xorist | .EnCiPhErEd .73i87A .p5tkjw .PoAr2w .fileiscryptedhard .0JELvV .6FKR8d .UslJ6m .n1wLp0 .5vypSa |
HOW TO DECRYPT FILES.TXT | XOR TEA |
Kaspersky Decrypter | |
XRTN | .xrtn | VaultCrypt Familie | |||
XYZWare | Basiert auf HiddenTear | ||||
You Have Been Hacked!!! | .Locked | Versucht Passwörter zu stehlen | |||
YourRansom | .yourransom | README.txt | |||
Zcrypt | .zcrypt | ||||
Zeta | .CRYPTOSHIELD .rdmk .lesli .scl .code .rmd .rscl |
# HELP_DECRYPT_ |
AES (256) | Avast Decryption Tool | |
Zimbra | .crypto | how.txt | mpritsken@ priest.com |
||
ZinoCrypt | .ZINO | ZINO_NOTE.TXT | |||
Zlader / Russian | .vault | VaultCrypt Familie | RSA | ||
Zorro | .zorro | Take_Seriously (Your saving grace).txt | |||
zScreenLocker | |||||
Zyka | .locked | Bleeping |
|||
Zyklon | .zyklon |
Decryptor / Entschlüsselungstools
Avast Decryption Tool

AES_NI, Alcatraz Locker, ApocalypseVM, BadBlock, BigBobRoss, BTCWare, CryptFIle2, CryptoShield, HiddenTear, EncrypTile, FindZip, GandCrab, Jigsaw, LambdaLocker, Legion, NoobCrypt, XData, Zeta.
Bleepingcomputer Decrypter

Alpha Ransomware (Alpha
Zum Download-Center von Bleepingcomputer: https://www.bleepingcomputer.com/download/windows/ransomware-decryptors/
Emsisoft Decrypter

777, Al-Namrood, Amnesia, Apocalypse, ApocalypseVM, Aurora, AutoLocky, BadBlock, Bandarchor, CrypBoss, CryptInfinite, CryptoDefense, CryptON, Damage, DirtyDecrypt, DMALocker, DMALocker 3.0, Fabiansomware, FakeGlobe aka GlobeImposter, FenixLocker, Globe v3, Gomasom, GetCrypt, Harasom, HKCrypt, HydraCrypt, ImS00rry, KeyBTC, LeChiffre, Marlboro, Merry X-Mas!, Nemucod, NMoreira, OzozaLocker, PClock, Philadelphia, Radamant, RedRum, SpartCrypt, UmbreCrypt.
Kaspersky Decrypter

BitCryptor, CoinVault, Cryaki, Crybola, CryptoLocker, CryptXXX, CryptXXX 2.0, CryptXXX 3.0, CryptXXX 3.1, Dharma, Fury, MarsJoke, Offline ransomware, Polyglot, Rakhni, Rannoh, Rector, Shade (Troldesh), WildFire Locker, Xorist.
Download: https://noransom.kaspersky.com/
Trend Micro File Decryptor

AutoLocky, Cerber 1, DXXD, Globe v1, Globe v2.