360 Ransomware Decryption Tool 1.0.0.1271 [free _VERIFIED

Decrypts files affected by Rakhni, Agent.iih, Aura, Autoit, Pletor, Rotor, Lamer, Cryptokluchen, Lortok, Democry, Bitman, TeslaCrypt (version 3 and 4), Chimera, Crysis (versions 2 and 3), Jaff, Dharma, new versions of Cryakl ransomware, Yatron, FortuneCrypt, Fonix, Maze, Sekhmet, Egregor, Conti.

The Al-Namrood ransomware is a fork of the Apocalypse ransomware. The group behind it primarily attacks servers that have remote desktop services enabled. Encrypted files are renamed to .unavailable or .disappeared and for each file a ransom note is created with the name *.Read_Me.Txt. The ransomware asks the victim to contact "[email protected]" or "[email protected]". To decrypt your files the decrypter requires your ID. The ID can be set within the "Options" tab. By default the decrypter will set the ID to the ID that corresponds to the system the decrypter runs on. However, if that is not the same system the malware infection and encryption took place on, make sure to put in the ID as specified in the ransom note.

360 Ransomware Decryption Tool 1.0.0.1271 [Free]

Download File 🔥 https://urllie.com/2xYcVm 🔥

Amnesia is a ransomware written in the Delphi programming language that encrypts your files using the AES-256 encryption algorithm. Encrypted files get renamed to *.amnesia and a ransom note is called "HOW TO RECOVER ENCRYPTED FILES.TXT" and asks you to contact "s[email protected]". It can be found on your Desktop.

Amnesia2 is a ransomware written in the Delphi programming language that encrypts your files using the AES-128 encryption algorithm. Encrypted files get renamed to *.amnesia and a ransom note is called "HOW TO RECOVER ENCRYPTED FILES.TXT" and asks you to contact "s[email protected]". It can be found on your Desktop.

AstraLocker is a ransomware based on the leaked Babuk source code, and encrypts files using a modified HC-128 encryption algorithm, and Curve25519. The extension ".Astra" or ".babyk" is appended to files.

Aurora is a ransomware family that encrypts files using XTEA and RSA, and may also be known as "Zorro", "Desu", or "AnimusLocker". Known extensions include ".Aurora", ".aurora", ".animus", ".ONI", ".Nano", ".cryptoid", ".peekaboo", ".isolated", ".infected", ".locked", ".veracrypt", ".masked", ".crypton", ".coronolock", ".bukyak", ".serpom", and ".systems32x".

Use this decrypter if your files have been encrypted but not renamed. The malware identifies itself as BadBlock both in the red ransomware screen as well as in the ransomnote "Help Decrypt.html" that can be found on the Desktop.

BigBobRoss is a ransomware written in C++ using QT. It uses AES-128 ECB to encrypt files, and adds the extension ".obfuscated", ".encryptedALL", or ".cheetah". The ransom note "Read Me.txt" asks the victim to contact "[email protected]".

Cry128 belongs to the CryptON/Nemesis ransomware family that is mostly used for targetted attacks via RDP. Files are encrypted using a customized version of AES and RSA. We have seen the following extensions being used by Cry128: ".fgb45ft3pqamyji7.onion.to.", ".idgebdp3k7bolalnd4.onion.", ".id_2irbar3mjvbap6gt.onion.to." and ".id-_[qg6m5wo7h3id55ym.onion.to].63vc4".

Cry9 is the successor of the CryptON ransomware family that is mostly used for targetted attacks via RDP. Files are encrypted using a customized version of AES, RSA and SHA-512. We have seen the following extensions being used by Cry9: ".-juccy[a]protonmail.ch", ".id-", ".id-_[[email protected]].xj5v2", ".id-_r9oj", ".id-x3m", ".id-[[email protected]]_[[email protected]].x3m", ".", ".-sofialobster[a]protonmail.ch" and ".[wqfhdgpdelcgww4g.onion.to].r2vy6".

CryptON aka Nemesis aka X3M is a ransomware family that is mostly used for targetted attacks via RDP. Files are encrypted using a mix of RSA, AES-256 and SHA-256. We have seen the following extensions being used by CryptON: ".id-_locked", ".id-_locked_by_krec", ".id-_locked_by_perfect", ".id-_x3m", ".id-_r9oj", ".id-[email protected]", ".id-[email protected]", ".id-[email protected]", ".id-[email protected]", ".id-[email protected]" and ".id-[email protected]".

Damage is a ransomware written in Delphi. It uses a combination of SHA-1 and Blowfish to encrypt the first and last 8 kb of a file. Encrypted files have the extension ".damage" and the ransom note, which is named "[email protected][COMPUTERNAME].txt", asks to contact "[email protected]".

Use this decrypter if your files have been encrypted by the FenixLocker ransomware. FenixLocker encrypts files and renames them by appending the "[email protected]!!" extension. It leaves behind a ransom note named "CryptoLocker.txt" or "Help to decrypt.txt" on your Desktop, instructing you to contact "[email protected]". To start the decrypter simply drag and drop one of your encrypted files onto the decrypter executable.

Globe is a ransomware kit that was first discovered at the end of August. Files are encrypted using Blowfish. Since the extension of encrypted files is configurable, several different file extensions are possible. The most commonly used extensions are .purge, .globe and [email protected].!dsvgdfvdDVGR3SsdvfEF75sddf#xbkNY45fg6}P{cg.xtbl. To use the decrypter you will require a file pair containing both an encrypted file and its non-encrypted original version. It is important to use a file pair that is as large as possible, as it determines the maximum file size up to which the decrypter will be able to decrypt your files. Select both the encrypted and unencrypted file and drag and drop both of them onto the decrypter file in your download directory.

Globe2 is a ransomware kit that was first discovered at the beginning of October. Globe2 encrypts files and optionally file names using RC4. Since the extension of encrypted files is configurable, several different file extensions are possible. The most commonly used extensions are .raid10, .blt, .globe, .encrypted and .[[email protected]]. To use the decrypter you will require a file pair containing both an encrypted file and its non-encrypted original version. Select both the encrypted and unencrypted file and drag and drop both of them onto the decrypter file in your download directory. If file names are encrypted, please use the file size to determine the correct file. Encrypted and original file will have exactly the same size.

Globe3 is a ransomware kit that we first discovered at the beginning of 2017. Globe3 encrypts files and optionally filenames using AES-256. Since the extension of encrypted files is configurable, several different file extensions are possible. The most commonly used extensions are .decrypt2017 and .hnumkhotep. To use the decrypter, you will require a file pair containing both an encrypted file and its non-encrypted original version. Select both the encrypted and unencrypted file and drag and drop both of them onto the decrypter file in your download directory. If file names are encrypted, please use the file size to determine the correct file. The encrypted and the original file will have the same size for files greater than 64 kb.

GlobeImposter is a Globe copycat that imitates the ransom notes and file extension found in the Globe ransomware kit. Encrypted files have the extension *.crypt and the base name of the file is unchanged. The ransom note is named "HOW_OPEN_FILES.hta" and can be found in all folders that contain encrypted files.

The Ims00rry ransomware encrypts files using AES-128, and does not add an extension. Instead, the text "---shlangan AES-256---" is prepended to the file contents. The victim is asked to contact the criminals on Telegram @Ims00rybot.

The Marlboro ransomware was first seen on January 11th, 2017. It is written in C++ and uses a simple XOR based encryption algorithm. Encrypted files are renamed to ".oops". The ransom note is stored inside a file named "_HELP_RecoverFiles.html" and includes no further point of contact.

Due to a bug in the malware's code, the malware will truncate up to the last 7 bytes from files it encrypts. It is, unfortunately, impossible for the decrypter to reconstruct these bytes.

MRCR or Merry X-Mas is a ransomware family that first appeared in December last year. It is written in Delphi and uses a custom encryption algorithm. Encrypted files will have either ".PEGS1", ".MRCR1", ".RARE1", ".MERRY", or ".RMCM1" as an extension. The ransom note is named "YOUR_FILES_ARE_DEAD.HTA" or "MERRY_I_LOVE_YOU_BRUCE.HTA" and asks victims to contact either "[email protected]" or "comodosecurity" via the secure mobile messenger Telegram.

NemucodAES is a new variant of the Nemucod ransomware family. Written in a combination of JavaScript and PHP it uses AES and RSA in order to encrypt your files. Encrypted files will keep their original file names and a ransom note named "DECRYPT.hta" can be found on your Desktop.

OpenToDecrypt is a ransomware written in the Delphi programming language that encrypts your files using the RC4 encryption algorithm. Encrypted files get renamed to *[email protected] and a ransom note named "!!!.txt" can be found on your Desktop.

Philadelphia is a ransomware kit offered within various hacking communities. Written in AutoIt, it encrypts files using AES-256 encryption, file names using RC4 encryption and uses the *.locked file extension. It is based on a similar ransomware kit called "Stampado" that is written by the same author. To use the decrypter you will require a file pair containing both an encrypted file and its non-encrypted original version. Due to the file name encryption this can be a bit tricky. The best way is to simply compare file sizes. Encrypted files will have the size of the original file rounded up to the next 16 byte boundary. So if a the original file was 1020 bytes large, the encrypted file will be 1024. Select both the encrypted and non-encrypted file and drag and drop both of them onto the decrypter file in your download directory.

Planetary is a ransomware family that uses AES-256 to encrypt files, adding the extension ".mira", ".yum", ".Neptune", or ".Pluto" - the latter of which give this ransomware its name. The ransom note "!!!READ_IT!!!.txt" then asks the victim to contact "[email protected]". be457b7860