RakhniDecryptor Ransomware Decryptor

RakhniDecryptor is a general purpose ransomware decryptor created by Kaspersky Labs. Instead of creating a separate decryptor for each ransomware infection, they created on decryptor that can handle a variety of different families.

A guide explaining how to use the RakhniDecryptor can be found here: Kaspersky Releases Decryptor for the Dharma Ransomware.

Currently RakhniDecryptor can decrypt the following ransomware families:

  Trojan-Ransom.Win32.Rakhni, Trojan-Ransom.Win32.Agent.iih, Trojan-Ransom.Win32.Aura, Trojan-Ransom.Win32.Autoit, Trojan-Ransom.AndroidOS.Pletor, Trojan-Ransom.Win32.Rotor, Trojan-Ransom.Win32.Lamer, Trojan-Ransom.MSIL.Lortok, Trojan-Ransom.Win32.Cryptokluchen, Trojan-Ransom.Win32.Democry, Trojan-Ransom.Win32.Bitman version 3 and 4, Trojan-Ransom.Win32.Libra, Trojan-Ransom.MSIL.Lobzik, Trojan-Ransom.Win32.Chimera, Trojan-Ransom.Win32.Mircop, and Trojan-Ransom.Win32.Crusis

Of these families, RakhniDecryptor can decrypt files that have their filenames encrypted and renamed to the one of the following formats:

Misc Ransomware:

  ..  ..  ..   ..   ..   ..  ..  ..  ..  ..  ..  ._crypt  ..  ..  ..    ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  .crypt@india.com.random_characters>  .+  Trojan-Ransom.Win32.Democry:  .+<._date-time_$address@domain$.777>  .+<._date-time_$address@domain$.legion>  Trojan-Ransom.Win32.Bitman version 3:  .  .  .  .  Trojan-Ransom.Win32.Bitman version 4:  . (name and extension are not changed)  Trojan-Ransom.Win32.Libra:  .  .  .  Trojan-Ransom.MSIL.Lobzik:  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .

Trojan-Ransom.Win32.Mircop:

  Lock.file_name.original extension

Trojan-Ransom.Win32.Crusis:

  .ID<…>.@..xtbl  .ID<…>.@..CrySiS  .id-<…>.@..xtbl  .id-<…>.@..CrySiS

Dharma Ransomware:

  .[3angle@india.com].dharma  .[amagnus@india.com].dharma  .[base_optimal@india.com].dharma  .[bitcoin143@india.com].dharma  .[blackeyes@india.com].dharma  .[doctor.crystal@mail.com].dharma  .[dr_crystal@india.com].dharma  .[emmacherry@india.com].dharma  .[google_plex@163.com].dharma  .[mr_lock@mail.com].dharma  .[opened@india.com].dharma  .[oron@india.com].dharma  .[payforhelp@india.com].dharma  .[savedata@india.com].dharma  .[singular@india.com].dharma  .[suppforhelp@india.com].dharma  .[SupportForYou@india.com].dharma  .[tombit@india.com].dharma  .[worm01@india.com].dharma