Free RansomWare Decryptors.
These free tools have been created after different ransomware gangs code was leaked online on hacker forums.
Ransomware is a type of cryptovirological malware that threatens to publish the victim's personal data or permanently block access to it unless a ransom is paid to the cybercriminals.
On this page we will list free ransomware decryptors created by different AV-vendors and others.
We will list them by vendor:
AVAST:
Avast Software s.r.o. is a Czech multinational cybersecurity software company headquartered in Prague, Czech Republic, that researches and develops computer security software, machine learning, and artificial intelligence. They have a lot of free decryptors from 2015, 2016, 2017, then it gets scarce and their latest is from 2021.
It is not impossible, but it is unlikely that you will get infected by an eight (8) year old ransomware. Still we will list it here:
2016:
December:
AES_NI is a ransomware strain that first appeared in December 2016. Since then, we’ve observed multiple variants, with different file extensions. For encrypting files, the ransomware uses AES-256 combined with RSA-2048.
The ransomware adds one of the following extensions to encrypted files: .aes_ni, aes256 or aes_ni_0day.
Kaspersky Lab:
A Russian multinational cybersecurity and anti-virus provider headquartered in Moscow, Russia, and operated by a holding company in the United Kingdom. It was founded in 1997 by Eugene Kaspersky, Natalya Kaspersky, and Alexey De-Monderik; Eugene Kaspersky is currently the CEO.
CoinVault Decryptor April 15th, 2015:
Decrypts files affected by CoinVault and Bitcryptor. Created in cooperation with The National High Tech Crime Unit (NHTCU) of the Netherlands’ police and Netherlands’ National Prosecutors.
Xorist Decryptor August 23rd, 2016:
Decrypts files affected by Xorist and Vandev.
Wildfire Decryptor August 24th, 2016:
Decrypts files affected by Wildfire. Wildfire Locker ransomware encrypts files on a computer and makes them inaccessible. Use WildfireDecryptor to decrypt the files with the WFLX extension. Kaspersky Internet Security protects against this ransomware. Last updated: 2023.
Shade Decryptor April 30th,2020:
Kaspersky Labs created this in 2020 and it decrypts files affected by all versions of Shade. The tool needs Internet access !
Rannoh Decryptor April 15th, 2022:
Decrypts files affected by Rannoh, AutoIt, Fury, Cryakl, Crybola, CryptXXX (versions 1, 2 and 3), Polyglot aka Marsjoke, Yanluowang.
Rakhni Decryptor March 6, 2023:
Decrypts files affected by Rakhni, Agent.iih, Aura, Autoit, Pletor, Rotor, Lamer, Cryptokluchen, Lortok, Democry, Bitman, TeslaCrypt (version 3 and 4), Chimera, Crysis (versions 2 and 3), Jaff, Dharma, new versions of Cryakl ransomware, Yatron, FortuneCrypt, Fonix, Maze, Sekhmet, Egregor, Conti.
