How to decrypt ransomware [Jul 2021]

Get best practice tips for identifying ransomware strains, successful recovery of the encrypted hostage data, and preventing the attack in the first place.

File-encrypting ransomware is undoubtedly the worst type of malicious code as of yet. In case of such an attack, simply removing the infection is not enough. Decrypting hostage data is the actual challenge victims are confronted with. The ransomware threat landscape is heterogeneous. Some samples have weak crypto, with the secret decryption key being embedded in the malicious executable itself. Others are made professionally enough to thwart recovery.

One way or another, reviving locked files is on every contaminated user’s agenda. Data backups are a godsend in this context, but this route of incident response is still a weak link of most end users’ and even organizations’ security posture. So what is the best practice, universal walkthrough to restore files mutilated by a ransom Trojan if there are no backups available?

Step 1: Remove the ransomware

This point is somewhat controversial, because most of the widespread strains of crypto ransomware only persevere on an infected computer until the victim’s data has been encrypted. The self-termination routine being in place, some of the newer sophisticated samples go equipped with additional DDoS, identity theft or screen locking mechanisms. With that said, it always makes sense to ascertain that the ransom Trojan and its accompanying components are no longer on the machine.

One of the methods is to leverage System Restore, a native Windows feature that allows reverting the operating system to its earlier state. Although this technique does not apply to personal files, it can make the PC ransomware-free. However, if System Restore was not enabled when the attack took place, it’s no good as a troubleshooting vector. In this case, consider using an automatic antimalware suite, which will detect the ransomware and completely remove it.

Download Ransomware Removal Tool

Step 2: Resort to forensics for file recovery

The effectivity of using forensic tools for restoring ransomware-crippled files revolves around the specificity of the average ransomware onslaught. The fact is, most of these offending programs tend to obliterate the original files. The inaccessible objects sprinkled throughout the plagued PC are nothing but encrypted copies of a victim’s important data. It means that the deleted files may physically still be somewhere on the hard drive, unless the infection utilizes multiple overwrites to shred them beyond recovery. By leveraging software like Data Recovery Pro, you may be able to reinstate some of the original data entries. Just install the tool and run a scan to determine what’s recoverable.

-%%block:link%%&PATH=https%3A%2F%2Fcloud.stellardatarecovery.com%2Favangate%2FStellarDataRecoveryProfessionalWindows.exe” btnsize=”large” bgcolor=”#1e73be” txtcolor=”#ffffff” btnnewt=”1″ nofollow=”1″ btnicon=”fa fa-arrow-circle-down”]Download Stellar Data Recovery Pro

One more avenue of file restoration has to do with what’s called the Volume Shadow Copy Service (VSS). In a nutshell, it denotes a system module that takes snapshots and saves reserve copies of files at certain intervals. You can view the list of the backup versions for an arbitrary file by going to its Properties and selecting the Previous Versions tab. The application called Shadow Explorer completely automates this routine, enabling users to select folders or files of interest and restore their shadow copies to a desired path.

In the event these do-it-yourself techniques end up futile, it’s high time you searched for specially crafted decryption tools. But first, it’s mandatory to find out what strain you are dealing with.

Step 3: Identify the ransomware

There are hundreds of different crypto ransomware families in the wild. To determine whether security researchers have released the right decryptor for your incident, the rule of thumb is to first figure out which strain has attacked your computer. Sometimes the ransom note straightforwardly mentions the name and iteration (including subversion) of the infection, as is the case with the notorious GandCrab or Cerber ransomware lineages.

This, however, is the exception rather than the rule. In case there is no direct indication of the name in the ransom demands, the format of encrypted files or the linked-to payment page, it’s recommended to use services like ID Ransomware by MalwareHunterTeam. This website provides two ways to identify a ransom Trojan. One way is to upload the .txt, .hta, .html, or .bmp ransom note, which is usually added to the desktop of a contaminated computer. The other method is to upload a sample encrypted file. Having processed this information, the service will return the name of your digital adversary. At this point, ID Ransomware detects 701 strains of ransomware.

Crypto Sheriff is another resource enabling ransomware victims to identify the sample they are confronted with. It is part of the remarkable international No More Ransom initiative. Users have several options: to upload two encrypted files, which are less than 1 MB in size; to type an email address and/or URL indicated in the ransom notes; or to upload the .txt or .html ransom manual dropped by the infection.

If a match is found in Crypto Sheriff’s database, the service will display a page defining the type of the ransomware. Furthermore, it provides a button to download the appropriate free decryption tool if available. Users can also report the crime to their local law enforcement agency.

As opposed to ransomware identification, attack attribution isn’t really a component of the data decryption chain proper. However, it provides food for thought about who the adversary is. According to statistics provided by Kaspersky Lab, 47 out of 62 ransomware strains spotted in 2016 were created by Russian-speaking crooks. It means that 75% of all file-encrypting malware samples originate from Russia. These perpetrating programs infected at least 1.4 million people last year. The takeaway is that online extortion has a language. It’s Russian.

Keep in mind that determining what ransomware specimen is on board your computer is half the battle. The next move is to find out whether antimalware labs or security enthusiasts have a free decryption tool in store for the infection.

Step 4: Decrypt your files

Now that you know the name of your cyber adversary, it’s time to figure out if there is a file recovery solution that doesn’t presuppose submitting the ransom. Unfortunately, few strains of ransomware can be decrypted for free, as compared to the whopping general quantity of these infections on the loose.

The security companies that have had the most success in the ransomware cracking initiative include Emsisoft, Kaspersky, Avast, AVG, Trend Micro, and Bitdefender. The most game-changing breakthroughs that hit the headlines in 2018 through 2019 are attributed to the latter vendor. In particular, Bitdefender has created a free decryptor that cracks the most widespread variants of the GandCrab ransomware, including v1, v4, and v5 up to GandCrab 5.1. This has reportedly become a real rescue for roughly 20,000 victims who thereby saved a total of $18 million.

The list of available free decryptors below, along with brief descriptions of the corresponding ransomware samples, is the starting point for your troubleshooting:

Most of these decryption tools are easy to use. The ones by Emsisoft, for instance, require that ransomware victims drag and drop an arbitrary encrypted file and its original version onto the decryptor’s window. The GandCrab decryptor by Bitdefender is even more intuitively built – it scans the whole system or specified path, spots all the hostage files and automatically decrypts them without user involvement if the ransomware version is supported. With some utilities, however, more advanced tech skills are necessary, such as the use of command prompt and the like. Furthermore, ransomware authors tend to tweak their code once in a while in order to defeat previously released decryptors. In any case, the list above should come in handy.

An additional recommendation is to look up the name of the ransomware on search engines, browse dedicated forums such as Bleeping Computer, and use the above-mentioned ID Ransomware and No More Ransom services. The best prevention tips are as follows: maintain regular data backups, do not open fishy email attachments, and use reliable security software that goes equipped with an anti-ransomware module.