RakhniDecryptor tool for removing Trojan-Ransom.Win32.Rakhni malware (.oshit and others)

2018 Aug 08 ID: 10556

Use the RakhniDecryptor.zip tool to decrypt files that have been encrypted by the Rakhni, Agent.iih, Aura, Autoit, Pletor, Rotor, Lamer, Lortok, Cryptokluchen, Democry, Bitman (TeslaCrypt, versions 3 and 4), Chimera, Crysis (versions 2 and 3), Dharma, Jaff, and Cryakl ransomware viruses.

Use the tool if your have been encrypted by the following programs:

Trojan-Ransom.Win32.Rakhni
Trojan-Ransom.Win32.Agent.iih
Trojan-Ransom.Win32.Autoit
Trojan-Ransom.Win32.Aura
Trojan-Ransom.AndroidOS.Pletor
Trojan-Ransom.Win32.Rotor
Trojan-Ransom.Win32.Lamer
Trojan-Ransom.Win32.Cryptokluchen
Trojan-Ransom.Win32.Democry
Trojan-Ransom.Win32.Bitman versions 3 and 4
Trojan-Ransom.Win32.Libra
Trojan-Ransom.MSIL.Lobzik
Trojan-Ransom.MSIL.Lortok
Trojan-Ransom.Win32.Chimera
Trojan-Ransom.Win32.CryFile
Trojan-Ransom.Win32.Nemchig
Trojan-Ransom.Win32.Mircop
Trojan-Ransom.Win32.Mor
Trojan-Ransom.Win32.Crusis (Dharma)
Trojan-Ransom.Win32.AecHu
Trojan-Ransom.Win32.Jaff
Trojan-Ransom.Win32.Cryakl CL 1.0.0.0
Trojan-Ransom.Win32.Cryakl CL 1.0.0.0.u
Trojan-Ransom.Win32.Cryakl CL 1.2.0.0
Trojan-Ransom.Win32.Cryakl CL 1.3.0.0
Trojan-Ransom.Win32.Cryakl CL 1.3.1.0

Files that can be decrypted with RakhniDecryptor

When malware encrypts files, it changes the file extensions. For example:

before file.doc / after file.doc.locked
before 1.doc / after 1.dochb15
before 1.doc / after 1.doc._17-05-2016-20-27-37_$seven_legion@india.com$.777

The RakhniDecryptor.zip tool can decrypt the files encrypted according to the following templates:

Trojan-Ransom.Win32.Rakhni:

<file_name>.<original_extension>.<locked>
<file_name>.<original_extension>.<kraken>
<file_name>.<original_extension>.<darkness>
<file_name>.<original_extension>.<oshit>
<file_name>.<original_extension>.<nochance>
<file_name>.<original_extension>.<oplata@qq_com>
<file_name>.<original_extension>.<relock@qq_com>
<file_name>.<original_extension>.<crypto>
<file_name>.<original_extension>.<helpdecrypt@ukr.net>
<file_name>.<original_extension>.<pizda@qq_com>
<file_name>.<original_extension>.<dyatel@qq_com>
<file_name>.<original_extension>.<nalog@qq_com>
<file_name>.<original_extension>.<chifrator@gmail_com>
<file_name>.<original_extension>.<gruzin@qq_com>
<file_name>.<original_extension>.<troyancoder@gmail_com>
<file_name>.<original_extension>.<coderksu@gmail_com_id373>
<file_name>.<original_extension>.<coderksu@gmail_com_id371>
<file_name>.<original_extension>.<coderksu@gmail_com_id372>
<file_name>.<original_extension>.<coderksu@gmail_com_id374>
<file_name>.<original_extension>.<coderksu@gmail_com_id375>
<file_name>.<original_extension>.<coderksu@gmail_com_id376>
<file_name>.<original_extension>.<coderksu@gmail_com_id392>
<file_name>.<original_extension>.<coderksu@gmail_com_id357>
<file_name>.<original_extension>.<coderksu@gmail_com_id356>
<file_name>.<original_extension>.<coderksu@gmail_com_id358>
<file_name>.<original_extension>.<coderksu@gmail_com_id359>
<file_name>.<original_extension>.<coderksu@gmail_com_id360>
<file_name>.<original_extension>.<coderksu@gmail_com_id20>

Trojan-Ransom.Win32.Mor:

<file_name>.<original_extension>_crypt

Trojan-Ransom.Win32.Autoit:

<<file_name>.<original_extension>.<_crypt@india.com_.random characters>

Trojan-Ransom.MSIL.Lortok:

<file_name>.<original_extension>.<cry>
<file_name>.<original_extension>.<AES256>

Trojan-Ransom.AndroidOS.Pletor:

<file_name>.<original_extension>.<enc>

Trojan-Ransom.Win32.Agent.iih:

<file_name>.<original_extension>+<hb15>

Trojan-Ransom.Win32.CryFile:

<file_name>.<original_extension>.<encrypted>

Trojan-Ransom.Win32.Democry:

<file_name>.<original_extension>+<._date-time_$email@domain$.777>
<file_name>.<original_extension>+<._date-time_$email@domain$.legion>

Trojan-Ransom.Win32.Bitman version 3:

<file_name>.<xxx>
<file_name>.<ttt>
<file_name>.<micro>
<file_name>.<mp3>

Trojan-Ransom.Win32.Bitman version 4:

<file_name>.<original_extension> (file name and extension are not changed)

Trojan-Ransom.Win32.Libra:

<file_name>.<encrypted>
<file_name>.<locked>
<file_name>.<SecureCrypted>

Trojan-Ransom.MSIL.Lobzik:

<file_name>.<fun>
<file_name>.<gws>
<file_name>.<btc>
<file_name>.<AFD>
<file_name>.<porno>
<file_name>.<pornoransom>
<file_name>.<epic>
<file_name>.<encrypted>
<file_name>.<J>
<file_name>.<payransom>
<file_name>.<paybtcs>
<file_name>.<paymds>
<file_name>.<paymrss>
<file_name>.<paymrts>
<file_name>.<paymst>
<file_name>.<paymts>
<file_name>.<gefickt>
<file_name>.<uk-dealer@sigaint.org>

Trojan-Ransom.Win32.Mircop:

<Lock>.<file_name>.<original_extension>

Trojan-Ransom.Win32.Crusis (Dharma):

.ID<…>.<mail>@<server>.<domain>.xtbl
.ID<…>.<mail>@<server>.<domain>.CrySiS
.id-<…>.<mail>@<server>.<domain>.xtbl
.id-<…>.<mail>@<server>.<domain>.wallet
.id-<…>.<mail>@<server>.<domain>.dhrama
.id-<…>.<mail>@<server>.<domain>.onion
.<mail>@<server>.<domain>.wallet
.<mail>@<server>.<domain>.dhrama
.<mail>@<server>.<domain>.onion
.bip
.cesar
.wallet
.dharma

Examples of some e-mail addresses used to spread malware:

webmafia@asia.com
braker@plague.life
crannbest@foxmail.com
amagnus@india.com
stopper@india.com
bitcoin143@india.com
worm01@india.com
funa@india.com
pay4help@india.com
lavandos@dr.com
mkgoro@india.com

Trojan-Ransom.Win32.Crusis:

.ID<…>.<mail>@<server>.<domain>.xtbl
.ID<…>.<mail>@<server>.<domain>.CrySiS
.id-<…>.<mail>@<server>.<domain>.xtbl
.id-<…>.<mail>@<server>.<domain>.wallet
.id-<…>.<mail>@<server>.<domain>.dhrama
.id-<…>.<mail>@<server>.<domain>.onion
.<mail>@<server>.<domain>.wallet
.<mail>@<server>.<domain>.dhrama
.<mail>@<server>.<domain>.onion

Trojan-Ransom.Win32. Nemchig:

<file_name>.<original_extension>.<safefiles32@mail.ru>

Trojan-Ransom.Win32.Lamer:

<file_name>.<original_extension>.<bloked>
<file_name>.<original_extension>.<cripaaaa>
<file_name>.<original_extension>.<smit>
<file_name>.<original_extension>.<fajlovnet>
<file_name>.<original_extension>.<filesfucked>
<file_name>.<original_extension>.<criptx>
<file_name>.<original_extension>.<gopaymeb>
<file_name>.<original_extension>.<cripted>
<file_name>.<original_extension>.<bnmntftfmn>
<file_name>.<original_extension>.<criptiks>
<file_name>.<original_extension>.<cripttt>
<file_name>.<original_extension>.<hithere>
<file_name>.<original_extension>.<aga>

Trojan-Ransom.Win32.Cryptokluchen:

<file_name>.<original_extension>.<AMBA>
<file_name>.<original_extension>.<PLAGUE17>
<file_name>.<original_extension>.<ktldll>

Trojan-Ransom.Win32.Rotor:

<file_name>.<original_extension>.<.-.DIRECTORAT1C@GMAIL.COM.roto>
<file_name>.<original_extension>.<.-.CRYPTSb@GMAIL.COM.roto>
<file_name>.<original_extension>.<.-.DIRECTORAT1C8@GMAIL.COM.roto>
<file_name>.<original_extension>.<!______________DESKRYPTEDN81@GMAIL.COM.crypt>
<file_name>.<original_extension>.<!___prosschiff@gmail.com_.crypt>
<file_name>.<original_extension>.<!_______GASWAGEN123@GMAIL.COM____.crypt>
<file_name>.<original_extension>.<!_________pkigxdaq@bk.ru_______.crypt>
<file_name>.<original_extension>.<!____moskali1993@mail.ru___.crypt>
<file_name>.<original_extension>.<!==helpsend369@gmail.com==.crypt>
<file_name>.<original_extension>.<!-==kronstar21@gmail.com=--.crypt>

Trojan-Ransom.Win32.Chimera:

<file_name>.<original_extension>.<crypt>
<file_name>.<original_extension>.<4 random characters>

Trojan-Ransom.Win32.AecHu:

<file_name>.<aes256>
<file_name>.<aes_ni>
<file_name>.<aes_ni_gov>
<file_name>.<aes_ni_0day>
<file_name>.<lock>
<file_name>.<decrypr_helper@freemail_hu>
<file_name>.<decrypr_helper@india.com>
<file_name>.<~xdata>

Trojan-Ransom.Win32.Jaff:

<file_name>.<jaff>
<file_name>.<wlu>
<file_name>.<sVn>

Trojan-Ransom.Win32.Cryakl

email-<...>.ver-<...>.id-<...>.randomname-<...>.<random_extension>

Malware version	Email address
CL 1.0.0.0	cryptolocker@aol.com iizomer@aol.com seven_Legion2@aol.com oduvansh@aol.com ivanivanov34@aol.com trojanencoder@aol.com load180@aol.com moshiax@aol.com vpupkin3@aol.com watnik91@aol.com
CL 1.0.0.0.u	cryptolocker@aol.com_graf1 cryptolocker@aol.com_mod byaki_buki@aol.com_mod2
CL 1.2.0.0	oduvansh@aol.com cryptolocker@aol.com
CL 1.3.0.0	cryptolocker@aol.com
CL 1.3.1.0	byaki_buki@aol.com byaki_buki@aol.com_grafdrkula@gmail.com vpupkin3@aol.com

How to use the tool

To decrypt the files, do the following:

Download the RakhniDecryptor.zip archive, using a file archiver (for example, 7zip).
Run the RakhniDecryptor.exe file on the infected computer.
In the Kaspersky RakhniDecryptor window click the Change parameters link.

In the Settings window select the objects to scan (hard drives / removable drives / network drives).
Select the checkbox Delete crypted files after decryption (the utility will be deleting copies of original files with the .locked, .kraken and .darkness extensions).
Click ОК.

In the Kaspersky RakhniDecryptor, click Start scan.

In the Specify the path to one of encrypted files, select the file you need to restore and click Open.

The utility will start recovering the password. Please mind the Warning! window message.

Wait until the utility is done with decrypting the file (do not exit the program or shut down the computer).

Trojan-Ransom.Win32.Rakhni creates the file exit.hhr.oshit which contains the password for decrypting the files in the encrypted form. If the file is preserved on the infected computer, decryption with the RakhniDecryptor tool will take significantly less time. If the exit.hhr.oshit file was deleted, you can try to restore it using special tools and move it to the %APPDATA% folder. After that, you can try runing the tool once again. The exit.hhr.oshit file is usually located in the following folder:

Windows XP: C:\Documents and Settings\<username>\Application Data
Windows Vista/7/8/8.1/10 C:\Users\<username>\AppData\Roaming

The file can be encrypted with the _crypt extension more than once. For example, the file test.doc was encrypted twice. The first encryption layer will be decrypted to test.1.doc.layerDecryptedKLR. In the tool performance report, the line Decryption success: disk:\path\test.doc_crypt -> disk:\path\test.1.doc.layerDecryptedKLR will appear. You will need to decrypt this file using the tool once again. In case of successful decryption, the file will be saved under the original name test.doc.

If the file was encrypted with the _crypt extension, decryption may take a long time. For example, for the Intel Core i5-2400 the procedure may take up to 120 days.

Parameters for running the utility from the command prompt

Was this information helpful?

Yes No

Back to "Virus-fighting tools"

Safety 101: General information

Safety 101: Questions and answers

Safety 101: Protection tips

Safety 101: Virus-fighting tools

RakhniDecryptor tool for removing Trojan-Ransom.Win32.Rakhni malware (.oshit and others)

Back to "Virus-fighting tools"

2018 Aug 08 ID: 10556

Use the RakhniDecryptor.zip tool to decrypt files that have been encrypted by the Rakhni, Agent.iih, Aura, Autoit, Pletor, Rotor, Lamer, Lortok, Cryptokluchen, Democry, Bitman (TeslaCrypt, versions 3 and 4), Chimera, Crysis (versions 2 and 3), Dharma, Jaff, and Cryakl ransomware viruses.

Use the tool if your have been encrypted by the following programs:

Trojan-Ransom.Win32.Rakhni
Trojan-Ransom.Win32.Agent.iih
Trojan-Ransom.Win32.Autoit
Trojan-Ransom.Win32.Aura
Trojan-Ransom.AndroidOS.Pletor
Trojan-Ransom.Win32.Rotor
Trojan-Ransom.Win32.Lamer
Trojan-Ransom.Win32.Cryptokluchen
Trojan-Ransom.Win32.Democry
Trojan-Ransom.Win32.Bitman versions 3 and 4
Trojan-Ransom.Win32.Libra
Trojan-Ransom.MSIL.Lobzik
Trojan-Ransom.MSIL.Lortok
Trojan-Ransom.Win32.Chimera
Trojan-Ransom.Win32.CryFile
Trojan-Ransom.Win32.Nemchig
Trojan-Ransom.Win32.Mircop
Trojan-Ransom.Win32.Mor
Trojan-Ransom.Win32.Crusis (Dharma)
Trojan-Ransom.Win32.AecHu
Trojan-Ransom.Win32.Jaff
Trojan-Ransom.Win32.Cryakl CL 1.0.0.0
Trojan-Ransom.Win32.Cryakl CL 1.0.0.0.u
Trojan-Ransom.Win32.Cryakl CL 1.2.0.0
Trojan-Ransom.Win32.Cryakl CL 1.3.0.0
Trojan-Ransom.Win32.Cryakl CL 1.3.1.0

Files that can be decrypted with RakhniDecryptor

When malware encrypts files, it changes the file extensions. For example:

before file.doc / after file.doc.locked
before 1.doc / after 1.dochb15
before 1.doc / after 1.doc._17-05-2016-20-27-37_$seven_legion@india.com$.777

The RakhniDecryptor.zip tool can decrypt the files encrypted according to the following templates:

Trojan-Ransom.Win32.Rakhni:

<file_name>.<original_extension>.<locked>
<file_name>.<original_extension>.<kraken>
<file_name>.<original_extension>.<darkness>
<file_name>.<original_extension>.<oshit>
<file_name>.<original_extension>.<nochance>
<file_name>.<original_extension>.<oplata@qq_com>
<file_name>.<original_extension>.<relock@qq_com>
<file_name>.<original_extension>.<crypto>
<file_name>.<original_extension>.<helpdecrypt@ukr.net>
<file_name>.<original_extension>.<pizda@qq_com>
<file_name>.<original_extension>.<dyatel@qq_com>
<file_name>.<original_extension>.<nalog@qq_com>
<file_name>.<original_extension>.<chifrator@gmail_com>
<file_name>.<original_extension>.<gruzin@qq_com>
<file_name>.<original_extension>.<troyancoder@gmail_com>
<file_name>.<original_extension>.<coderksu@gmail_com_id373>
<file_name>.<original_extension>.<coderksu@gmail_com_id371>
<file_name>.<original_extension>.<coderksu@gmail_com_id372>
<file_name>.<original_extension>.<coderksu@gmail_com_id374>
<file_name>.<original_extension>.<coderksu@gmail_com_id375>
<file_name>.<original_extension>.<coderksu@gmail_com_id376>
<file_name>.<original_extension>.<coderksu@gmail_com_id392>
<file_name>.<original_extension>.<coderksu@gmail_com_id357>
<file_name>.<original_extension>.<coderksu@gmail_com_id356>
<file_name>.<original_extension>.<coderksu@gmail_com_id358>
<file_name>.<original_extension>.<coderksu@gmail_com_id359>
<file_name>.<original_extension>.<coderksu@gmail_com_id360>
<file_name>.<original_extension>.<coderksu@gmail_com_id20>

Trojan-Ransom.Win32.Mor:

<file_name>.<original_extension>_crypt

Trojan-Ransom.Win32.Autoit:

<<file_name>.<original_extension>.<_crypt@india.com_.random characters>

Trojan-Ransom.MSIL.Lortok:

<file_name>.<original_extension>.<cry>
<file_name>.<original_extension>.<AES256>

Trojan-Ransom.AndroidOS.Pletor:

<file_name>.<original_extension>.<enc>

Trojan-Ransom.Win32.Agent.iih:

<file_name>.<original_extension>+<hb15>

Trojan-Ransom.Win32.CryFile:

<file_name>.<original_extension>.<encrypted>

Trojan-Ransom.Win32.Democry:

<file_name>.<original_extension>+<._date-time_$email@domain$.777>
<file_name>.<original_extension>+<._date-time_$email@domain$.legion>

Trojan-Ransom.Win32.Bitman version 3:

<file_name>.<xxx>
<file_name>.<ttt>
<file_name>.<micro>
<file_name>.<mp3>

Trojan-Ransom.Win32.Bitman version 4:

<file_name>.<original_extension> (file name and extension are not changed)

Trojan-Ransom.Win32.Libra:

<file_name>.<encrypted>
<file_name>.<locked>
<file_name>.<SecureCrypted>

Trojan-Ransom.MSIL.Lobzik:

<file_name>.<fun>
<file_name>.<gws>
<file_name>.<btc>
<file_name>.<AFD>
<file_name>.<porno>
<file_name>.<pornoransom>
<file_name>.<epic>
<file_name>.<encrypted>
<file_name>.<J>
<file_name>.<payransom>
<file_name>.<paybtcs>
<file_name>.<paymds>
<file_name>.<paymrss>
<file_name>.<paymrts>
<file_name>.<paymst>
<file_name>.<paymts>
<file_name>.<gefickt>
<file_name>.<uk-dealer@sigaint.org>

Trojan-Ransom.Win32.Mircop:

<Lock>.<file_name>.<original_extension>

Trojan-Ransom.Win32.Crusis (Dharma):

.ID<…>.<mail>@<server>.<domain>.xtbl
.ID<…>.<mail>@<server>.<domain>.CrySiS
.id-<…>.<mail>@<server>.<domain>.xtbl
.id-<…>.<mail>@<server>.<domain>.wallet
.id-<…>.<mail>@<server>.<domain>.dhrama
.id-<…>.<mail>@<server>.<domain>.onion
.<mail>@<server>.<domain>.wallet
.<mail>@<server>.<domain>.dhrama
.<mail>@<server>.<domain>.onion
.bip
.cesar
.wallet
.dharma

Examples of some e-mail addresses used to spread malware:

webmafia@asia.com
braker@plague.life
crannbest@foxmail.com
amagnus@india.com
stopper@india.com
bitcoin143@india.com
worm01@india.com
funa@india.com
pay4help@india.com
lavandos@dr.com
mkgoro@india.com

Trojan-Ransom.Win32.Crusis:

.ID<…>.<mail>@<server>.<domain>.xtbl
.ID<…>.<mail>@<server>.<domain>.CrySiS
.id-<…>.<mail>@<server>.<domain>.xtbl
.id-<…>.<mail>@<server>.<domain>.wallet
.id-<…>.<mail>@<server>.<domain>.dhrama
.id-<…>.<mail>@<server>.<domain>.onion
.<mail>@<server>.<domain>.wallet
.<mail>@<server>.<domain>.dhrama
.<mail>@<server>.<domain>.onion

Trojan-Ransom.Win32. Nemchig:

<file_name>.<original_extension>.<safefiles32@mail.ru>

Trojan-Ransom.Win32.Lamer:

<file_name>.<original_extension>.<bloked>
<file_name>.<original_extension>.<cripaaaa>
<file_name>.<original_extension>.<smit>
<file_name>.<original_extension>.<fajlovnet>
<file_name>.<original_extension>.<filesfucked>
<file_name>.<original_extension>.<criptx>
<file_name>.<original_extension>.<gopaymeb>
<file_name>.<original_extension>.<cripted>
<file_name>.<original_extension>.<bnmntftfmn>
<file_name>.<original_extension>.<criptiks>
<file_name>.<original_extension>.<cripttt>
<file_name>.<original_extension>.<hithere>
<file_name>.<original_extension>.<aga>

Trojan-Ransom.Win32.Cryptokluchen:

<file_name>.<original_extension>.<AMBA>
<file_name>.<original_extension>.<PLAGUE17>
<file_name>.<original_extension>.<ktldll>

Trojan-Ransom.Win32.Rotor:

<file_name>.<original_extension>.<.-.DIRECTORAT1C@GMAIL.COM.roto>
<file_name>.<original_extension>.<.-.CRYPTSb@GMAIL.COM.roto>
<file_name>.<original_extension>.<.-.DIRECTORAT1C8@GMAIL.COM.roto>
<file_name>.<original_extension>.<!______________DESKRYPTEDN81@GMAIL.COM.crypt>
<file_name>.<original_extension>.<!___prosschiff@gmail.com_.crypt>
<file_name>.<original_extension>.<!_______GASWAGEN123@GMAIL.COM____.crypt>
<file_name>.<original_extension>.<!_________pkigxdaq@bk.ru_______.crypt>
<file_name>.<original_extension>.<!____moskali1993@mail.ru___.crypt>
<file_name>.<original_extension>.<!==helpsend369@gmail.com==.crypt>
<file_name>.<original_extension>.<!-==kronstar21@gmail.com=--.crypt>

Trojan-Ransom.Win32.Chimera:

<file_name>.<original_extension>.<crypt>
<file_name>.<original_extension>.<4 random characters>

Trojan-Ransom.Win32.AecHu:

<file_name>.<aes256>
<file_name>.<aes_ni>
<file_name>.<aes_ni_gov>
<file_name>.<aes_ni_0day>
<file_name>.<lock>
<file_name>.<decrypr_helper@freemail_hu>
<file_name>.<decrypr_helper@india.com>
<file_name>.<~xdata>

Trojan-Ransom.Win32.Jaff:

<file_name>.<jaff>
<file_name>.<wlu>
<file_name>.<sVn>

Trojan-Ransom.Win32.Cryakl

email-<...>.ver-<...>.id-<...>.randomname-<...>.<random_extension>

Malware version	Email address
CL 1.0.0.0	cryptolocker@aol.com iizomer@aol.com seven_Legion2@aol.com oduvansh@aol.com ivanivanov34@aol.com trojanencoder@aol.com load180@aol.com moshiax@aol.com vpupkin3@aol.com watnik91@aol.com
CL 1.0.0.0.u	cryptolocker@aol.com_graf1 cryptolocker@aol.com_mod byaki_buki@aol.com_mod2
CL 1.2.0.0	oduvansh@aol.com cryptolocker@aol.com
CL 1.3.0.0	cryptolocker@aol.com
CL 1.3.1.0	byaki_buki@aol.com byaki_buki@aol.com_grafdrkula@gmail.com vpupkin3@aol.com

How to use the tool

To decrypt the files, do the following:

Download the RakhniDecryptor.zip archive, using a file archiver (for example, 7zip).
Run the RakhniDecryptor.exe file on the infected computer.
In the Kaspersky RakhniDecryptor window click the Change parameters link.

In the Settings window select the objects to scan (hard drives / removable drives / network drives).
Select the checkbox Delete crypted files after decryption (the utility will be deleting copies of original files with the .locked, .kraken and .darkness extensions).
Click ОК.

In the Kaspersky RakhniDecryptor, click Start scan.

In the Specify the path to one of encrypted files, select the file you need to restore and click Open.

The utility will start recovering the password. Please mind the Warning! window message.

Wait until the utility is done with decrypting the file (do not exit the program or shut down the computer).

Trojan-Ransom.Win32.Rakhni creates the file exit.hhr.oshit which contains the password for decrypting the files in the encrypted form. If the file is preserved on the infected computer, decryption with the RakhniDecryptor tool will take significantly less time. If the exit.hhr.oshit file was deleted, you can try to restore it using special tools and move it to the %APPDATA% folder. After that, you can try runing the tool once again. The exit.hhr.oshit file is usually located in the following folder:

Windows XP: C:\Documents and Settings\<username>\Application Data
Windows Vista/7/8/8.1/10 C:\Users\<username>\AppData\Roaming

The file can be encrypted with the _crypt extension more than once. For example, the file test.doc was encrypted twice. The first encryption layer will be decrypted to test.1.doc.layerDecryptedKLR. In the tool performance report, the line Decryption success: disk:\path\test.doc_crypt -> disk:\path\test.1.doc.layerDecryptedKLR will appear. You will need to decrypt this file using the tool once again. In case of successful decryption, the file will be saved under the original name test.doc.

If the file was encrypted with the _crypt extension, decryption may take a long time. For example, for the Intel Core i5-2400 the procedure may take up to 120 days.

Parameters for running the utility from the command prompt

Was this information helpful?

Yes No

Back to "Virus-fighting tools"

RakhniDecryptor tool for removing Trojan-Ransom.Win32.Rakhni malware (.oshit and others)

Files that can be decrypted with RakhniDecryptor

How to use the tool

Parameters for running the utility from the command prompt

Safety 101: General information

Safety 101: Questions and answers

Safety 101: Protection tips

Safety 101: Virus-fighting tools

RakhniDecryptor tool for removing Trojan-Ransom.Win32.Rakhni malware (.oshit and others)

Files that can be decrypted with RakhniDecryptor

How to use the tool

Parameters for running the utility from the command prompt

Feedback on Technical Support Site

Thank you!

How can we improve this article?

Thank you for your feedback!

For Windows

For Mac

Frequently Asked Questions

For Mobile

Common Articles

Support

Services

For Workstations and Mobile Devices

Cloud solutions

Administration

For Internet Gateways

Free tools

For File Servers

For Mail and Collaboration Servers

For Virtual Environments

Scan your PC for viruses & vulnerabilities

Decrypt the system

Security tips

Restore & disinfect the system

Decrypt files

Helpful tools