Tool for decrypting files affected by Trojan-Ransom.Win32.Rannoh

Latest update: April 12, 2022 ID: 8547

Do you want to prevent infections? Install Kaspersky Internet Security.

Kaspersky RannohDecryptor is a free tool for decrypting files affected
by Trojan-Ransom.Win32.Rannoh. To download RannohDecryptor, click Download.


RannohDecryptor tool is designed to decrypt files encrypted by the following ransomware:

  • Trojan-Ransom.Win32.Rannoh
  • Trojan-Ransom.Win32.AutoIt
  • Trojan-Ransom.Win32.Cryakl
  • Trojan-Ransom.Win32.CryptXXX version 1, 2, and 3
  • Trojan-Ransom.Win32.Crybola
  • Trojan-Ransom.Win32.Polyglot
  • Trojan-Ransom.Win32.Fury
  • Trojan-Ransom.Win32.Yanluowang

In case of an infection, all files on the computer will be changed as follows:

Ransomware How files will be encrypted
Trojan-Ransom.Win32.Rannoh File names and extensions will be changed according to the template locked-<original_name>.<four_random_letters>.
Trojan-Ransom.Win32.AutoIt Extensions will be changed according to the template <original_name>@<mail server>_.<random_set_of_characters>. For example, ioblomov@india.com_.RZWDTDIC.
Trojan-Ransom.Win32.Cryakl The tag {CRYPTENDBLACKDC} is added to the end of file names.
Trojan-Ransom.Win32.CryptXXX Extensions will be changed according to the templates:
  • <original_name>.crypt
  • <original_name>.crypz
  • <original_name>.cryp1
Trojan-Ransom.Win32.Crybola Extensions will be changed according to the template <original_name>.ebola.
Trojan-Ransom.Win32.Yanluowang Extensions will be changed according to the template <original_name>.yanluowang.

The other ransomware does not change file extensions.

If you want to decrypt files affected by Trojan-Ransom.Win32.CryptXXX, take into account the following: 

  • RannohDecryptor utility scans a limited number of file formats:
  • 1cd, 7z, ai, avi, bz2, cab, cdr, cdw, cdx, cf, chm, dbf, djvu, doc, docm, docx, dt, dwg, epf, eps, erf, ert, fla, flac, flv, gif, gz, html, iso, jpeg, jpg, ldf, md, mdb, mdf, mov, mp3, mp4, mxl, nef, ods, odt, ogg, pdf, php, png, ppt, pptm, pptx, ps1, psd, pst, qbb, rar, rcf, rtf, sdf, sldasm, slddrw, tib, tif, tiff, vhd, vhdx, vsd, wav, xls, xlsm, xlsx, xlt, zip.
  • It may take a long time to restore the key for decrypting files affected by Trojan-Ransom.Win32.CryptXXX version 2. In this case, the utility displays a warning:

Key recovery can take a long time warning


How to disinfect the system


How to use the tool through the command line


What to do if the tool did not help


Useful references

Free disinfection tools

Did you find what you were searching for?
Thank you for your feedback!