Tool for decrypting files affected by Trojan-Ransom.Win32.Rannoh

Latest update: September 18, 2023 ID: 8547
 
 

Do you want to prevent infections? Be safe and private with new Kaspersky applications.

Kaspersky RannohDecryptor is a free tool for decrypting files affected by Trojan-Ransom.Win32.Rannoh.
To download RannohDecryptor, click Download.

 
 
 

RannohDecryptor tool is designed to decrypt files encrypted by the following ransomware:

  • Trojan-Ransom.Win32.Rannoh
  • Trojan-Ransom.Win32.AutoIt
  • Trojan-Ransom.Win32.Cryakl
  • Trojan-Ransom.Win32.CryptXXX version 1, 2, and 3
  • Trojan-Ransom.Win32.Crybola
  • Trojan-Ransom.Win32.Polyglot
  • Trojan-Ransom.Win32.Fury
  • Trojan-Ransom.Win32.Yanluowang

In case of an infection, all files on the computer will be changed as follows:

Ransomware How files will be encrypted
Trojan-Ransom.Win32.Rannoh File names and extensions will be changed according to the template locked-<original_name>.<four_random_letters>.
Trojan-Ransom.Win32.AutoIt Extensions will be changed according to the template <original_name>@<mail server>_.<random_set_of_characters>. For example, ioblomov@india.com_rzwdtdic.
Trojan-Ransom.Win32.Cryakl The tag {CRYPTENDBLACKDC} is added to the end of file names.
Trojan-Ransom.Win32.CryptXXX Extensions will be changed according to the templates:
  • <original_name>.crypt
  • <original_name>.crypz
  • <original_name>.cryp1
Trojan-Ransom.Win32.Crybola Extensions will be changed according to the template <original_name>.ebola.
Trojan-Ransom.Win32.Yanluowang Extensions will be changed according to the template <original_name>.yanluowang.

The other ransomware does not change file extensions.

If you want to decrypt files affected by Trojan-Ransom.Win32.CryptXXX, take into account the following: 

  • RannohDecryptor utility scans a limited number of file formats:
  • 1cd, 7z, ai, avi, bz2, cab, cdr, cdw, cdx, cf, chm, dbf, djvu, doc, docm, docx, dt, dwg, epf, eps, erf, ert, fla, flac, flv, gif, gz, html, iso, jpeg, jpg, ldf, md, mdb, mdf, mov, mp3, mp4, mxl, nef, ods, odt, ogg, pdf, php, png, ppt, pptm, pptx, ps1, psd, pst, qbb, rar, rcf, rtf, sdf, sldasm, slddrw, tib, tif, tiff, vhd, vhdx, vsd, wav, xls, xlsm, xlsx, xlt, zip.
  • It may take a long time to restore the key for decrypting files affected by Trojan-Ransom.Win32.CryptXXX version 2. In this case, the utility displays a warning:

Key recovery can take a long time warning

 
 
 
 

How to disinfect the system

 
 
 
 

How to use the tool through the command line

 
 
 
 

What to do if the tool did not help

 
 
 
 
 
 
 

Useful references

Free disinfection tools

 
 
Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.