Tool for decrypting files affected by Trojan-Ransom.Win32.Rannoh


General articles: Recovery tools


Tool for decrypting files affected by Trojan-Ransom.Win32.Rannoh

Back to "Recovery tools"
Latest update: July 01, 2021 ID: 8547

Do you want to prevent infections? Install Kaspersky Internet Security.

Kaspersky RannohDecryptor is a free tool for decrypting files affected
by Trojan-Ransom.Win32.Rannoh. To download RannohDecryptor, click Download.


RannohDecryptor tool is designed to decrypt files encrypted by the following ransomware:

  • Trojan-Ransom.Win32.Rannoh
  • Trojan-Ransom.Win32.AutoIt
  • Trojan-Ransom.Win32.Cryakl
  • Trojan-Ransom.Win32.CryptXXX version 1, 2, and 3
  • Trojan-Ransom.Win32.Crybola
  • Trojan-Ransom.Win32.Polyglot
  • Trojan-Ransom.Win32.Fury

In case of an infection, all files on the computer will be changed as follows:

Ransomware How files will be encrypted
Trojan-Ransom.Win32.Rannoh File names and extensions will be changed according to the template locked-<original_name>.<four_random_letters>.
Trojan-Ransom.Win32.AutoIt Extensions will be changed according to the template <original_name>@<mail server>_.<random_set_of_characters>. For example, ioblomov@india.com_.RZWDTDIC.
Trojan-Ransom.Win32.Cryakl The tag {CRYPTENDBLACKDC} is added to the end of file names.
Trojan-Ransom.Win32.CryptXXX Extensions will be changed according to the templates:
  • <original_name>.crypt
  • <original_name>.crypz
  • <original_name>.cryp1
Trojan-Ransom.Win32.Crybola Extensions will be changed according to the template <original_name>.ebola.

The other ransomware does not change file extensions.

If you want to decrypt files affected by Trojan-Ransom.Win32.CryptXXX, take into account the following: 

  • RannohDecryptor utility scans a limited number of file formats:
  • 1cd, 7z, ai, avi, bz2, cab, cdr, cdw, cdx, cf, chm, dbf, djvu, doc, docm, docx, dt, dwg, epf, eps, erf, ert, fla, flac, flv, gif, gz, html, iso, jpeg, jpg, ldf, md, mdb, mdf, mov, mp3, mp4, mxl, nef, ods, odt, ogg, pdf, php, png, ppt, pptm, pptx, ps1, psd, pst, qbb, rar, rcf, rtf, sdf, sldasm, slddrw, tib, tif, tiff, vhd, vhdx, vsd, wav, xls, xlsm, xlsx, xlt, zip.
  • It may take a long time to restore the key for decrypting files affected by Trojan-Ransom.Win32.CryptXXX version 2. In this case, the utility displays a warning:

Key recovery can take a long time warning


How to disinfect the system


How to use the tool through the command line


What to do if the tool did not help

Was this information helpful?
Yes No
Thank you


How can we improve this article?

Your feedback will be used for content improvement purposes only. If you need assistance, please contact technical support.

Submit Submit

Thank you for your feedback!

Your suggestions will help improve this article.