Emsisoft Decryptor for Ragnarok

It sometimes happens that ransomware gangs shut down their operations and release a decryption key or even a standalone decryption tool for the victims to unlock their files. This is exactly what happened with the authors of the Ragnarok ransomware.

But even if the decryption tool is out there, that does not mean that you should rush to use it right away. On the contrary, given the faulty reputation of its authors, it is highly recommended you don’t trust it and wait for the security experts to analyze it beforehand. Usually, in a few days, some security company releases a dedicated decryption tool that is safe to use.

This is the case with the Ragnarok ransomware mentioned before. After its authors released a free decryption utility on their web, Emsisoft created the Emsisoft Decryptor for Ragnarok.

The name of the application speaks for itself: it is a dedicated decryptor designed to unlock files previously encrypted by the Ragnarok ransomware. Keep in mind that you should make sure that the malware is quarantined using a reliable antivirus solution before using the decryptor, or else new files might get encrypted.

Emsisoft Decryptor for Ragnarok is, in fact, a tool that runs a brute force attack on a pair of files, one encrypted and its original counterpart. If you cannot provide such a pair of files, you can also try to run the attack on a ransom note on your computer. The analysis shouldn’t take long and, soon enough, a notification message with the decryption key should be displayed.

Once it finds the key, Emsisoft Decryptor for Ragnarok allows you to select the location of the encrypted files. The connected drives are added to the list by default, but you can also fill in new locations. All that is left for you to do is hit the “Decrypt” button and the application starts looking for encrypted files to unlock them.

A log is displayed in the “Results” tab, where you can see which file has been decrypted and which not. Since the decryptor cannot fully guarantee that the decrypted files are identical to the originals, you should opt to preserve the encrypted files in the “Options” tab.

Ragnarok encrypts files using two encryption algorithms: AES-256 and RSA-4096. You can recognize its presence if you find files that cannot be accessed and have one of the following appended extensions: "..thor" or "..hela". In that case, you can download and try the Emsisoft Decryptor for Ragnarok to try and recover your data.