ThunderX-Decryptor

The ThunderX ransomware is relatively new, as the first infection cases were reported at the end of August 2020. You can recognize its presence by the ransom note and the “.tx_locked” extension appended to the encrypted files. 

Just one month later, the Tesorion company found a way to unlock files without paying up the ransom and released a dedicated decryption tool, available on the NoMoreRansom platform.

Simply called ThunderX-Decryptor, this application tries to unlock files encrypted by the ThunderX ransomware. It requires no install, so it is up and running once you double click on the executable file.

ThunderX-Decryptor features a straightforward interface with two separate tabs. The first includes a detailed description of all the steps required in order to unlock encrypted files, while the second displays options that allow you to put the usage instructions into practice.

You might think the lack of options and the one-window interface makes this application extremely easy to use. And it is true, as long as you take the time to read the usage instructions, as there are a few steps you have to go through and they are mandatory.

The first step you need to take is uploading the ransom note, a text file named “readme.txt” that should be present in all the folders that contain encrypted files. In case this step is not enough to get the decryption key, you will be prompted to also upload one of the encrypted files, in DOCX, PPTX, XLSX or ZIP format, in the second step.

The files are sent to a centralized server, which processes them and tries to reveal the decryption key. Last but not least, you must browse for a folder to unlock and the ThunderX-Decryptor will parse it recursively, scanning for encrypted files and unlocking all using the key it found. Depending on the work volume, this operation might take a very long time to complete.

The ThunderX-Decryptor comes in handy to victims of the ThunderX ransomware, allowing the decryption of locked files without having to pay up the ransom requested by the cybercriminals. While it provides no guarantee that the files will fully match the originals, neither does paying up the ransom. It is definitely worth a try.