The file “!!! READ THIS - IMPORTANT !!!.txt” contains the following ransom note seen in the screenshot below. Additionally, the ransomware creates a key file with name similar to: #9C43A95AC27D3A131D3E8A95F2163088-Bravo _ni_0day in C:ProgramData folder. The HermeticRansom ransomware avoids encrypting files in Program Files and Windows folders to keep the victim’s PC operational. Portable Avast Ransomware Decryption Tools 1.0.0.295 Portable Software Ransomware is a type of malware from cryptovirology that threatens to publish the victim’s personal data or perpetually block access to it unless a ransom is paid. Save it to your desktop and run it later by double-clicking the avastdecryptorglobe.exe icon on your desktop. Avast Decryption Tool for HermeticRansom decrypts the ransomware strain accompanying the data wiper HermeticWiper that has recently been circulating in Ukraine. Download the avastdecryptorRANSOMWARENAME.exe file (e.g., avastdecryptorglobe.exe), then: Click Runto launch the application immediately. In each folder with at least one encrypted file, the file '!!! READ THIS - IMPORTANT !!!.txt' can be found. Avast Decryption Tool for HermeticRansom. BigBobRoss Decryptor is designed to decrypt files encrypted by BigBobRoss Ransom. Make sure you remove the malware from your system first, otherwise it will repeatedly lock your system or encrypt files. TargetCompany ransomware victims can download the decryption tool from Avasts servers (64-bit or 32-bit) to decrypt entire disk partitions using the instructions displayed within the tools user. The ransomware adds one of the following extensions to encrypted files: IMPORTANT Before downloading and starting the solution, read the how-to guide. AES_NI uses AES-256 combined with RSA-2048. There are known multiple variants with different file extensions. All the Avast Decryption Tools are available in one zip here. Avast Decryption Tool for AES_NI can help decrypt the AES_NI ransomware strain.

Avast decryption tool