By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
10alert.com10alert.com
  • Threats
    • WordPress ThreatsDanger
    Threats
    A cyber or cybersecurity threat is a malicious act that seeks to damage data, steal data, or disrupt digital life in general. Cyber threats include…
    Show More
    Top News
    Seven Steps to Recover from Scareware
    8 months ago
    Protecting Computers and Smartphones from Cryptolocker, Pletor aka Simplocker and Other Ransomware
    8 months ago
    Facebook Messenger: The New Platform to Rule Them All
    8 months ago
    Latest News
    Triangulation: Trojan for iOS | Kaspersky official blog
    5 days ago
    Wordfence Intelligence Weekly WordPress Vulnerability Report (May 22, 2023 to May 28, 2023)
    5 days ago
    Safeguards against firmware signed with stolen MSI keys
    7 days ago
    WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin
    7 days ago
  • Fix
    Fix
    Troubleshooting guide you need when errors, bugs or technical glitches might ruin your digital experience.
    Show More
    Top News
    How to enable DNS over HTTPS in Chrome
    8 months ago
    How to check Windows Update history on Windows 10
    8 months ago
    Windows 10 update KB5011543 (build 19044.1620) brings search highlights
    8 months ago
    Latest News
    How automatically delete unused files from my Downloads folder?
    4 months ago
    Now you can speed up any video in your browser
    4 months ago
    How to restore access to a file after EFS or view it on another computer?
    4 months ago
    18 Proven Tips to Speed Up Your WordPress Site and Improve SEO | 2023 Guide
    5 months ago
  • How To
    How ToShow More
    Nine years of Project Galileo and how the last year has changed it
    Nine years of Project Galileo and how the last year has changed it
    17 hours ago
    Dynamic data collection with Zaraz Worker Variables
    Dynamic data collection with Zaraz Worker Variables
    4 days ago
    Reduce latency and increase cache hits with Regional Tiered Cache
    Reduce latency and increase cache hits with Regional Tiered Cache
    5 days ago
    Cloudflare is deprecating Railgun
    Cloudflare is deprecating Railgun
    5 days ago
    What is two-factor authentication | Kaspersky official blog
    1 week ago
  • News
    News
    This category of resources includes the latest technology news and updates, covering a wide range of topics and innovations in the tech industry. From new…
    Show More
    Top News
    How to check your hearing through the application
    8 months ago
    Canva Suffers Data Breach Affecting 139 Million Users
    8 months ago
    Make Woocommerce product not purchasable
    8 months ago
    Latest News
    How to generate SSH keys on Windows 11
    7 hours ago
    How to enable file sharing on WSA for Windows 11
    7 hours ago
    How to add CPU, GPU, RAM widgets on Windows 11
    4 days ago
    How to create virtual drive (VHD, VHDX, Dev Drive) on Windows 11
    1 week ago
  • Glossary
  • My Bookmarks
Reading: How to decrypt files encrypted by the Shade ransomware
Share
Notification Show More
Aa
Aa
10alert.com10alert.com
  • Threats
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
  • Threats
    • WordPress ThreatsDanger
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
Follow US
AppsThreatsWordpress Threats

How to decrypt files encrypted by the Shade ransomware

Vitus White
Last updated: 13 October
Vitus White 8 months ago
Share
4 Min Read

Last year, we joined forces with Dutch law enforcement to launch the NoRansom website, which helps victims of CoinVault ransomware restore access to their data. Later, we enhanced the website with a couple of other free tools to restore files encrypted by other cryptors such as TeslaCrypt, CryptXXX, and others like them.

Contents
ShadeGet the free decryptor

Today we’re taking another big step in our crusade against ransomware. Together with the Dutch police, Europol, and Intel Security, we created NoMoreRansom.org, a website where we plan to aggregate the widest selection of decryptors available anywhere.

We are starting by adding another virus cure to the website — one to help victims of Shade ransomware to restore their files. We offer it, like the others, free of charge.

Shade

Shade is a family of ransomware cryptors that emerged in early 2015. Shade Trojans use malicious spam or exploit kits as primary attack vectors. The latter is the more hazardous method because a victim does not have to open any files — a single visit to an infected website does the trick.

When the ransomware infiltrates a victim’s system, the Trojan requests an encryption key from the criminal’s command-and-control (C&C) server — or, should the server be unavailable, uses one of the keys embedded in advance. That means, even if the PC is disconnected from the Internet, the ransomware functions, provided it’s already in the system.

The malware then starts encrypting files. It affects more than 150 formats, including Microsoft Office files, images, and archives. When encrypting, Shade adds a .xtbl or .ytbl extension to the file name. Once the encryption process is complete, a ransom note appears on the screen.

Shade cryptor ransom demand

As if the file encryption was not bad enough, the ransomware continues on its rampage: While the victim panics and searches for a decryptor — or money for ransom — Shade keeps busy, downloading other malware onto the compromised PC.

Get the free decryptor

If you were unlucky enough to fall victim to Shade, we have a spot of good news for you: We can spare you the temptation to pay ransom to get your encrypted files back. Here’s what to do:

1. Go to NoMoreRansom.org.

2. Scroll down and find the two download buttons for decryptors. You may choose the decryptor from Intel Security or Kaspersky Lab. The following instructions are for our own decryptor, however.

3. Unzip the downloaded file, ShadeDecryptor.zip.

4. Run ShadeDecryptor.exe.

5. In the Kaspersky ShadeDecryptor window, click Change Parameters.

Shade decryptor user manual

6. Choose which drives the utility should check for encrypted files.

7. In the same window, you may also choose “Delete crypted files after decryption,” but we do not recommend doing that until you are 100% sure your files have been restored.

Shade decryptor user manual

8. Click “ОК” to return to the main screen. Click Start scan.

Shade decryptor user manual

9. In the “Specify the path to one of encrypted files” window, choose one of the encrypted files and click “Open.”

10. If the utility says it cannot automatically detect the victim’s ID, specify the file path to the readme.txt file, which is essentially the ransom note and which contains the ID in question.

Now your files should be decrypted. Enjoy the money you just saved! And to protect yourself from ransomware attacks in the future, use a robust security solution, such as Kaspersky Internet Security. For additional guidance on ransomware check out this post.


Source: kaspersky.com

Translate this article

TAGGED: Encryption, Malware, Microsoft, Microsoft Office, RC4, Security, Split tunneling, Targeted Attack, Threats
Vitus White October 13, 2022 October 7, 2022
Share this Article
Facebook Twitter Reddit Telegram Email Copy Link Print

STAY CONECTED

24.8k Followers Like
253.9k Followers Follow
33.7k Subscribers Subscribe
124.8k Members Follow

LAST 10 ALERT

How to generate SSH keys on Windows 11
News 10 hours ago
How to enable file sharing on WSA for Windows 11
News 10 hours ago
Nine years of Project Galileo and how the last year has changed it
Nine years of Project Galileo and how the last year has changed it
Apps 17 hours ago
Dynamic data collection with Zaraz Worker Variables
Dynamic data collection with Zaraz Worker Variables
Apps 4 days ago
How to add CPU, GPU, RAM widgets on Windows 11
News 5 days ago

Recent Posts

  • How to generate SSH keys on Windows 11
  • How to enable file sharing on WSA for Windows 11
  • Nine years of Project Galileo and how the last year has changed it
  • Dynamic data collection with Zaraz Worker Variables
  • How to add CPU, GPU, RAM widgets on Windows 11

You Might Also Like

News

How to generate SSH keys on Windows 11

10 hours ago
Nine years of Project Galileo and how the last year has changed it
Apps

Nine years of Project Galileo and how the last year has changed it

17 hours ago
Dynamic data collection with Zaraz Worker Variables
Apps

Dynamic data collection with Zaraz Worker Variables

4 days ago
Reduce latency and increase cache hits with Regional Tiered Cache
Apps

Reduce latency and increase cache hits with Regional Tiered Cache

5 days ago
Show More

Related stories

How to Use Cloudflare to Secure Your WordPress Site
How To Starting Chrome from the command line
How to fix error 0x80070057 in Chrome?
Windows 10 How To Disable Slide to Shutdown
Windows search not working (FIX)
How to watch movies and TV series for free on Kinopoisk?
Previous Next

10 New Stories

Reduce latency and increase cache hits with Regional Tiered Cache
Cloudflare is deprecating Railgun
Triangulation: Trojan for iOS | Kaspersky official blog
Wordfence Intelligence Weekly WordPress Vulnerability Report (May 22, 2023 to May 28, 2023)
Safeguards against firmware signed with stolen MSI keys
WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin
Previous Next
Hot News
How to generate SSH keys on Windows 11
How to enable file sharing on WSA for Windows 11
Nine years of Project Galileo and how the last year has changed it
Dynamic data collection with Zaraz Worker Variables
How to add CPU, GPU, RAM widgets on Windows 11
10alert.com10alert.com
Follow US

© 10 Alert Network. All Rights Reserved.

  • Privacy Policy
  • Contact
  • Customize Interests
  • My Bookmarks
  • Glossary
Go to mobile version
adbanner
AdBlock Detected
Our site is an advertising supported site. Please whitelist to support our site.
Okay, I'll Whitelist
Welcome Back!

Sign in to your account

Lost your password?