The official LooCipher ransomware decoder has been released, helping you to retrieve data completely free

Recently, a decoder for LooCipher extortion malicious code has been officially released by security company Emsisoft, allowing this ransomware victim to decrypt their files for free. If your computer or your company is infected with LooCipher, don't rush to pay the ransom and instead, follow the steps in this article.

If you don't know, LooCipher is infected and installed on the victim's system through malicious Word documents, can download the malicious executable file and run the file in the system. Once executed, ransomware will immediately encrypt all the data on the victim's computer and concatenate the .lcphr extension to the names of all encrypted files.

Then, this blackmail code will automatically show the new desktop with the main image of the LooCipher Decoder (LooCipher Decryptor) containing the countdown until your key is deleted, as well as a button to check if ransom payment has been made or not.

1. Ransomware (ransomware) is showing signs of explosion worldwide, paying is no longer the most effective option.

Message of LooCipher malicious code

If your computer encounters all of the above phenomena, follow the instructions below to retrieve encrypted files without spending a cent.

Decode ransomware LooCipher

If your computer has been infected with LooCipher and still has intact files that have been encrypted, just download the program decrypt_LooCodes.exe from the link: https://www.emsisoft.com/decrypter/loocipher. Then save this program right on the desktop. This decoder was developed by renowned security expert Michael Gillespie, with support from another experienced network intelligence researcher, Francesco Muroni.

The decoder does not require the LooCipher.exe program to work together while decrypting the file, so if you find the program running in the background, you should terminate the process and delete the file after it has been installed to avoid encountered an error.

1. FBI released the key decryption key for GandCrab Ransomware

After successfully downloading decrypt_LooCodes.exe to your computer, run this program with administrative privileges to decrypt all encrypted LooCipher files on the system. Click to agree to the license agreement and you will be redirected to the bruteforcer screen. Here, the program will ask you to select an encrypted file and the same file in unencrypted form, as shown below.

Select the sample file folder to prepare the process for retrieving the decryption key

If you do not select the encrypted / unencrypted folder as above, it is best to use some sample images stored in the C: UsersPublicPicturesSample Pictures folder. These images are often encoded by ransomware when it spreads on the system, but the unencrypted version can also be easily 'borrowed' from another computer, since almost every windows device is available. contains these images.

In case you can't 'borrow' these images, you can download the sample images archive of Windows 7 here: https://doad.bleepingcomputer.com/public-sample-pictures/sample-pics .zip.

After you've selected the required files, click the Start button to begin the process of retrieving the decryption key. This process may take some time, please wait patiently.

1. Ryuk Ransomware added "selective" encryption capabilities.

The process of taking the decryption key LooCipher ransomware

When a decryption key has been found, the program will display this decryption key in a small warning as shown below.

The message found the decryption key

Click the OK button and the decoder will reboot with the decrypted key already available.

Key decoding screen

After restarting, the decoder is ready to embark on the main task. Click on the Decrypt button to start the local decoding process on the system. The decoder will automatically search for files that are encrypted by ransomware being stored on the system (owning the .lcphr extension) and immediately decrypt them.

1. Shade ransomware, the nightmare of 5 years ago is showing signs of returning

File decoding list

After the decryption process is complete, the Results tab will revert to Finished, and all your files will now be successfully decoded.

Above is the whole process of ransomware LooCipher decoding, wish you success!