How to decrypt files encrypted by Sarut ransomware

If you are infected with Sarut ransomware you can try to follow this guide to recover your files that were encrypted.
  1. Upload a sample encrypted file, possible email addresses used for ransom contacts and readme file HERE.
  2. Download STOPDecrypter tool (latest version HERE).
  3. Right click on it and run it as “Administrator”, then you should see this window:

4.  Click on “Select Directory”.

Select your folder(s) in which you have your encrypted file(s).
5.  Click on “Decrypt”.
6.  And then you can recover your files.
NOTE: The decryption of files depends on ransomware variant and on the type of the key used for the encryption. Usually when the files are encrypted with an offline key by Sarut ransomware is possible to decrypt them, instead with an online key, best is to backup your encrypted files and wait for others solutions in future. It is NOT guaranteed that you have your files back if you pay the ransom!

2 thoughts on “How to decrypt files encrypted by Sarut ransomware

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.