Decrypt the WannaCry Ransomware Without Paying the Ransom

Great news for the thousands of infected computers and users who fell prey to the WannaCry ransomware attack–you can now decrypt your files without paying the $300 bitcoin ransom.

The Hacker News reports that the decryption tool can be credited to Adrien Guinet, a French security researcher working for Quarkslab. The tool, called WannaKey, can be downloaded from GitHub for free, but only works on Windows XP.

However, there are a couple other potential hold-ups. The decryption tool will only work if:

  1. The WannaCry infected computer has not been rebooted after infection.
  2. The associated memory (containing the WannaCry encryption keys) has not been allocated or erased by another computer process.

Need A WannaCry Decryption Tool for Windows 7?

Fear not, the foundation laid by Guinet allowed for a breakthrough by another security researcher, Benjamin Delpy. Delpy developed a more user friendly tool called WanaKiwi that will work on infected computers running Windows XP, Windows 7, Windows Vista, or Windows Server 2003 and 2008.

Matt Suiche of security firm Comae Technologies has provided tutorial materials demonstrating how to use WannaKiwi to decrypt your files.

Still need help?

Don’t hesitate to contact us. We’re happy to help.