- Avast, a cybersecurity software company, has recently released a free decryptor to help victims of BianLian ransomware attacks.
- This tool is available for free and can be used by anyone who has been affected by the BianLian ransomware.
- The tool can currently only help people who have been affected by a known variation of the BianLian ransomware.
After Bitdefender offered a free ransomware decryptor for MegaCortex, cybersecurity software company Avast has also released a free decryptor, which is for the BianLian ransomware. BianLian is a ransomware that has been making headlines in recent months. It is a type of malicious software that encrypts files on an infected computer and then demands payment in order to decrypt them.
How BianLian works
Avast reports that BianLian searches all available disk drives upon execution (from A: to Z:). It searches all drives for files and encrypts any whose file extension matches one of the 1013 extensions hardcoded into the ransomware binary. Following data encryption, the ransomware appends the .bianlian extension to each folder on the PC and drops a ransom note called “Look at this instruction.txt” into each folder.
When the encryption is complete, the ransomware deletes itself. Only files encrypted by a known variation of the BianLian ransomware can be recovered by the free decryptor supplied by Avast. According to Avast telemetry, common names of the BianLian ransomware file on the victim’s PC include:
How to use the free decryptor
Step 1: Download the decryptor
Simply follow the link below to download the Avast Decryption Tool for BianLian from Avast’s official website:
Download Avast Decryption Tool for BianLian
Step 2: Run the decryptor
Now you have initiated the installation process of the decryptor. You might want to check the license information if you are interested.
Step 3: Choose locations
Choose the locations you want to be searched and decrypted from the list on the following page. It includes a list of all local drives by default:
Step 4: Upload files
On the third page, you must upload a file that has been encrypted by the BianLian ransomware and its original file. Specify the file names for both files.
Step 5: Passwords are tested
The password-cracking process begins on the following page. All known BianLian passwords are tested as part of the password-cracking process to find the right one.
Step 6: Wait for the decryptor to complete
When the password is discovered, click Next to continue and decrypt all the encrypted files on your computer. You have the option to back up your encrypted files on the last page. If anything goes wrong during the decryption process, these backups might be useful. Wait for the decryptor to complete decrypting all of your files.