Please note that these free tools are provided as-is and without warranty of any kind. The tools may only work with specific ransomware versions, and may not work with versions that were released after a tool was created. Technical support for the tools is available only to customers using a paid Emsisoft product.
The Al-Namrood ransomware is a fork of the Apocalypse ransomware. The group behind it primarily attacks servers that have remote desktop services enabled. Encrypted files are renamed to *.unavailable or *.disappeared and for each file a ransom note is created with the name *.Read_Me.Txt. The ransomware asks the victim to contact "[email protected]" or "[email protected]". An example can be found below:
Hello!
All your files was encrypted.
If you wanna recover your files contact me as soon as possible:
[email protected]
Your ID: B5584071
You have few days for contact me, then all your files will be lost.
If you dont get answer more than 24 hours - try any public mail service for contact me(like gmail or yahoo).
Regards.
To decrypt your files the decrypter requires your ID. The ID can be set within the "Options" tab. By default the decrypter will set the ID to the ID that corresponds to the system the decrypter runs on. However, if that is not the same system the malware infection and encryption took place on, make sure to put in the ID as specified in the ransom note.