How to decrypt files after BTCWare Gryphon?

Question

My PC got affected by BTCWare Gryphon.

I have tried different software such as Data Recovery Pro, 360 Document Protector, Kaspersky, and so on, but they couldn't help me.

ID Ransomware claims that there is no decryptor for this ransomware:

This ransomware has no known way of decrypting data at this time.

It is recommended to backup your encrypted files, and hope for a solution in the future.

_{Identified by sample_extension: .[<email>].gryphon}

Is it true that there's no decryptor for this ransomware? Otherwise, how to decrypt it?

Answer 1

If you follow the "more information" link on the page that you linked, you will reach a forum thread where someone has posted a decrypter. However, it seems that it only works for specific variants of the virus. When the poster says that there's no way of decrypting files affected by the AES version, they really mean there is nothing you can do to get your files back short of either paying the ransom or waiting for years or decades until technology advances far enough to break AES.

Answer 2

I will second Nnnes opinion. While some people claim that an actual decryptor exists, honestly, there is nothing you can do to reliably recover your files. Oh and obviously, decryptor doesn't work. The best steps for the approach are to remove your malware using Malwarebytes and Hitman Pro with the addition of anti-virus scan of your choice.

The couple solutions you can try are Shadow Explorer or System Restore point. You can read more about them and general removal here.

And it is always good to educate yourself on how everything works. Following a couple of malware, researchers on social media will keep you informed of the available decryptors and potential threats.