Avast Decryption Tool for DoNex allows you to decrypt files held hostage by the DoNex ransomware strain. All the Avast Decryption Tools are available in one zip here.

The DoNex ransomware has undergone several rebranding efforts, with the first iteration, known as Muse, emerging in April 2022. Over time, it evolved into the current version, DoNex. However, since April 2024, there have been no signs of further evolution, and no new ransomware samples have been detected. Additionally, the TOR site associated with the ransomware has been inaccessible.

When a DoNex ransomware infection occurs, it creates an encryption key using the 'CryptGenRandom()' function. This key is then used to initialize a ChaCha20 symmetric key, which encrypts the targeted files. There is also a ransom note, which is viewable from the last screenshot.

When initiating decryption, it is advisable to back up the encrypted files just in case you run into an issue. The decryptor provides this option.

Following the file encryption process, the ChaCha20 key undergoes an additional layer of encryption using the specified identifier RSA-4096. This encrypted key is then appended to the end of each file.

Similar:
● Which Anti-Malware App Is Best and Can It Run Alongside My Antivirus
● What's the Best Antivirus and Is Windows Defender Good Enough?
● How to Manage Windows Defender Antivirus Found Threats
● What to Do When Your Norton or McAfee Antivirus Expire