Decrypt Files Encrypted by Shade .Xtbl Ransomware - How to, Technology and PC Security Forum |

Decrypt Files Encrypted by Shade .Xtbl Ransomware

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)

ransomware-encryption-explained-stockhoto-stforumFile extensions .better_call_saul;.breaking bad;.heisenberg;.xtbl;.ytbl are just some of the expansions associated with the nasty Shade ransomware virus. There have been many variants ever since one of the first CrySiS variant has appeared, and many have the reason to believe that all variants associated with this virus have been created by the very same hacking team for one thing – profit. Malware researchers continue to discover even newer variants of the virus, all with different modifications distinguishable to them. The good news is that Kaspersky malware researchers have successfully created ransomware decryptor for the Share ransomware which should be able to recover files encoded by this virus successfully. This is where we have decided to create instructions on how to use Kaspersky’s Shade Decryptor and hopefully decrypt your files in case they have been encoded by this crypto virus.

Shade Ransomware – A Bit Of Background

The Shade also known as Troldesh Ransomware is a virus that has been first detected in September 2015. Back then, the virus used the discontinued now Nuclear Exploit Kit to infect users on a massive scale. Nuclear EK is now dead, but Shade is long from being that. Many new variants of this virus have now appeared, and they use new techniques, like modified EK and even brute forcing to infect your computer. Here are some of the viruses related to Shade:

These many viruses may be very different, but there are several symptoms like the encryption used, the files created by them and some folders they are dropped in, that unify them, driving researchers into believing that they are all Trolldesh / Shade ransomware variants. Luckily Kaspersky has released a decryptor for those viruses and victims by them may be in luck.

Shade Ransomware – Removal and Decryption Instructions

Phase 1 – Removal

Before you attempt any form of decryption, it is advisable that you remove this virus from your computer firstly, to be safe. We have provided a fast removal manual that will help you locate and delete the files of the Shae ransomware virus before starting the decryption process.


Ventsislav Krastev

Ventsislav has been covering the latest malware, software and newest tech developments at SensorsTechForum for 3 years now. He started out as a network administrator. Having graduated Marketing as well, Ventsislav also has passion for discovery of new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management and then Network Administration, he found his passion within cybersecrurity and is a strong believer in basic education of every user towards online safety.

More Posts - Website


  1. AvatarManish Singh

    The kaspersky Shade decryptor does not work. It even cannot identify that the file is encrypted.

    1. AvatarVencislav Krustev

      Hello, Manish, it is very unfortunate that it does not work for you. Since your variant may be diferent than the conventional Shade viruses, I urge you to try EmsiSoft’s decrypter:

      Get back to us with your experience!


Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share