EdgeLocker .edgel Virus Remove and Decrypt Manual

EdgeLocker .edgel Virus Remove and Decrypt Manual

EdgeLocker crypto virus was recently discovered by security researchers, encrypting victims’ files, appending an .edgel extension to each file and demanding 0.1 bitcoin for the decryption key. Once the encryption process via the RSA algorithm is finalized, EdgeLocker displays a ransom message containing instructions on the payment process.

Threat Summary



Short DescriptionEdgeLocker encrypts files on the targeted system and appends an .edgel extension to each file.
SymptomsA ransom note is dropped on the victim’s computer. A ransom in the amount of 0.1 Bitcoin is demanded.
Distribution Method Spam emails.
Detection Tool See If Your System Has Been Affected by EdgeLocker


Malware Removal Tool

User ExperienceJoin our forum to Discuss EdgeLocker.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

This is what the text on the ransom note reads:

>>> Your files are encrypted by the EdgeLocker ransomware!
>>> Nobody can decrypt your files without a special RSA private key.
>>> YOU can obtain this key by purchasing it for 0.1 Bitcoin from us.
>>> Pay 0.1 BTC on the address 1LVFaPgwCFBnn5BQsSxRmEZ94nKj7tDDVA and then press “Check Payment”
>>> The payment is not recieved instantly; don’t worry.
>>> Key
button “Decrypt”
button “Check Payment”
>>> Warning: do not try to kill this application or the key will be lost!
С :\Users\User\Desktop\test\5.doc.edgel
С :\Users\User\Desktop\test\5.jpg.edgel
С :\Users\User\Desktop\test\5.png.edgel
С :\Users\User\Desktop\test\50.doc.edgel
>>> A total of 3905 files encrypted.

EdgeLocker .edgel Virus Technical Resume


Researchers have observed ransomware such as EdgeLocker being spread primarily in spam emails containing malicious attachments. However, other possible ways of spreading the crypto virus is through exploit kits, fake updates, and infected freeware installers.

Regarding spam, users should be extra cautious and should never open random emails crafted to look like important messages sent out by legal organizations. This is how cyber criminals are trying to trick you into downloading their malicious payloads.


EdgeLocker demands a ransom in the amount of 0.1 bitcoin. The virus instructs the victim how and where to pay it so that a decryption key is sent. Despite these claims that a decryption key will be send once the payment is finalized, victims should not proceed with paying. For one, ransom payments further enable cyber criminals in continuing and developing their malicious operations.

drops the following file onto the infected system: _EdgeLocker___.exe. When the file was scanned via VirusTotal on December 31, 2016, only 2 out of the 55 malware engines detected it as malicious:

  • Baidu – Win32.Trojan.WisdomEyes.16070401.9500.9988
  • Qihoo-360 – HEUR/QVM03.0.0000.Malware.Gen

EdgeLocker .edgel Virus Removal and Decryption Instructions

EdgeLocker file virus, otherwise known as the EdgeLocker ransomware, can be removed manually – the first half of EdgeLocker removal guide below will guide you through the process step by step but don’t forget that at least some experience in malware removal is needed for you to succeed. If you doubt that you can remove the virus yourself, please refer to the instructions for EdgeLocker automatic removal.

As for decryption – for now there is no official decrypter released for EdgeLocker. If you don’t have a back up of your files, you can still attempt restoring them via alternative methods such as data recovery software.


Milena Dimitrova

An inspired writer and content manager who has been with SensorsTechForum for 4 years. Enjoys ‘Mr. Robot’ and fears ‘1984’. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles! Follow Milena @Milenyim

More Posts

Follow Me:

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share