.WRUI File Extension
STOP WRUI Ransomware Encrypted File
3.0 | 1 Votes
What is a WRUI file?
A WRUI file is a file that has been encrypted by STOP WRUI ransomware, which is malware distributed by cybercriminals. It contains a file, such as an .MP4, .JPG, or .DOCX file, that the virus has renamed and encrypted. WRUI files cannot be opened, and they cannot be decrypted.
In April 2021, some PC users began reporting that their computers had been infected by ransomware that came packaged within the B6F6.exe and MicrosoftToolkit.exe executables. The executables contained several viruses, one of which encrypted many of the users' files and renamed the files to use the .wrui extension.
STOP WRUI ransomware is a variant of STOP Djvu ransomware, which is one of the most common types of ransomware. Other variants of STOP ransomware append users' files with the .STOP, .DJVU, .rumba, .gero, or .CADQ extensions. All variants of STOP ransomware produce ransom messages named _readme.txt in affected folders, which contain instructions a user is supposed to follow to decrypt their files.
How do I open a WRUI file?
WRUI files are encrypted, so you cannot open them. In some cases, you may be able to revert a WRUI file to its original form by renaming it to use its previous extension. For example, you can rename an encrypted JPG from yourjpg.wrui to yourjpg.jpg and attempt to open it. This may allow you to open some of your renamed files but likely will not work on all your files.
While Emsisoft offers a Decryptor for STOP Djvu ransomware, it works only for STOP variants that use offline decryption keys. The WRUI variant uses online decryption keys, so Emsisoft's decryptor cannot decrypt WRUI files.