.WNCRY File

A WNCRY file is a file encrypted by Wana Decrypt0r 2.0, a ransomware infection utilized by cybercriminals. It contains a user's file, such as a .BAT, .BMP, .WAV, or .XLSX file, encrypted with the RSA algorithm and AES-128 ciphers. WNCRY files became prevalent in 2017.

Wana Decrypt0r 2.0 is a newer version of the WannaCry (WCry) malware and is highly dangerous. The purpose of the virus is to take your files hostage and force you to pay the perpetrator (by way of bitcoin) to unlock your files. The virus may be spread through fake updates or torrent websites but is primarily spread via emails designed to coax the victim into opening a malicious email attachment. Once the virus affects your computer it begins scrambling your files, renaming them, and encrypting them. It appends the WNCRY extension on to the file extension. For example, your example.docx file becomes example.docx.wncry. The virus then generates a .TXT ransom note informing you of the takeover and what you need to do to recover your files.

There is no program currently available to effectively restore your files. If you backup your files you can execute a full system restore. Otherwise, the only known way to decrypt your infected files is to pay the perpetrator for the private key and decrypt program.