I've got an emergency on my PC. I remotely connected to it using Remote Desktop Connection a couple of days ago and I worked on my PC for a while and logged off. Later, when I went to log back on, I discovered there was a virus and all my files were encrypted. I discovered it was LockBit 3.0 and saw this post: LockBit 3.0 Ransomware Unlocked. It showed that the LockBit build was leaked. I downloaded the LockBit builder files and ran the builder. Once, I ran the builder, the decryptor was inside as LB3Decryptor.exe. I have my decryption ID and now I have the decryptor. Is there some way I can decrypt my files?

I uploaded the builder files here if anyone wants to mess with it: LockBit builder files. You have to run the build.bat and then everything will be inside the "Build" directory.


1 Answer 1


What you have is not the decryptor, but a builder. It will not be used to decrypt the files already encrypted, because it don't look like there's a master key or private key on it. If you look at the config.json file on that repository, you will see a blank key.

The leaked files are helpful for decoding the logic of the ransomware, but if you don't have the keys, you don't have any way to decrypt the data.

  • Take a look at my post again. I guess I didn't make it clear the first time. I have the decryptor. But, you're saying I can't decrypt without the private key Mar 10, 2023 at 0:15
  • 1
    Yes. You will build both the encryptor and the decryptor, but without the key you cannot decrypt anything.
    – ThoriumBR
    Mar 10, 2023 at 0:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .