Avast Decryption Tool for HiddenTear can unlock HiddenTear, one of the first open-sourced ransomware codes hosted on GitHub and dating back to August 2015. All the Avast Decryption Tools are available in one zip here.
Since then, hundreds of HiddenTear variants have been produced by crooks using the source code. HiddenTear uses AES encryption.
Encrypted files will have one of the following extensions (but not limited to): .locked, .34xxx, .bloccato, .BUGSECCCC, .Hollycrypt, .lock, .saeid, .unlockit, .razy, .mecpt, .monstro, .lok, .ì•”í˜¸í™”ë¨, .8lock8, .fucked, .flyper, .kratos, .krypted, .CAZZO, .doomed.
After encrypting files, a text file (READ_IT.txt, MSG_FROM_SITULA.txt, DECRYPT_YOUR_FILES.HTML) appears on the user's desktop. Various variants can also show a ransom message. Because it was open source, the images can vary, as seen below.