Evil-JS variant ransomware-affected file
File type: Ransomware encrypted file
Files with the .evillock file extension are user files encrypted by a variant of Evil-JS ransomware. The ransomware renames the encrypted files by adding the .evillock suffix.
File type category:
Ransomware encrypted file
Date updated: October 16, 2026
The .evillock file extension is associated with a variant of the Evil-JS ransomware. This variant appeared on January 25, 2017, and is designed to encrypt users' files, rename their extensions, and demand a ransom.
An affected file is not a separate document format. It is an encrypted version of the original user file, and its contents cannot normally be used until the ransomware has been removed and the data decrypted.
An .evillock file cannot normally be opened with a standard application because its contents are encrypted. It requires a working decryption tool for this specific Evil-JS variant, and changing the file extension does not decrypt the file.
No working decrypter is currently identified for this variant of Evil-JS.
The encrypted file cannot be meaningfully converted to another format. If the file is successfully decrypted, the resulting original file can be opened and converted with software that supports its original format.
Language