Merry X-Mas ransomware-affected file
File type: Ransomware encrypted file
Files with the .RARE1 file extension are original user files encrypted and renamed by the Merry X-Mas ransomware.
The extension identifies an affected file, not a standalone file format.
File type category:
Ransomware encrypted file
Date updated: October 14, 2026
The .RARE1 file extension is associated with a type of ransomware that first appeared in early January 2017 and is known as Merry X-Mas.
A .RARE1 file contains an original user file whose contents have been encrypted and whose name has been changed by the ransomware. The ransom note created by the infection is named YOUR_FILES_ARE_DEAD.hta.
Emsisoft Decryptor for MRCR is Microsoft Windows software designed to decrypt files affected by this ransomware. After successful decryption, the original file can be used normally; .RARE1 is an infection-related suffix rather than a format intended for continued use.
Do not try to open a .RARE1 file with a regular document or media program. Use Emsisoft Decryptor for MRCR on Microsoft Windows to attempt to decrypt the file.
After decryption, open the recovered file with the program associated with its original file type.
A .RARE1 file cannot be meaningfully converted while it remains encrypted. It must first be successfully decrypted.
Once decrypted, the recovered file can be saved or exported using a program that supports its original format.
Software apps that recover RARE1 files:
Microsoft Windows
Language
