Cobra Locker ransomware: what it is and how to remove it
Cobra Locker ransomware - the cryptovirus that makes files useless and then demands payments in cryptocurrency for the alleged decryption tool option, so you fall for the trick and help criminals to make a profit. Ransomware encrypts data on the machine, marks those files with .cobra appendix, and drops the ransom note on the screen.
Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Make sure nothing will rename more files to .cobra: an automatic scan checks the PC first.
Do it yourself · free Remove Cobra Locker ransomware yourself 6 steps, about 18 minutes, no software needed.
Start the steps
Cobra Locker ransomware: summary
| Distribution | Files that trigger payload drop of this threat can be downloaded from a malicious site, via a spam email campaign or directly injected by the trojan, worm, other malware |
|---|---|
| Name | Cobra Locker |
| Type | Ransomware |
| Versions of file extensions | The primary version of the threat used .Cobra file appendix, later .IT got released. These file markers appear at the end of the original filename |
| Ransom note | Lockscreen that shows the program window and encourages to pay up or contact people for th; the text is quoted in full below |
| Contact information | Cobra_Locker@protonmail.com |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 10 more facts
| Detection names | No Microsoft detection name is known |
|---|---|
| Encrypted file extension | .cobra |
| Decryptor | No free decryptor is known for this variant; check No More Ransom (nomoreransom.org) for updates |
| Damage | Not recorded in the old report |
| Symptoms | Files renamed with a new extension and a ransom note left in folders |
| Evidence | 4 write-ups by security sites; no sample analysed yet |
| Encrypted files | .cobra |
| Free decryptor | No free decryptor is known (checked 7 October 2026) |
| First seen | 9 July 2020 |
| Facts checked | 7 October 2026 |
- File extension:
.cobra - Note file:
the ransom note
From our report of Jul 2020 · not reviewed since
More from our earlier report on Cobra Locker
- You need to remove Cobra Locker ransomware with proper anti-malware tools so all the traces of threat get cleaned off
- The computer is affected more significantly than you think, so you need to run for the system file corruption indication and recovery
- You have fallen victim to IT ransomware!
- All your important files have been encrypted!
- And your screen is locked!
- let me introduce you to the rules 1.
- to unlock screen you must enter special key 2.
- to decrypt files you must contact with us: Cobra_Locker@protonmail.com
How Cobra Locker ransomware behaves
From our report of Jul 2020 · not reviewed since
Cobra Locker ransomware is the threat that uses AES and RSA algorithms in the process of file-locking
Cobra Locker ransomware - the cryptovirus that makes files useless and then demands payments in cryptocurrency for the alleged decryption tool option, so you fall for the trick and help criminals to make a profit.
Ransomware encrypts data on the machine, marks those files with .cobra appendix, and drops the ransom note on the screen. This particular version of the threat shows the ransom demanding message on the program window named Cobra_Locker, hence the name of the threat.
This virus started spreading mid-June 2020, so it is new that in the ransomware filed. However, the particular Cobra Locker ransomware virus already has a few distinct features and a .IT virus version that came out in July of the same year. This cryptocurrency extortion-based virus locks the screen and asks for payment, encourages to contact the criminal group behind the malware.
The money demanding message on the program window states that your files all got encrypted and cannot be recovered without the private key. The decryption you need for the recovery should be purchased after you write the message via Cobra_Locker@protonmail.com email.
However, contacting these people is not recommended because extortionists are not trustworthy at all. You should remove the threat instead and try to restore the system after the CobraLocker virus attack.
Cobra Locker ransomware is the threat that focuses on the encryption process that allows criminals to collect payments from gullible people. Of course, statements about locked files and ransom demands are scary enough, so you would think that paying is the only option. However, this is a complex threat that shouldn't be trusted, so you need to remove the virus instead of contacting extortionists.
There is no reason to believe Cobra Locker ransomware virus creators, so once the encryption process is done, and you receive the ransom note, notice locked and appended files, you need to react to these symptoms and clean the machine. The best option would be anti-malware tools since those programs can detect the threat fully with all files.
Make sure to clean the machine as soon as you get this Cobra Locker ransomware ransom note:
The sooner you start the Cobra Locker ransomware removal process the better because once the encryption is complete, this threat focuses on system file alterations. It can easily damage functions, files, programs to ensure the persistence and make the file recovery impossible.
Cobra Locker ransomware drops this ransom note when files are all encrypted, so the person panics and turns to the offered option - paying the ransom. Unfortunately, this is not the best option since not may people get their files restored after paying the ransom fee.
You need to remove Cobra Locker ransomware because it affects audio, video files, pictures, backups, and other personal files directly, but it managed to compromise the system functions by triggering alterations in other parts of the operating system and program folders.
The best tool for the Cobra Locker termination is anti-malware since it can detect and indicate malicious files for you. However, this is not the process that could recover encoded files for you. Anti-malware tools find malicious software, but the damaged pieces can only be restored with third-party tools or using data backups from an external device or cloud.
For Cobra Locker ransomware virus damage repair, you should run the tool like that is a system optimizer and can even recover some OS files, so functions for file restoring or virus elimination can run. These alterations significantly affect the performance and persistence of the threat, so make sure to fix the damage.
From our report of Jul 2020 · not reviewed since
CobraLocker versions: .IT files virus
The particular IT ransomware virus came out not long after the initial release of this threat.
There are not many distinct features that could be indications of the particular variant. The email that criminals would like to receive your questions remains the same. So the ransom note pops-up as a lock screen and encourages victims to receive further payment instructions via Cobra_Locker@protonmail.com email.
CobraLocker is new, but the quick actions may indicate that malware is going to spread further and be more complex, dangerous than experts may think. The full-screen message from criminals is not displaying much besides the content informational the fact that you have fallen the victim for this IT ransomware.
IT files virus even includes the IT movie poster for the scariness of the initial ransomware attack. However, when you try to unlock the screen and put the key, anything, in general, you get mocked with a "wrong. hahaha" reaction. Cybercriminals are not emphatic and they only care for the profit, not your files or belongings.
Make sure to remove IT ransomware and do not think about paying these people. There is no need to believe or trust them, so keep your money and get the proper anti-malware tool instead. There are no other options since the decryption tool is not developed yet. Thrid-party options can help, but the most reliable technique is anti-malware tools and your file backups stored on the external devices.
From our report of Jul 2020 · not reviewed since
Ransom-demanding threats spread using stealthy methods and rely on malicious files
The infection might get spread using a payload dropper that initiates malicious script injection after the malicious macro virus triggering or when the particular trojan, worm, other pieces of malware installs the cryptovirus on the machine. File-sharing, torrent, operating sites, and platforms can be one of the many methods that distribute malicious files to systems via the internet.
Even websites that get malicious scripts loaded as additional layers can trigger such drops of the file that includes pieces of cryptovirus. Unfortunately, spam emails sent from unknown companies or people also pose the risk to your data and the machine. If you visit the link provided in the message or download the file attached, you can trigger the infection unknowingly.
Once the script is launched, the encryption process can start and you will only notice the infection after data gets locked and a ransom demanded. Pay attention to all the details, red flags and avoid content that is suspicious or seems harmful, especially unfamiliar files, if you want to avoid these serious infections.
The Cobra Locker ransomware note
All your important files were encrypted on this PC.
All files with .Cobra extension are encrypted.
Encryption was produced using unique private key generated for this computer.
To decrypt your files, you need to obtain private key.
To retrieve the private key you need to contact us by email
Cobra_Locker@protonmail.com send us an email and wait for further instructions.
E-mail address to contact us:
Cobra_Locker@protonmail.com
If you want decrypt your files you must have decryption code
How to remove Cobra Locker ransomware
Tools you'll need
All of these are free except where noted. Download them on a clean device if the infected PC is offline.
- A USB stick: to keep the ransom note, two or three encrypted files and screenshots off the infected PC.
- Microsoft Defender Offline: built into Windows 11 and Windows 10; scans before Windows starts, so running malware cannot hide.
- Microsoft Safety Scanner: a second, portable scanner with current signatures; each download works for 10 days.
- ID Ransomware: identifies the family from the note and one encrypted file and says whether a decryptor exists.
- No More Ransom: the free decryptors from police and security companies; check it again every few months.
- Fortect (optional): scans Windows for malware and repairs the system files and settings it damaged. The free scan is in the box above.
How to remove Cobra Locker and get your files back
Work in this order.
Disconnecting comes first, removal comes before any restore, and nothing here asks you to contact the attackers.
Step 1: Disconnect the PC and unplug backup drives
Unplug the network cable or turn off Wi-Fi, and disconnect USB drives, external disks and network shares, so Cobra Locker cannot reach more files. Pause OneDrive, Google Drive or Dropbox sync, because synced folders upload the encrypted copies over the good ones.
Leave the PC on but offline while you read the next steps, since a restart can let the ransomware run again. This applies to Windows 11 and Windows 10 alike.
Windows 11: turn off Wi-Fi to take the PC offline. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 2: Save the ransom note and confirm the family
Your files now end in
.cobraand the instructions are inthe ransom note. Save both to a USB stick, a copy of the note and two small encrypted files, before anything else.On another device, check them with ID Ransomware or Crypto Sheriff: the family name decides which decryptor, if any, can help. Keep the note's ID and contact line for your report.
Windows 11: the ransom note and encrypted files to copy for identification. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 3: Check for a free decryptor
Our last check found that for Cobra Locker, no free decryptor is known (checked 7 October 2026). Look again yourself in the No More Ransom list and the free decryptor pages of Emsisoft, Avast and Kaspersky, which add new families every year.
A decryptor needs the ransomware gone first, or it encrypts the files again. Keep at least one copy of the encrypted files on an external drive, even if no tool works yet.
Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 4: Remove the ransomware before you restore or decrypt
Removing Cobra Locker does not bring the files back, but it has to come first. Start with Defender's Full scan, then the offline scan from the same Scan options page, which checks the disk before Windows loads.
If the scan cannot start, use Safe Mode with Networking. Delete the ransom notes only after you have saved a copy, because removal tools sometimes leave them behind on Windows 11 and Windows 10.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Look for shadow copies of the files
Windows keeps shadow copies for restore points and backups, and some ransomware fails to delete them.
vssadmin list shadowsin an administrator Command Prompt tells you at once whether any exist.If they do, right-click the folder that held your files, open Properties > Previous Versions, select a version from before the attack, and click Open to check it before you Restore or copy the files out. Windows 11 and Windows 10 both have the tab.
Windows 11: vssadmin list shadows shows whether shadow copies exist. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 6: Restore the files from a backup or recover deleted originals
A backup made before the attack is the surest way back. Connect it only once the PC is clean, then restore from File History, Windows Backup, OneDrive's Restore your OneDrive or your own external copies.
Without a backup, try file recovery: the originals that Cobra Locker deleted may still be on the disk until something overwrites them. Install nothing new on the drive you want to recover from on the Windows 11 or Windows 10 PC.
Full procedure with screenshots: Recover deleted files (Recycle Bin, backups, OneDrive) On uGetFix
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
From our report of Jul 2020 · not reviewed since
You need to repair the system functions and recover files, but only after the Cobra Locker virus termination
Cobra Locker ransomware virus already has another version when it released .IT files virus after the first spreading campaign, so these people behind the cryptovirus shouldn't be trusted at all.
Paying is not the options, especially when there is no information about possible decryption.
Rely on anti-malware tools and remove Cobra Locker ransomware instead. Running a full scan with the security tool like or can ensure that your device gets thoroughly checked for malicious programs and files associated with any harmful procedures and behavior.
Unfortunately, you need to rely on additional methods besides the Cobra Locker ransomware removal because the system gets affected on a more significant level when files and programs in the background stop running properly. Get or a similar program that is designed to repair damage and only then go for the file recovery.
[GI=method-1]Try to remove Cobra Locker ransomware from your machine with AV tools by relying on the Safe Mode with Networking reboot
[GI=method-2]System Restore feature can help with the virus removal because it allows user to recover machine in a previous state
Windows Previous Versions helping with encrypted data
When you use System Restore first, you can try to restore encoded data with Windows Previous Versions
ShadowExplorer - a feature that recovers files after the Cobra Locker ransomware attack
If you know that Cobra Locker ransomware is not affecting Shadow Volume Copies, you can use ShadowExplorer and restore files this way
Cobra Locker ransomware decryption tool is not released yet
Report it and recover your files
Report it
Report the attack even if you do not expect the files back: insurers and banks ask for the report number, and police use the contacts in the note to link cases.
- United States
- FBI IC3 · FTC ReportFraud
- United Kingdom
- Report Fraud (formerly Action Fraud) · NCSC
- Australia
- ReportCyber (ASD)
- EU countries
- Europol: national reporting sites
Give the victim ID, the note and the date the files were encrypted. A business that holds personal data may also have to notify its data protection authority, in the EU within 72 hours.
Backups: the 3-2-1 rule
Keep three copies of files that matter, on two kinds of storage, with one copy offline or off-site.
A disk that stays plugged in is reached by malware like Cobra Locker together with the PC; one you connect only for the backup is not.
On Windows 11, File History keeps versions on an external drive, and OneDrive keeps earlier versions of synced files. Before restoring anything, make sure the PC no longer shows files that end in .cobra and no longer open.
Setting it up step by step: 3-2-1 backups on Windows 11 and 10.
Access your website securely from any location
When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. The best solution for creating a tighter network could be a dedicated/fixed IP address.
If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for the server or network manager that needs to monitor connections and activities. VPN software providers like can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world.
Recover files after data-affecting malware attacks
While much of the data can be accidentally deleted due to various reasons, malware is one of the main culprits that can cause loss of pictures, documents, videos, and other important files.
More serious malware infections lead to significant data loss when your documents, system files, and images get encrypted. In particular, ransomware is is a type of malware that focuses on such functions, so your files become useless without an ability to access them.
Even though there is little to no possibility to recover after file-locking threats, some applications have features for data recovery in the system. In some cases, can also help to recover at least some portion of your data after data-locking virus infection or general cyber infection.
Questions about Cobra Locker ransomware
Is there a decryptor for .cobra files?
That depends on the family behind the .cobra extension, which this guide cannot confirm yet from the reports alone. Check No More Ransom and ID Ransomware with your ransom note and one encrypted file; they list families with free tools.
If none exists today, keep the encrypted files and a copy of the note on a separate drive, because decryptors are sometimes published months later after flaws are found or servers are seized. Never buy a decryptor from a website that is not the security company that made it.
Should I pay the ransom in the ransom note?
Not before you have tried everything else. Identify the family from the ransom note and one encrypted file, check No More Ransom for a free decryptor, and look for clean copies in OneDrive, backups and Previous Versions.
Paying funds further attacks, may be illegal if the group is sanctioned, and is no promise of a working key: many victims get partial or broken decryption. If you consider paying for business-critical data, involve the police and a professional incident responder first, and never pay through intermediaries who promise their own decryption.
How do I open .cobra files?
You cannot open them by renaming or by choosing another program. The .cobra ending shows that Cobra Locker encrypted the content, and only the matching key can reverse it. Renaming a file back to .docx or .jpg changes nothing except the icon, and it can confuse a future decryptor, so leave the names as they are.
To get the content back, use a backup, an unencrypted copy elsewhere, or a decryptor listed on No More Ransom if one exists for Cobra Locker. Store the encrypted files on an external disk until then.
Did Cobra Locker steal my files or passwords?
We do not know yet. Nothing published so far shows data theft by Cobra Locker, but the only confirmed sign is files that end in .cobra and no longer open, which says nothing about what happened before. Many current ransomware attacks copy files or run a password stealer first, so it is wise to act as if they did.
From a clean device, change the passwords that were saved in the browsers on this PC, starting with e-mail and banking, sign out of all sessions and turn on two-step verification. Watch bank statements and account activity for the next few weeks.
Are ransomware recovery services legitimate?
Some are, but read the offer carefully. Genuine data-recovery firms recover deleted originals from disks or rebuild damaged files, and they say so. Others promise to "decrypt any ransomware" for a fixed price, which is impossible without the key; they quietly pay the attackers and keep a margin, sometimes without telling the victim.
Be especially careful with services that contact you after you post about the attack online. Ask for references, a written method and a no-result-no-fee clause, and check the free tools on No More Ransom first.
How did Cobra Locker get on my computer?
The way Cobra Locker spreads has not been documented yet, so look at your own recent activity. On home PCs, ransomware most often comes with cracked programs, game cheats, key generators and fake updates, or with an e-mail attachment that was opened. On business networks, attackers usually log in through Remote Desktop with a stolen or guessed password.
Think back to what was downloaded or installed in the days before files that end in .cobra and no longer open, and check the Downloads folder and Installed apps sorted by date. Keep anything suspicious for your report, but do not run it again.
Is Cobra Locker the same as other ransomware with a similar name?
Not necessarily. Ransomware names come from the file extension, the note or a word in the code, so unrelated families often end up with similar names, and one family can appear under several names. The difference matters: a decryptor or advice for one family does not fit another and can damage files.
Compare the ending added to your files and the exact name of the note with the summary table at the top of this guide, then upload the note and one encrypted file to ID Ransomware from a clean device. If the result names another family, follow the guide for that family instead.
Can I delete the ransom note?
Yes, the note itself is harmless text and deleting it does not affect your files. Keep at least one copy first, outside the infected PC. the ransom note contains your personal ID and the attackers' contact details, which identification services use to tell which family encrypted your files, and which a decryptor may need later.
Police reports also ask for it. Once you have saved a copy, you can remove the notes from every folder after the ransomware program has been removed and your files are restored or backed up.
My files got .cobra overnight. What happened?
Ransomware often runs at night or when the PC is idle, so the encryption finishes before anyone notices. It usually entered earlier through a cracked program, a fake installer, an e-mail attachment or remote desktop with a weak password.
The .cobra extension marks every file it reached. Start by disconnecting the PC from the network, then identify the family from the ransom note and one encrypted file, check for a decryptor, and look for copies in backups and OneDrive before you consider anything else.
Will Fortect remove Cobra Locker?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Cobra Locker, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Wikipedia: Rabsomware (read October 7, 2026)
- VirusTotal: Cobra Locker detection (read October 7, 2026)
- CISA: StopRansomware (read October 7, 2026)
- No More Ransom (read October 7, 2026)
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)