Lime ransomware: what it is and how to restore your files
Lime ransomware (also BigEyes, LimeDecryptor) encrypts your files with AES-256, adds .lime to their names and asks for 100 US dollars in Bitcoin. The key it uses is saved on the infected PC, so do not pay and do not delete the hash file before you try to restore.
Facts checked October 5, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Before you restore backups, a full scan can confirm the program that added .lime is gone.
Do it yourself · free Remove Lime ransomware yourself 6 steps, about 18 minutes, no software needed.
Start the steps
Lime ransomware: summary
| Type | File-encrypting ransomware (.NET), also a module of njRAT Lime Edition |
|---|---|
| Risk | High if you have the njRAT build (keylogger, wallet search); medium for the plain ransomware, because the key is kept on the PC |
| Symptoms | Files ending .lime, a red wallpaper, a window named #Lime Decryptor with a 30-day timer, Task Manager closing |
| How to get rid of it | Copy the hash key file first, scan with Microsoft Defender, remove what it dropped, then restore; see the plan |
| Our check | Source check on 5 October 2026 (Seqrite, Zscaler, Elastio); we did not run the malware |
| First seen | 1 November 2017 (Elastio); our first report 17 January 2018 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 13 more facts
| Also called | BigEyes, LimeDecryptor, njRAT Lime Edition |
|---|---|
| Encrypted file extension | .lime, added after the old ending (.limes is also listed) |
| Ransom note | No file: a wallpaper and a program window, quoted below |
| Decryptor | No packaged tool found; Seqrite published a method using the hash file (not tested by us) |
| Contact | An e-mail address at Proton Mail; the Bitcoin address is not printed here |
| Detection names | No Microsoft detection name is known. Seqrite: Ransom.Lime.S1809905; Zscaler: Win32_Backdoor_NjRATLime_117974 |
| Distribution | Spam attachments and malicious downloads (Seqrite); a remote access kit (Zscaler) |
| Name | Lime ransomware |
| Evidence | 0 write-ups by security sites; no sample analysed yet |
| Encrypted files | .lime |
| Free decryptor | No free decryptor is known (checked 5 October 2026) |
| Damage | Files on the PC and connected drives encrypted, restore points often deleted, sometimes a password stealer installed as well |
| Facts checked | 5 October 2026 |
Facts checked on 5 October 2026 against Seqrite's analysis (6 March 2018), Zscaler's njRAT report (30 March 2018), Elastio's family page and our own January 2018 screenshot. We did not run the malware.
What Lime ransomware is
Lime is Windows ransomware written in .NET that locks files with AES-256, adds .lime to their names and asks for 100 US dollars in Bitcoin, but the key it uses is saved on the infected PC, which is why Seqrite says it could decrypt the files.
Our January 2018 report said no one could restore the files. Seqrite's analysis of March 2018 says otherwise, and this page follows it. We could not run the malware, so everything here comes from the sources listed at the bottom.
- Also called
- BigEyes ransomware, LimeDecryptor ransomware, njRAT Lime Edition (its ransomware module)
- Written in
- .NET (Seqrite)
- First seen
- 1 November 2017 (Elastio); our report 17 January 2018
- Encryption
- AES-256 in ECB mode, one key per victim
- Extension
.limeadded after the old ending:mydemo.cppbecomesmydemo.cpp.Lime- Ransom
- 100 US dollars in Bitcoin, to be paid within 30 days according to the screen
How the Lime story went
1 November 2017
First sighting
Elastio's family page gives this date for the first time Lime was observed. It lists the extensions
.Limeand.limesand files namedNjRat Lime Edition 0.7.8.exeand001.gif.17 January 2018
Our first report
We described Lime as a file-encrypting virus that asks for 100 dollars in Bitcoin and said no decryptor existed.
The wallpaper and the #Lime Decryptor window as they appeared in our 2018 report (the padlock is report artwork and the Bitcoin address is blurred). 6 March 2018
Seqrite's analysis
Quick Heal's researchers describe the .NET code, the
hashfile and a way to rebuild the key. They state that all files encrypted by Lime can be decrypted.30 March 2018
Zscaler's njRAT report
Zscaler links Lime to "njRAT Lime Edition", whose ransomware module drops the key under
%AppData%. It was updated on 1 and 3 April 2018 with indicators.5 October 2026
Our recheck
We rewrote the guide from the vendors' reports. The old claim that nothing can be done is corrected on this page.
What we checked and what we did not
There is no website in this case, and we did not run the malware, so this is a check of reports, not a test.
Lime ransomware · source check · 5 October 2026
- Behaviour and key locationRead in Seqrite (6 March 2018) and Zscaler (30 March 2018); both describe the
hashfile. - Our screenshotThe text on the wallpaper and the window matches our old guide's quote.
- DecryptionSeqrite says it can decrypt the files; we found no downloadable tool, and we did not test the method on real files.
- The 30-day deletionShown on the screen; no source confirms the files are deleted.
- System Restore and shadow copiesNot mentioned in any report we read, so we cannot say whether Lime removes them.
Recoverable in principle The files are really encrypted, but the key sits on the PC. That is a good chance only if the hash file is still there and untouched.
- File extension:
.lime - Note file:
the desktop wallpaper and the #Lime Decryptor window
What antivirus programs call it
Detection names change often, so use them only to confirm that a scan found the right family.
| Who | Name | Note |
|---|---|---|
| Seqrite | Ransom.Lime.S1809905 | Standalone ransomware |
| Zscaler | Win32_Backdoor_NjRATLime_117974 and _117975 | njRAT Lime Edition |
| Zscaler | Njrat_2227 | Generic njRAT name |
| Microsoft Defender | No name known | We found none in public sources |
How Lime ransomware behaves
Two descriptions of the same name
Two security companies wrote about Lime within a month of each other and described it differently, so it helps to know which one you may be facing.
| Source | What it calls Lime | Where it keeps the key file |
|---|---|---|
| Seqrite (Quick Heal), 6 March 2018 | A newly found .NET ransomware, also known as BigEyes | C:\Microsoft\hash |
| Zscaler ThreatLabZ, 30 March 2018 | A ransomware module inside "njRAT Lime Edition", a remote access trojan kit | %AppData%\Microsoft\MMC\hash |
| Elastio family page | Lime, aliased NjRat, extensions .Lime and .limes | Not stated |
The practical point is the same for both: look for a file called hash in the two folders above before you do anything else.
What it does on the PC, step by step
The steps below come from Seqrite's analysis of the standalone build; the njRAT module (Zscaler) differs in the folders it targets.
- 1
It makes a key
On first launch it builds a random 50-character string, takes the MD5 of it and uses that as the AES key. The string is not sent anywhere in the analysis we read.
- 2
It saves the key on your disk
The random string is written to a file called
hash. Seqrite reports it atC:\Microsoft\hash, and Zscaler reports%AppData%\Microsoft\MMC\hashfor the njRAT build. The malware's author uses this file to decrypt the victim's files after payment. - 3
It encrypts files in your personal folders
AES-256 in ECB mode, on files of the listed types in the folders below. The
.Limeending is put after the old one, so the name stays recognisable. - 4
It ends programs you could use to look at it
Seqrite lists
Taskmgr,Cmd,Bdagent(a Bitdefender process) andProcessHacker. If Task Manager closes by itself, that is why. - 5
It shows the demand
A red wallpaper and a program window named "#Lime Decryptor" appear. The next chapter has the text.
Folders Seqrite lists as encrypted
- My Music
- My Pictures
- My Videos
- Desktop
- UserProfile
Extra folders in the njRAT build (Zscaler)
- LocalApplicationData
- ApplicationData
- ProgramFiles
- Favorites
- Personal (Documents)
- Recent
Seqrite's list of encrypted file types is long: documents (.doc, .xls, .ppt, .pdf, .rtf), pictures (.bmp, .png), archives (.zip, .bak), source code (.c, .cpp, .py) and even scripts and programs such as .exe, .bat and .msi. Our 2018 guide said "every single file" was locked; the sources say it is a list of types in certain folders, so files elsewhere may be untouched.
How it reaches PCs
Seqrite names two routes, and the old guide listed more.
Only the first two have a source.
- High
Spam attachments (Seqrite)
An attached file is opened and the program installs itself. The senders pretend to be companies or services you know.
- High
Malicious downloads (Seqrite)
Cracks and "free" programs from unofficial sites. Our old guide named peer-to-peer networks in particular.
- Medium
A remote access kit (Zscaler)
In the njRAT Lime Edition, ransomware is one of several commands sent by someone who already controls the PC.
Was anything stolen?
If you have the njRAT Lime Edition, yes, quite possibly: Zscaler lists a keylogger, a password stealer and a Bitcoin wallet grabber next to the ransomware.
- High
Keylogger and password stealer
Zscaler lists commands that log keystrokes and delete saved Chrome logins and cookies. Change passwords from another, clean device.
- High
Bitcoin wallet search
A
searchwalletcommand checks for Bitcoin Core, Bitcoin.com and Electrum wallets. If you keep coins on the PC, move them from a clean device. - Medium
USB spread
The njRAT build copies itself to inserted USB drives and makes a folder-icon shortcut. Do not plug a drive from an infected PC into another computer.
- Low
The standalone build
Seqrite's analysis of the plain ransomware mentions none of this, so we do not know if it applies to every sample.
The Lime ransomware note
What a ransom note left in folders said
All your files have been encrypted.
But you can still recover your files.
Just send us 100$ Bitcoin, and we will give you your files back.
After you pay us, send us email r3vo@protonmail.com, include your transaction number.
This is Ransomware, it's not a joke.
Thanks. Bye.
What the wallpaper and the window say
There is no note file: the message is a wallpaper and a program window, and both show the same text. The Bitcoin address in the window is not printed on this page.
| Item | What it says | Our reading |
|---|---|---|
| Price | "Just send us 100$ Bitcoin" | A small, fixed sum, which suggests an attacker aiming at ordinary users, not companies. |
| Time | A red bar and "Your files will deleted after 30 days" in the #Lime Decryptor window | A pressure timer. We could not check whether anything is deleted when it ends, so treat it as a threat only. |
| How to pay | The window offers a PayPal route ("=120") and a link to a video on how to open a Bitcoin account | The PayPal line is in our screenshot but not in the old text. We do not know whether it worked. |
| Contact | An e-mail address at Proton Mail, plus your "transaction number" | A free mailbox the attacker can close at any time. |
| Key box | A field marked "Decrypt" where you enter a key | The decryptor part of the program is inside the malware itself (Zscaler found a decrypt function), which fits with the key being kept locally. |
Can Lime ransomware files be decrypted?
Can .lime files be restored?
Possibly, and without paying: Seqrite wrote in 2018 that it could decrypt every file Lime encrypted, because the AES key is made from the hash file the malware leaves on the PC.
We did not find a ready decryptor from Seqrite, Emsisoft, Avast or Kaspersky, and we did not test the method. The steps below protect your chances, they do not decrypt anything.
| What you have | What it means | What to do |
|---|---|---|
Files ending .lime, and a hash file | The key can in theory be rebuilt (Seqrite) | Keep both; see the steps |
Files ending .lime, no hash file | The key is gone from this PC | Backups, Previous Versions, shadow copies (recovery chapter) |
| Files with another ending | Another ransomware family | Search for that extension instead |
- 1
Do not delete the hash file
Look for
C:\Microsoft\hashand%AppData%\Microsoft\MMC\hash(paste the second into the File Explorer address bar). Cleaning tools may remove it, so copy it first. - 2
Copy the key and your locked files
Put
hashand a copy of the.limefiles on a USB drive, then connect it to nothing else. - 3
Look for a tool, with a sample
Search the No More Ransom project's list for "Lime" and upload one small
.limefile and the wallpaper text to its Crypto Sheriff, which identifies the family. Do not download a "Lime decryptor" from a random site. - 4
Ask the vendor
Seqrite published the method, so its support is the first place to ask whether a tool exists. We did not confirm that it still offers one in 2026.
Do
- Remove the malware first, then decrypt a copy, so files are not locked again
- Check that decrypted files open and are the right size
Don't
- Do not rename the
.limefiles or run anything that came with the ransom message - Do not pay for a decryptor before you have checked the key file
Should you pay the ransom?
No. The attacker asks for a few hundred dollars at most, but there is no promise to hold them to, and your key may already be on your own disk.
- High
No guarantee
Nothing obliges the sender to answer, and the contact is a free mailbox. Our 2018 guide said the same: payment does not ensure the files come back.
- High
It pays for the next attack
Money sent to a ransomware author funds the next version.
- Medium
You may be marked as someone who pays
A paid-up victim is a better target for later demands.
Do
- Remove the program, keep the key, restore from backups
- Report the attack to your national cybercrime service
Don't
- Do not e-mail the address on the screen
- Do not send Bitcoin or PayPal money to any address shown
How to remove Lime ransomware
Tools you'll need
All of these are free except where noted. Download them on a clean device if the infected PC is offline.
- A USB stick: to keep the ransom note, two or three encrypted files and screenshots off the infected PC.
- Microsoft Defender Offline: built into Windows 11 and Windows 10; scans before Windows starts, so running malware cannot hide.
- Microsoft Safety Scanner: a second, portable scanner with current signatures; each download works for 10 days.
- ID Ransomware: identifies the family from the note and one encrypted file and says whether a decryptor exists.
- No More Ransom: the free decryptors from police and security companies; check it again every few months.
- Fortect (optional): scans Windows for malware and repairs the system files and settings it damaged. The free scan is in the box above.
How to remove Lime ransomware and get your files back
Work in this order.
Disconnecting comes first, removal comes before any restore, and nothing here asks you to contact the attackers.
Step 1: Disconnect the PC and unplug backup drives
Lime ransomware encrypts everything it can reach, including drives and shares you connect later. Cut the network first: cable out, or Wi-Fi off from the taskbar.
Then unplug every USB stick and backup disk and pause cloud sync, so the encrypted versions do not replace your online copies. Do not reconnect any of them until the ransomware is removed from the Windows 11 or Windows 10 PC.
Windows 11: turn off Wi-Fi to take the PC offline. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 2: Save the ransom note and confirm the family
Copy
the desktop wallpaper and the #Lime Decryptor windowand one or two files ending in.limeto a USB stick, and leave the originals where they are.From another device, upload the note and a sample file to ID Ransomware or No More Ransom's Crypto Sheriff, which name the family from the note, the extension and the file structure.
Write down the contact address and your personal ID from the note, because a decryptor or the police may ask for them.
Warning: Never contact the attackers from the infected Windows 11 or Windows 10 PC.
Windows 11: the ransom note and encrypted files to copy for identification. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 3: Check for a free decryptor
For Lime ransomware, no free decryptor is known (checked 5 October 2026). Search the family name in the No More Ransom decryption tools list and in the free decryptors of Emsisoft, Avast and Kaspersky, because new tools appear years after an attack.
Important: Keep the encrypted files even if nothing works today, and do not pay before every free option is ruled out: payment does not guarantee a working key.
Decryptors run on Windows 11 and Windows 10, but only after the ransomware itself is removed.
Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 4: Remove the ransomware before you restore or decrypt
Restoring or decrypting files while Lime ransomware still runs lets it encrypt them again. Run a Full scan in Windows Security > Virus & threat protection > Scan options, then the Microsoft Defender Antivirus (offline scan).
If the ransomware blocks Windows Security, start Safe Mode with Networking and scan from there. Some families install a password stealer as well, so let both scans finish on Windows 11 or Windows 10.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Look for shadow copies of the files
Open Command Prompt as administrator and run
vssadmin list shadows. If it lists copies dated before the attack, right-click a folder with encrypted files in File Explorer, choose Properties > Previous Versions, and open or restore a version from before that date.ShadowExplorer, a free tool, shows the same copies when the tab is empty or hidden. Most current families delete shadow copies, so an empty list is normal, but the check takes two minutes on Windows 11 or Windows 10.
Windows 11: vssadmin list shadows shows whether shadow copies exist. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 6: Restore the files from a backup or recover deleted originals
Restore from an external backup, File History or OneDrive's version history, choosing a date before the attack. Connect the backup drive only after the scans are clean, or the ransomware encrypts it too.
If there is no backup, file recovery software can sometimes find the deleted originals, because some ransomware writes an encrypted copy and deletes the original file.
Stop writing to the drive and try recovery on Windows 11 or Windows 10 before new files overwrite the space.
Full procedure with screenshots: Recover deleted files (Recycle Bin, backups, OneDrive) On uGetFix
Report it and recover your files
Report it
Report the attack even if you do not expect the files back: insurers and banks ask for the report number, and police use the contacts in the note to link cases.
- United States
- FBI IC3 · FTC ReportFraud
- United Kingdom
- Report Fraud (formerly Action Fraud) · NCSC
- Australia
- ReportCyber (ASD)
- EU countries
- Europol: national reporting sites
Give the victim ID, the note and the date the files were encrypted. A business that holds personal data may also have to notify its data protection authority, in the EU within 72 hours.
If the key does not work: other ways to get files back
Removing Lime does not decrypt anything, so recovery is a separate job.
Check these in order, before you save anything new to the disk.
- 1
Your own backups
An external drive, a NAS or cloud storage (OneDrive, Google Drive, Dropbox). Connect or sign in only after the PC is clean.
- 2
Previous Versions
Right-click the folder, choose Properties > Previous Versions (on Windows 11, Show more options first). Pick a date before the attack. If System Restore protection was off, the list is empty.
- 3
Shadow copies
Run
vssadmin list shadowsin an administrator Command Prompt. If copies are listed, a free viewer such as ShadowExplorer can open them. No source we read says whether Lime deletes them, so check. - 4
A file recovery program
Programs that restore deleted files do not decrypt anything, but they can bring back older, unencrypted copies if the originals were deleted. Do not install one on the affected disk.
- 5
Wait for a tool
If you have no backup, keep the locked files and the
hashfile on a drive. A decryptor may appear later; the old guide said none was published, and we could not confirm one in 2026.
Back up with the 3-2-1 rule
The old guide's advice still holds: keep copies of important files where ransomware cannot reach them.
The 3-2-1 rule turns it into a plan.
| Number | Rule | Example |
|---|---|---|
| 3 | Three copies of every important file | The working file plus two backups |
| 2 | Two different kinds of storage | Your disk and a USB drive |
| 1 | One copy away from the PC | A drive in a drawer, or cloud storage with version history |
Do
- Unplug a USB drive after each backup
- Test once in a while that a file opens from the backup
Don't
- Do not leave the only backup plugged in all the time
How to prevent Lime ransomware and the next attack
Five habits cover the routes Seqrite and our old guide list.
Do
- Keep Microsoft Defender and Windows updates on, and run a full scan after you open anything unusual
- Treat unexpected e-mail with an attachment as suspect, even when the sender looks like a company you know
- Show file extensions in File Explorer (View > Show > File name extensions), so
invoice.pdf.execannot pass as a PDF - Keep a backup that is not connected to the PC
- Close remote desktop (TCP port 3389) to the internet, or protect it with a strong password and two-step sign-in
Don't
- Do not run cracks, key generators or "free" copies of paid software, especially from peer-to-peer sites
- Do not open attachments you did not expect
- Do not rely on a VPN for this: it does not stop ransomware
Questions about Lime ransomware
Is there a decryptor for Lime ransomware?
No packaged decryptor is known to us, but a decryption method has been published. Seqrite's March 2018 analysis says every file Lime encrypts can be decrypted, because the AES-256 key is built from a file called hash that the malware leaves on the PC, at C:\Microsoft\hash in the standalone build.
The old 2-spyware guide said no tool existed, and we could not confirm one in 2026. Keep the hash file, copy it and your locked files to a USB drive, and ask the vendor or check the No More Ransom list.
Be careful with sites offering a free Lime decryptor, since fake tools are a common way to spread more malware.
How do I open .lime files?
You cannot open them as they are, because the content is encrypted with AES-256 and only the key can reverse it. The name shows the original ending first, for example mydemo.cpp.Lime was a C++ file. Renaming the file does not help and can make recovery harder, so leave the names alone.
Copy the files to a safe drive, find the hash file Lime saved (see the restore chapter), and try the decryption method described by Seqrite or a backup. If neither is possible, keep the copies, since a tool may appear later. Always remove the malware before you open or restore anything.
Should I pay the Lime ransom?
No, you should not pay. The screen asks for 100 US dollars in Bitcoin and tells you to send an e-mail, but nothing makes the sender keep the promise, and our 2018 guide warned that files may not come back even after payment.
The key may also be on your own disk already, which makes payment unnecessary. Money sent to the author supports the next version of the malware. Remove the program, keep the hash file, restore from a backup if you have one, and change your passwords from a clean device because the njRAT build can steal them.
What is Lime code encryption?
It is the AES-256 encryption done by Lime ransomware, not a programming technique. People who search for lime code encryption usually found files ending .lime, or the red wallpaper and the #Lime Decryptor window.
The malware creates a random string, turns it into a key with MD5, and encrypts personal files in folders such as Desktop, My Pictures, My Music and My Videos.
It saves the string in a hash file on the same PC. That detail is why researchers think files can be restored, although the method was published in 2018 and we have not tested it.
How did Lime ransomware get on my PC?
Most likely from a spam attachment or a malicious download. Seqrite names these two routes for the standalone build, and our 2018 guide added peer-to-peer downloads and fake e-mails that copy real companies.
Zscaler found the ransomware inside njRAT Lime Edition, which means an attacker with remote control could also have started it. No source shows exactly how one victim got it, so check your Downloads folder, recent e-mail attachments and remote desktop settings. Run a full Microsoft Defender scan before you restore any file.
Was my data stolen by Lime?
The standalone ransomware does not appear to steal data, but the njRAT Lime Edition does. Seqrite's analysis of the plain build mentions no theft. Zscaler lists a keylogger, a password stealer, Chrome login deletion, USB spreading and a search for Bitcoin wallets in the njRAT version.
Because you cannot tell which version you have without a scan, change your passwords from another device and move any cryptocurrency out of wallets stored on the PC. There is no leak site for this family in the sources we read.
Can a data recovery company or paid service help with .lime files?
A recovery service can help only in limited ways, and none can break AES-256 by force.
Removing Lime does not decrypt anything either, so what a firm can really do is look for older copies of your files, such as shadow copies or deleted originals, or apply the key-based method Seqrite described in 2018 if the hash file is still there.
Ask what exactly will be done, ask for a price before work starts and never pay for a service that promises to crack the encryption. You can do the first steps yourself for free:
- copy the hash file
- keep the locked files
- check Previous Versions
Is Lime the same as njRAT?
Not exactly, but the two are linked. Zscaler describes njRAT Lime Edition, a version of the njRAT remote access trojan with a ransomware module that uses the same key routine Seqrite found in Lime. Elastio lists NjRat as an alias.
Seqrite describes a standalone ransomware and never mentions njRAT. We cannot say if every Lime sample belongs to njRAT, so assume the worst: if the PC had Lime, scan for remote access tools and treat your passwords as exposed.
Will Fortect remove Lime ransomware?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Lime ransomware, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Seqrite (Quick Heal): Beware! A new .Net Ransomware is encrypting files with .Lime (read October 5, 2026)
- Zscaler ThreatLabZ: njRAT pushes Lime ransomware and Bitcoin wallet stealer (read October 5, 2026)
- Elastio: Lime ransomware (read October 5, 2026)