Sage Ransomware

Also Known As: Sage virus
Distribution: Low
Damage level: Severe

Sage ransomware removal instructions

What is Sage?

Sage is a ransomware-type virus discovered by Karsten Hahn and is a variant of CryLocker ransomware. Following infiltration, Sage encrypts various files and appends the ".sage" extension to the name of each encrypted file (e.g., "sample.jpg" is renamed to "sample.jpg.sage"). Following successful encryption, Sage creates two files ("!Recovery_[6_random_characters]_.txt" and "!Recovery_[6_random_characters].html"), placing them in each folder containing encrypted files. It also changes the desktop wallpaper.

The txt and HTML files contain identical ransom-demand messages stating that files are encrypted using asymmetric cryptography and that they can only be restored using a private key. To receive this key, victims must pay a ransom of $150 in Bitcoins. If payment is not submitted within the given time frame (timer is displayed within Sage's website), the ransom will double to $300. To pay, victims must visit a Tor website (link provided in the message) and follow detailed instructions. Sage employs an asymmetric encryption algorithm and, thus, claims that decryption without a private key is impossible are unfortunately accurate. Sage's developers store the key on a remote server - victims are blackmailed and encouraged to pay a ransom to receive it. Cyber criminals often ignore victims, despite submitted payments. Therefore, you should never risk paying, since there is a high probability that you will be scammed. We strongly advise you to ignore all requests to pay or contact these people. There are currently no tools capable of restoring files encrypted by Sage ransomware. This problem can only be addressed by restoring files/system from a backup.

Screenshot of a message (desktop wallpaper) encouraging users to pay a ransom to decrypt their compromised data:

Sage decrypt instructions

There are dozens of ransomware-type viruses that share similarities with Sage. Examples include ASN1, Cerber, Dharma, and many others. Research shows that all of these viruses have identical behavior - they encrypt files and make ransom demands. There are just two major differences: 1) type of encryption algorithm (symmetric/asymmetric), and; 2) price of decryption. Ransomware-type viruses are often distributed using spam emails (malicious attachments), peer-to-peer networks and other third party software download sources (freeware download websites, free file hosting websites, etc.), fake software update tools, and trojans. Therefore, be very cautious when opening files received from suspicious emails, and when downloading software from unofficial sources. Furthermore, keep your installed software up-to-date and never use third party updaters. Using a legitimate anti-virus/anti-spyware suite is also paramount. The key to computer safety is caution.

Ransom-demand message (presented within desktop wallpaper):

Sage encrypted all your files!
All your files, images, videos, and databases were encrypted and made inaccessible by software known as Sage.
You have no chance to restore the files without our help. But if you follow our instructions files can be restored easily. Instructions on how to get your files back are stored on every disk, in your documents and on your desktop. Look for files !Recovery_47UdPQ.txt and !Recovery_47UdPQ.html If you can’t find files, use the program “Tor Browser” (you can find it in Google) to access to (onion) web site http://qbxeaekvg7o3lxnn.onion to get your instructions.

Screenshot of Sage's text file:

Sage text file

Screenshot of Sage HTML file:

Sage decrypt instructions

Ransom-demand message (presented within "!Recovery_[6_random_characters]_.txt" and "!Recovery_[6_random_characters].html" files):

Not your language? Use hxxps://
How did this happen?
Specially for your PC was generated personal 4096 bit RSA key, both public and private. All your files have been encrypted with the public key. Decrypting of your files is only possible with the help of the private key and de-crypt program.....
What do I do?...
Don't wait for a miracle and the price doubled!Start obtaining Bitcoin now and restore your data easy way! If you HAVE REALLY VALUABLE DATA, you better NOT WASTE YOUR TIME, because there is NO OTHER WAY to get your files, EXCEPT MAKE A PAYMENT.Your personal ID:..
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1 - hxxp://
2 - hxxp://
3 - hxxp://
What should you do with these addresses?

1. Take a look at the first address (in this case it is
2. Select it with the mouse cursor holding the left mouse button and
moving the cursor to the right;
3. Release the left mouse button and press the right one;
4. Select "Copy" in the appeared menu;
5. Run your Internet browser (if you do not know what it is run the
Internet Explorer);
6. Move the mouse cursor to the address bar of the browser (this is the place where the site address is written);
7. Click the right mouse button in the field where the site address is written;
8. Select the button "Insert" in the appeared menu;
9. Then you will see the address hxxp:// appeared there;
10. Press ENTER;

11. The site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.If for some reason the site cannot be opened check the connection to the Internet. Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available:
1. Run your Internet browser (if you do not know what it is run the Internet Explorer);
2. Enter or copy the address hxxps:// into the address bar of your browser and press ENTER;
3. Wait for the site loading;
4. On the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;
5. Run Tor Browser;
6. Connect with the button "Connect" (if you use the English version);
7. A normal Internet browser window will be opened after the initialization;
8. type or copy the address hxxp://qbxeaekvg7o3lxnn.onion in this browser address bar;
9. Press ENTER;
10. The site should be loaded; if for some reason the site is not loading wait for a moment and try again
Be sure to copy your personal ID and the instruction link to your notepad not to lose them.

Screenshot of Sage Tor website (Home page):

Sage website (Home)

Text presented within this page:

Important Information! Please read very carefully!
Sage encrypted all your files!
All your files, images, videos and databases where have been encrypted and no longer accessible by software known as Sage!
To restore all your files you need to pay $150 (≈ BTC 0.20357) for the decryption.
The after full payment, you will be able to download the software to restore your data.
In the case of non-payment of the full commission within 06 d 06 h 49 m 39 s,
the amount of commission will be raised to $300 (≈0.40713)
You have no chance to restore the files without our help!
The files will restored easily if you will follow our instructions!
In case of the repeated non-payment of the increased commission during the - period,
the unique decryption code for your files will be blocked
and its recovery will be absolutely impossible!

Screenshot of Sage website (Payment page):

Sage website (Payment)

Text presented within this page:

Payment procedure How to pay?
Payment can only be made using the BitCoin system.
BitCoin is the new generation of the decentralized cyber currency that has been created on the Internet and is operating on the Internet only. Emission of the BitCoin currency (BTC) is performed by the work of millions of computers around the world using a program for calculation of mathematical algorithms. Due to this fact, all the payments within the system are open payments but at the same time are completely anonymous for the whole world. So you can be sure that in the case of full payment of the commission, all your files will be decrypted. Please note that BTC currency rate as any other currency rate in the world is not fixed. It tends to increase, therefore we advise you not to delay the BTC currency purchase and payment. How to pay within the BitCoin system?
Don't worry, the payment process in the BitCoin system is not difficult and requires few simple steps.
1. BTC wallet you need to transfer the payment to has been set up specially for you and the amount paid can not be lost! You will be able to check all the information about the payments made. Your BTC wallet: 1EpwuEdnMRaWs75WwKBHuQkiPcyVyb7GdM
2. Around the world there is a wide variety of services (see the full list below) allowing to buy BTC currency with cash, classic bank cards (Visa/Mastercard), PayPal, bank transfers and other payment methods.
3. Below you can find the list of trusted BitCoin purchase services. We would like to draw your attention to the fact that these services are not affiliated with us! Most of them are designed for beginners and have prompt support services. Some of these services will set up a personal BTC wallet for you, while others can make a direct transfer to the wallet that has been set up for you on our system. It should be noted that some of the services mentioned can require you to confirm your identity before the BitCoins purchase.
If you need to save, copy, etc your BTC wallet number do not try to write it down by hand! If while making a transaction you type the wrong BTC wallet number, the money will be lost. Therefore, if necessary, print out the BTC wallet number you need or use the QR-code scanner on your smartphone.
5. If you are not confident that you are able to do everything correctly the first time, you can split the full amount of payment in several BTC transactions. As was mentioned above, the BTC wallet you need to make payment to has been set up specially for you. That is why at any time you may see the current balance and the reminder to be paid.
6. Keep in mind that some BTC purchase services have a delay in payment processing. The delay may last from 24 to 36 hours. We therefore recommend you not to put aside the decision of payment until the last moment. Failure to pay on time may result in the increase of the commission amount!!!

Screenshot of Sage website (Test decryption page):

Sage website (Test decryption)

Text presented within this page:

Test decryption Upload file to test decryption. You can upload one file up to 15 KB to test decryption

Screenshot of Sage website (Instructions page):

Sage website (Instructions)

Text presented within this page:

InstructionsWhat to do after the payment is made? How to decrypt all your data?
After payment you can download the decryption software from the home page. We guarantee that all your files will be decrypted.
Just follow these simple steps:
1. Login to your personal page
2. Copy the decryption key from field on the home page
3. Click "Download decryption software" button and save Sage_Decryptor.exe to your hard disk
4. Run Sage_Decryptor.exe
5. Paste the decryption key into field in the decryption software window
6. Click "Run decryption" and wait for successfull completion of the decryption process
7. IMPORTANT: Don't turn off or reboot your PC before the process is completed!
8. Congratulations! Now all your files are restored!

Screenshot of Sage website (Support page):

Sage website (Support)

Text presented within this page:

Support requests Ask your questions. If you still have some questions on the work of our service, please use the special form to contact our support service. We will be glad to answer any questions you may have.

Screenshot of files encrypted by Sage ransomware (".sage" extension):

Sage decrypt instructions

Sage ransomware removal:

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Malwarebytes is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Malwarebytes By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Malwarebytes. 14 days free trial available.

Quick menu:

Step 1

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Safe Mode with Networking

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup. Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings". Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Windows 8 Safe Mode with networking

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

windows 10 safe mode with networking

Video showing how to start Windows 10 in "Safe Mode with Networking":

Step 2

Log in to the account infected with the Sage virus. Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.

If you cannot start your computer in Safe Mode with Networking, try performing a System Restore.

Video showing how to remove ransomware virus using "Safe Mode with Command Prompt" and "System Restore":

1. During your computer start process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.

Boot your computer in Safe Mode with Command Prompt

2. When Command Prompt mode loads, enter the following line: cd restore and press ENTER.

system restore using command prompt type cd restore

3. Next, type this line: rstrui.exe and press ENTER.

system restore using command prompt rstrui.exe

4. In the opened window, click "Next".

restore system files and settings

5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the Sage ransomware virus infiltrating your PC).

select a restore point

6. In the opened window, click "Yes".

run system restore

7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remaining Sage ransomware files.

To restore individual files encrypted by this ransomware, try using Windows Previous Versions feature. This method is only effective if the System Restore function was enabled on an infected operating system. Note that some variants of Sage are known to remove Shadow Volume Copies of the files, so this method may not work on all computers.

To restore a file, right-click over it, go into Properties, and select the Previous Versions tab. If the relevant file has a Restore Point, select it and click the "Restore" button.

Restoring files encrypted by CryptoDefense

If you cannot start your computer in Safe Mode with Networking (or with Command Prompt), boot your computer using a rescue disk. Some variants of ransomware disable Safe Mode making its removal complicated. For this step, you require access to another computer.

To regain control of the files encrypted by Sage, you can also try using a program called Shadow Explorer. More information on how to use this program is available here.

shadow explorer screenshot

To protect your computer from file encryption ransomware such as this, use reputable antivirus and anti-spyware programs. As an extra protection method, you can use programs called HitmanPro.Alert and Malwarebytes Anti-Ransomware, which artificially implant group policy objects into the registry to block rogue programs such as Sage ransomware.

HitmanPro.Alert CryptoGuard - detects encryption of files and neutralises any attempts without need for user-intervention:

hitmanproalert ransomware prevention application

Malwarebytes Anti-Ransomware Beta uses advanced proactive technology that monitors ransomware activity and terminates it immediately - before reaching users' files:

malwarebytes anti-ransomware

  • The best way to avoid damage from ransomware infections is to maintain regular up-to-date backups. More information on online backup solutions and data recovery software Here.

Other tools known to remove Sage ransomware:

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

Removal Instructions in other languages
Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
Sage virus QR code
A QR code (Quick Response Code) is a machine-readable code which stores URLs and other information. This code can be read using a camera on a smartphone or a tablet. Scan this QR code to have an easy access removal guide of Sage virus on your mobile device.
We Recommend:

Get rid of Windows malware infections today:

Download Malwarebytes

Platform: Windows

Editors' Rating for Malwarebytes:
Editors ratingOutstanding!

[Back to Top]

To use full-featured product, you have to purchase a license for Malwarebytes. 14 days free trial available.