Sage 2.0 Ransomware

Also Known As: Sage 2.0 virus
Distribution: Low
Damage level: Severe

Sage 2.0 ransomware removal instructions

What is Sage 2.0?

Sage 2.0 is an updated version of Sage - a ransomware-type virus. Following infiltration, Sage 2.0 encrypts various files and appends their filenames with the ".sage" extension. For instance, "sample.jpg" is renamed to "sample.jpg.sage". Following successful encryption, Sage 2.0 creates an HTML file ("Recovery_[3_random_characters].html"), places it in each folder containing encrypted files, and changes the desktop wallpaper.

The wallpaper and HTML file contain an identical ransom-demand message informing victims of the encryption and stating that files cannot be restored without the assistance of Sage 2.0's developers. To receive help, victims must pay a ransom equivalent of $2000 in Bitcoins. It is currently unknown whether Sage 2.0 uses symmetric or asymmetric cryptography. In either case, decryption without a unique key is impossible. This key is stored on a remote server controlled by Sage 2.0's developers and victims are encouraged to pay to receive it. Payment must be made via Sage 2.0's website (links are provided within the ransom-demand message). In addition, the ransom must be paid within the given time frame (the website contains a timer), otherwise the key is deleted permanently and decryption becomes impossible. Despite these demands and threats, you should never trust cyber criminals. Research shows that victims are often ignored once payments are submitted. There is no guarantee that your files will ever be decrypted and you will be scammed. Furthermore, you will support these criminals' malicious businesses. We strongly advise you to ignore all requests to pay or contact these people. Unfortunately, there are no tools capable of restoring files encrypted by Sage 2.0. The problem can only be resolved by restoring files/system from a backup.

Screenshot of a message (wallpaper) encouraging users to pay a ransom to decrypt their compromised data:

Sage 2.0 decrypt instructions

Sage 2.0 shares many similarities with CTB-Locker, Locky, Cerber, and dozens of other ransomware-type viruses. Research reveals that these viruses encrypt files and make ransom demands. There are just two major differences between ransomware-type viruses: 1) type of encryption algorithm [symmetric/asymmetric] used, and; 2) size of ransom. The distribution methods are also identical. Cyber criminals proliferate ransomware via fake software updaters, trojans, third party software download sources (peer-to-peer networks, free file hosting websites, freeware download websites, etc.), and infectious files attached to spam emails. Therefore, keeping your installed applications up-to-date and using a legitimate anti-virus/anti-spyware suite is essential. Note, however, that cyber criminals often use fake software updaters to infect the system. Therefore, only use tools from official websites. Furthermore, never open files received from suspicious emails or download software from unofficial sources.

Special thanks to security researcher Brad Duncan for providing samples and research insights on this ransomware.

Screenshot of Sage 2.0 HTML file:

Sage 2.0 decrypt instructions

Ransom-demand message presented within Sage 2.0 HTML file and desktop wallpaper:

Need help with translation?? Use
All your important and critical files as well as databases, images and videos and so on were encrypted by software known as SAGE!
SAGE 2.0 uses military grade elliptic curve cryptography and you have no chances restoring your files without our help!
But if you follow our instructions we guarantee that you can restore all your files quickly and safely!
To get the instructions open any of this temporary links m your browser:
This links are temporary and will stop working after some time, so if you can't open these links, you can use TOR Browser
The TOR Browser is available on the official website
Just open this site, click on the "Download Tor" button and follow the installation instructions, then use it to open the following link:
Please be sure to copy this instruction text and links to your notepad to avoid losing it.
This crypto ransomware encrypts user data using the AES, and then calls go to the Tor-site to pay a ransom in Bitcoin and get instructions on how to return the files. Redemption amount: $ 2,000 (~ 2.15550 Bitcoin). After 7 days, the amount of foreclosures doubled.

Sage 2.0 ransomware Tor website "Homepage":

Sage 2.0 website's Home

Text presented within this page:

Important Information! Please read very carefully!
Sage 2.0 encrypted all your files!
All your files, images, videos and databases where have been encrypted and no longer accessible by software known as Sage 2.0!
To restore all your files you need to pay $2000 (≈2.17965) for the decryption.
The after full payment, you will be able to download the software to restore your data.
In the case of non-payment of the full commission within 5d 05h,
the amount of commission will be raised to $4000 (≈4.35929)
You have no chance to restore the files without our help!
The files will restored easily if you will follow our instructions!
In case of the repeated non-payment of the increased commission during the 5d 05h period,
the unique decryption code for your files will be blocked
and its recovery will be absolutely impossible!

Sage 2.0 ransomware Tor website "Payment" page:

Sage 2.0 website's Payment

Text presented within this page:

Payment procedure How to pay?
Payment can only be made using the BitCoin system.
So you can be sure that in the case of full payment of the commission, all your files will be decrypted.
Please note that BTC currency rate as any other currency rate in the world is not fixed. It tends to increase, therefore we advise you not to delay the BTC currency purchase and payment.
If you want to learn more what is Bitcoin, then watch this YouTube Video or visit WeUseCoins website.
How to pay within the BitCoin system?
Don't worry, the payment process in the BitCoin system is not difficult and requires few simple steps.
First of all, you need to create your Bitcoin currency (BTC) wallet.
We recommend to use most popular and easy-to-use online wallet.
Or you can install Electrum software wallet for any OS you need
Next, you need to top-up your Bitcoin wallet's balance.
Below is the list of trusted services where you may buy Bitcoin. These services absolutely are not related to us!
If you can't find the option that suits you, then maybe you need to try find the solution in Google?
To receive the payment from you, we have created the unique Bitcoin wallet.
Further you need to make transaction from your own Bitcoin-wallet to the Bitcoin-wallet which we have prepared for you.
You can see it below (large font).
This wallet has been created especially for you and the amount paid can not be lost!
Send 2.17965 to the following wallet: 1EjHLfL5yy4o7pjG7sfvPrQfPwfMtVT4J8
If you already made the partial payment before, you can see there the remaining amount that you need to pay.
If you need to save or copy your BTC wallet address don't try to write it down by hand.
If while making the transaction you type the wrong BTC wallet number, the money will be lost!
Therefore, if necessary, print out the BTC wallet address you need or use the QR-code scanner on your smartphone/tablet.
Keep in mind that some Bitcoin purchase services are not work in real time and have the delay in payment processing.
The delay may last from 1 to 36 hours.
We therefore recommend you not to put aside the decision of payment until the last moment. Failure to pay on time may result in the increase of the payment amount!
After full payment you can download the decryption software from the Instructions section and use it with your personal decryption key.
We guarantee that all your files will be decrypted.
Note: Due to the configuration of some browsers simply reload this page does not always update the current information.
Please logout and relogin into your account to check the actually decryption status.

Sage 2.0 ransomware Tor website "Instructions" page:

Sage 2.0 website's Instructions

Text presented within this page:

Instructions What to do after the payment is made? How to decrypt all your data?
After payment you can download the decryption software from the home page. We guarantee that all your files will be decrypted.
Just follow these simple steps:
1. Login to your personal page
2. Copy the decryption key from field on the home page
3. Click "Download decryption software" button and save Sage2Decrypter.exe to your hard disk
4. Run Sage2Decrypter.exe
5. Paste the decryption key into "Key code" field in the decryption software window.
6. Select folder or disk you want to decrypt.
7. Click "Decrypt" button and wait for successfully completion of the decryption process
8. IMPORTANT: Don't turn off or reboot your PC before the process is completed!
9. Congratulations! Now all your files are restored!

Sage 2.0 ransomware Tor website "Support" page:

Sage 2.0 website's Support

Text presented within this page:

If you still have some questions on the work of our service, please use the special form to contact our support service.
We will be glad to answer any questions you may have.
Note: Due to the configuration of some browsers simply reload this page does not always update the current information.
Please logout and relogin into your account to check the actually decryption status.

Here's how Sage 2.0 Tor website looks like (GIF):

Sage 2.0 website gif

Screenshot of files encrypted by Sage 2.0 (".sage" extension):

Sage 2.0 decrypt instructions

Update 8 February, 2017 - Cyber criminals have updated this ransomware. Now the ransom demanding message that comes as a desktop wallpaper is in green color (was red before). Right after encrypting victim’s files this ransomware displays a ransom demanding message in a pop-up window named “Decryption Instructions” (!HELP_SOS.hta file) which is available in 11 languages (English, German, Italian, Portuguese, Spain, France, Korean, Dutch, Persian, Arabic, Chinese).

Screenshot of a ransom note presented in a wallpaper:

sage 2.0 ransomware updated wallapper

Decryption Instructions pop-up (!HELP_SOS.hta file):

sage2 !HELP SOS.hta file

Text presented in this pop-up:

File recovery instructions
You probably noticed that you can not open your files and that some software stopped working correctly. This is expected. Your files content is still there, but it was encrypted by "SAGE 2.0 Ransomware". Your files are not lost, it is possible to revert them back to normal state by decrypting. The only way you can do that is by getting "SAGE Decrypter" software and your personal decryption key. Using any other software which claims to be able to restore your files will result in files being damaged or destroyed. You can purchase "SAGE Decrypter" software and your decryption key at your personal page you can access by following links: -  If you are asked for your personal key, copy it to the form on the site. This is your personal key: -  You will also be able to decrypt one file for free to make sure "SAGE Decrypter" software is able to recover your files
If none of those links work for you for a prolonged period of time or you need your files recovered as fast as possible, you can also access your personal page using "Tor Browser". In order to do that you need to:
open Internet Explorer or any other internet browser;
copy the address into address bar and press "Enter";
once the page opens, you will be offered to download Tor Browser, download it and run the installator, follow installation instructions;
once installation is finished, open the newly installed Tor Browser and press the "Connect" button (button can be named differently if you installed non-English version);
Tor Browser will establish connection and open a normal browser window;
copy the address -
into this browser address bar and press "Enter";
your personal page should be opened now; if it didn't then wait for a bit and try again.
If you can not perform this steps then check your internet connection and try again. If it still doesn't work, try asking some computer guy for help in performing this steps for you or look for some video guides on YouTube.
You can find a copy of this instruction in files named "!HELP_SOS" stored next to your encrypted files.

Encrypted files now get an icon of a lock (the extension is the same as in the previous version - .sage):

sage 2.0 encrypted files lock icon

Update 21 February, 2017 - Cyber criminals have released another update for this ransomware. It’s now called "SAGE 2.2 Ransomware":

sage ransomware 2.2 hta file sage ransomware 2.2 wallpaper

The Tor website seems unchanged compared to the previous variant.

Sage 2.0 ransomware removal:

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Malwarebytes is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Malwarebytes By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Malwarebytes. 14 days free trial available.

Quick menu:

Step 1

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Safe Mode with Networking

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup. Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings". Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Windows 8 Safe Mode with networking

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

windows 10 safe mode with networking

Video showing how to start Windows 10 in "Safe Mode with Networking":

Step 2

Log in to the account infected with the Sage 2.0 virus. Start your Internet browser and download a legitimate anti-spyware program. Update the anti-spyware software and start a full system scan. Remove all entries detected.

If you cannot start your computer in Safe Mode with Networking, try performing a System Restore.

Video showing how to remove ransomware virus using "Safe Mode with Command Prompt" and "System Restore":

1. During your computer start process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.

Boot your computer in Safe Mode with Command Prompt

2. When Command Prompt mode loads, enter the following line: cd restore and press ENTER.

system restore using command prompt type cd restore

3. Next, type this line: rstrui.exe and press ENTER.

system restore using command prompt rstrui.exe

4. In the opened window, click "Next".

restore system files and settings

5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the Sage 2.0 ransomware virus infiltrating your PC).

select a restore point

6. In the opened window, click "Yes".

run system restore

7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remaining Sage 2.0 ransomware files.

To restore individual files encrypted by this ransomware, try using Windows Previous Versions feature. This method is only effective if the System Restore function was enabled on an infected operating system. Note that some variants of Sage 2.0 are known to remove Shadow Volume Copies of the files, so this method may not work on all computers.

To restore a file, right-click over it, go into Properties, and select the Previous Versions tab. If the relevant file has a Restore Point, select it and click the "Restore" button.

Restoring files encrypted by CryptoDefense

If you cannot start your computer in Safe Mode with Networking (or with Command Prompt), boot your computer using a rescue disk. Some variants of ransomware disable Safe Mode making its removal complicated. For this step, you require access to another computer.

To regain control of the files encrypted by Sage 2.0, you can also try using a program called Shadow Explorer. More information on how to use this program is available here.

shadow explorer screenshot

To protect your computer from file encryption ransomware such as this, use reputable antivirus and anti-spyware programs. As an extra protection method, you can use programs called HitmanPro.Alert and Malwarebytes Anti-Ransomware, which artificially implant group policy objects into the registry to block rogue programs such as Sage 2.0 ransomware.

HitmanPro.Alert CryptoGuard - detects encryption of files and neutralises any attempts without need for user-intervention:

hitmanproalert ransomware prevention application

Malwarebytes Anti-Ransomware Beta uses advanced proactive technology that monitors ransomware activity and terminates it immediately - before reaching users' files:

malwarebytes anti-ransomware

  • The best way to avoid damage from ransomware infections is to maintain regular up-to-date backups. More information on online backup solutions and data recovery software Here.

Other tools known to remove Sage 2.0 ransomware:

About the author:

Tomas Meskauskas

Tomas Meskauskas - expert security researcher, professional malware analyst.

I am passionate about computer security and technology. I have an experience of over 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an author and editor for since 2010. Follow me on Twitter and LinkedIn to stay informed about the latest online security threats. Contact Tomas Meskauskas.

PCrisk security portal is brought by a company RCS LT. Joined forces of security researchers help educate computer users about the latest online security threats. More information about the company RCS LT.

Our malware removal guides are free. However, if you want to support us you can send us a donation.

Removal Instructions in other languages
Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

QR Code
Sage 2.0 virus QR code
A QR code (Quick Response Code) is a machine-readable code which stores URLs and other information. This code can be read using a camera on a smartphone or a tablet. Scan this QR code to have an easy access removal guide of Sage 2.0 virus on your mobile device.
We Recommend:

Get rid of Windows malware infections today:

Download Malwarebytes

Platform: Windows

Editors' Rating for Malwarebytes:
Editors ratingOutstanding!

[Back to Top]

To use full-featured product, you have to purchase a license for Malwarebytes. 14 days free trial available.