Re: Rakhni Decryptor is designed to decrypt files encrypted by Dharma Ransom.
Quick look on Kaspy - yes, they have a such a tool. On the site you linked - they mention that a specific file contains an encrypted (or encoded) password file which contains the user's decryption key. From the sounds of the description either this is encrypted using a weaker method OR the malware writer's decryption key has been released somewhere.
Would love to get a copy of Dharma and slap a 7 (or XP) install on some spare hardware (would try a VM but I mostly keep my VM's on my working machines and wouldn't want a 'leak' accidentally!) and have at it. I can readily furnish a few thousand image and doc files to give it a good run.
IME, if Kaspersky says they can recover the files then I'm pretty sure they can, and in this case it's not the shop working with the malware writers but using freebie Kaspersky tools at a premium. Same as the people who used to use Dogbert's free laptop password recovery tools (and yes, having used those many times myself, quite convinced they work)
ISTR some years back there was another ransomware variant that created a file on disk that contained the decryption key, which was then uploaded to the writer - of course said file could be recovered by file recovery tools as it wasn't over-written (or was poorly overwritten). But that was some years back and I have other work I need to do
Biting the hand that feeds IT
