[ { "name": [ ".CryptoHasYou." ], "extensions": ".enc", "extensionPattern": "", "ransomNoteFilenames": " YOUR_FILES_ARE_LOCKED.txt", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/CryptoHasYou.html" ], "screenshots": "", "microsoftDetectionName": "Trojan:Win32/Dynamer!ac", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Trojan%3AWin32%2FDynamer!ac", "sandbox": "https://www.hybrid-analysis.com/sample/afd3394fb538b36d20085504b86000ea3969e0ae5da8e0c058801020ec8da67c?environmentId=4", "iocs": "https://otx.alienvault.com/pulse/57180b18c1492d015c14bed8/", "snort": "" }, { "name": [ "777", "Sevleg" ], "extensions": ".777", "extensionPattern": "._[timestamp]_$[email]$.777\ne.g. ._14-05-2016-11-59-36_$ninja.gaiver@aol.com$.777", "ransomNoteFilenames": "read_this_file.txt", "comment": "", "encryptionAlgorithm": "XOR", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/777" ], "screenshots": "", "microsoftDetectionName": "Ransom:Win32/Empercrypt.A", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/Encyclopedia/Entry.aspx?Name=Ransom:Win32/Empercrypt.A", "sandbox": "https://www.hybrid-analysis.com/sample/2955d081ed9bca764f5037728125a7487f29925956f3095c58035919d50290b5?environmentId=4", "iocs": "https://otx.alienvault.com/pulse/573b02701116a040ceccdd85/", "snort": "" }, { "name": [ "7ev3n", "7ev3n-HONE$T" ], "extensions": ".R4A\n.R5A", "extensionPattern": "", "ransomNoteFilenames": "FILES_BACK.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://github.com/hasherezade/malware_analysis/tree/master/7ev3n\nhttps://www.youtube.com/watch?v=RDNbH5HDO1E&feature=youtu.be", "http://www.nyxbone.com/malware/7ev3n-HONE$T.html\n" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/pulse/57180dbf0ebaa4015af21166/", "snort": "" }, { "name": [ "7h9r" ], "extensions": ".7h9r", "extensionPattern": "", "ransomNoteFilenames": "README_.TXT", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/7h9r.html" ], "screenshots": "" }, { "name": [ "8lock8" ], "extensions": ".8lock8", "extensionPattern": "", "ransomNoteFilenames": "READ_IT.txt", "comment": "Based on HiddenTear", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/614025/8lock8-help-support-topic-8lock8-read-ittxt/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "https://www.hybrid-analysis.com/sample/90256220a513536b2a09520a1abb9b0f62efc89b873c645d3fd4a1f3ebed332d?environmentId=4", "iocs": "https://www.hybrid-analysis.com/sample/d572a7d7254846adb73aebc3f7891398e513bdac9aac06231991e07e7b55fac8?environmentId=4", "snort": "" }, { "name": [ "AiraCrop" ], "extensions": "._AiraCropEncrypted", "extensionPattern": "", "ransomNoteFilenames": "How to decrypt your files.txt", "comment": "related to TeamXRat", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/PolarToffee/status/796079699478900736" ], "screenshots": "" }, { "name": [ "Al-Namrood" ], "extensions": ".unavailable\n.disappeared", "extensionPattern": "", "ransomNoteFilenames": "Read_Me.Txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/al-namrood" ], "screenshots": "" }, { "name": [ "Alcatraz Locker" ], "extensions": ".Alcatraz", "extensionPattern": "", "ransomNoteFilenames": "ransomed.html", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/PolarToffee/status/792796055020642304" ], "screenshots": "" }, { "name": [ "ALFA Ransomware" ], "extensions": ".bin", "extensionPattern": "", "ransomNoteFilenames": "README HOW TO DECRYPT YOUR FILES.HTML", "comment": "Made by creators of Cerber", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/new-alfa-or-alpha-ransomware-from-the-same-devs-as-cerber/" ], "screenshots": "" }, { "name": [ "Alma Ransomware" ], "extensions": "random", "extensionPattern": "random(x5)", "ransomNoteFilenames": "Unlock_files_randomx5.html", "comment": "", "encryptionAlgorithm": "AES(128)", "decryptor": "", "resources": [ "https://cta-service-cms2.hubspot.com/ctas/v2/public/cs/c/?cta_guid=d4173312-989b-4721-ad00-8308fff353b3&placement_guid=22f2fe97-c748-4d6a-9e1e-ba3fb1060abe&portal_id=326665&redirect_url=APefjpGnqFjmP_xzeUZ1Y55ovglY1y1ch7CgMDLit5GTHcW9N0ztpnIE-ZReqqv8MDj687_4Joou7Cd2rSx8-De8uhFQAD_Len9QpT7Xvu8neW5drkdtTPV7hAaou0osAi2O61dizFXibewmpO60UUCd5OazCGz1V6yT_3UFMgL0x9S1VeOvoL_ucuER8g2H3f1EfbtYBw5QFWeUmrjk-9dGzOGspyn303k9XagBtF3SSX4YWSyuEs03Vq7Fxb04KkyKc4GJx-igK98Qta8iMafUam8ikg8XKPkob0FK6Pe-wRZ0QVWIIkM&hsutk=34612af1cd87864cf7162095872571d1&utm_referrer=https%3A%2F%2Finfo.phishlabs.com%2Fblog%2Falma-ransomware-analysis-of-a-new-ransomware-threat-and-a-decrypter&canon=https%3A%2F%2Finfo.phishlabs.com%2Fblog%2Falma-ransomware-analysis-of-a-new-ransomware-threat-and-a-decrypter&__hstc=61627571.34612af1cd87864cf7162095872571d1.1472135921345.1472140656779.1472593507113.3&__hssc=61627571.1.1472593507113&__hsfp=1114323283", "https://info.phishlabs.com/blog/alma-ransomware-analysis-of-a-new-ransomware-threat-and-a-decrypter" ], "screenshots": "http://www.bleepingcomputer.com/news/security/new-alma-locker-ransomware-being-distributed-via-the-rig-exploit-kit/", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Alma+Ransomware", "snort": "" }, { "name": [ "Alpha Ransomware", "AlphaLocker" ], "extensions": ".encrypt", "extensionPattern": "", "ransomNoteFilenames": "Read Me (How Decrypt) !!!!.txt", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://download.bleepingcomputer.com/demonslay335/AlphaDecrypter.zip", "http://www.bleepingcomputer.com/news/security/decrypted-alpha-ransomware-continues-the-trend-of-accepting-amazon-cards/" ], "screenshots": "https://twitter.com/malwarebread/status/804714048499621888" }, { "name": [ "Alphabet" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Doesn't encrypt any files / provides you the key", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/PolarToffee/status/812331918633172992" ], "screenshots": "" }, { "name": [ "AMBA" ], "extensions": ".amba", "extensionPattern": "", "ransomNoteFilenames": "\u041f\u0420\u041e\u0427\u0422\u0418_\u041c\u0415\u041d\u042f.txt\nREAD_ME.txt", "comment": "Websites only\namba@riseup.net", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/benkow_/status/747813034006020096" ], "screenshots": "" }, { "name": [ "Angela Merkel" ], "extensions": ".angelamerkel", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/798268218364358656" ], "screenshots": "" }, { "name": [ "AngleWare" ], "extensions": ".AngleWare", "extensionPattern": "", "ransomNoteFilenames": "READ_ME.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/844531418474708993" ], "screenshots": "" }, { "name": [ "Angry Duck" ], "extensions": ".adk", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Demands 10 BTC", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/demonslay335/status/790334746488365057" ], "screenshots": "" }, { "name": [ "Anony", "Based on HiddenTear\nngocanh" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/842047409446387714" ], "screenshots": "" }, { "name": [ "Anubis" ], "extensions": ".coded", "extensionPattern": "", "ransomNoteFilenames": "Decryption Instructions.txt", "comment": "EDA2", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://nyxbone.com/malware/Anubis.html" ], "screenshots": "" }, { "name": [ "Apocalypse", "Fabiansomeware" ], "extensions": ".encrypted\n.SecureCrypted\n.FuckYourData\n.unavailable\n.bleepYourFiles\n.Where_my_files.txt", "extensionPattern": "[filename].ID-*8characters+countrycode[cryptservice@inbox.ru].[random7characters]\n*filename*.ID-[A-F0-9]{8}+countrycode[cryptcorp@inbox.ru].[a-z0-9]{13}", "ransomNoteFilenames": "*.How_To_Decrypt.txt\n*.Contact_Here_To_Recover_Your_Files.txt\n*.Where_my_files.txt\n*.Read_Me.Txt\n*md5*.txt", "comment": "decryptionservice@mail.ru\nrecoveryhelp@bk.ru\nransomware.attack@list.ru\nesmeraldaencryption@mail.ru\ndr.compress@bk.ru", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/apocalypse", "http://blog.emsisoft.com/2016/06/29/apocalypse-ransomware-which-targets-companies-through-insecure-rdp/" ], "screenshots": "" }, { "name": [ "ApocalypseVM" ], "extensions": ".encrypted\n.locked", "extensionPattern": "", "ransomNoteFilenames": "*.How_To_Get_Back.txt ", "comment": "Apocalypse ransomware version which uses VMprotect", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://decrypter.emsisoft.com/download/apocalypsevm" ], "screenshots": "", "microsoftDetectionName": "Win32/Cribit", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32/Cribit", "sandbox": "https://www.hybrid-analysis.com/sample/7d66e29649a09bf3edb61618a61fd7f9fb74013b739dfc4921eefece6c8439bb?environmentId=4", "iocs": "https://otx.alienvault.com/pulse/57166d65c1492d015c14bcc4/", "snort": "" }, { "name": [ "ASN1" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "!!!!!readme!!!!!.htm", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://malwarebreakdown.com/2017/03/02/rig-ek-at-92-53-105-43-drops-asn1-ransomware/" ], "screenshots": "" }, { "name": [ "AutoLocky" ], "extensions": ".locky", "extensionPattern": "", "ransomNoteFilenames": "info.txt\ninfo.html", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/autolocky" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Aw3s0m3Sc0t7" ], "extensions": ".enc", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/828902907668000770" ], "screenshots": "" }, { "name": [ "BadBlock" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "Help Decrypt.html", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/badblock", "http://www.nyxbone.com/malware/BadBlock.html" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/pulse/56eac97aaef9214b1550b37e/", "snort": "" }, { "name": [ "BadEncript" ], "extensions": ".bript", "extensionPattern": "", "ransomNoteFilenames": "More.html", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/demonslay335/status/813064189719805952" ], "screenshots": "" }, { "name": [ "BaksoCrypt" ], "extensions": ".adr", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on my-Little-Ransomware", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/760482299007922176" ], "screenshots": "https://0xc1r3ng.wordpress.com/2016/06/24/bakso-crypt-simple-ransomware/" }, { "name": [ "Bandarchor", "Rakhni" ], "extensions": ".id-1235240425_help@decryptservice.info", "extensionPattern": ".id-[ID]_[EMAIL_ADDRESS]", "ransomNoteFilenames": "HOW TO DECRYPT.txt", "comment": "Files might be partially encrypted", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://reaqta.com/2016/03/bandarchor-ransomware-still-active/" ], "screenshots": "https://www.bleepingcomputer.com/news/security/new-bandarchor-ransomware-variant-spreads-via-malvertising-on-adult-sites/" }, { "name": [ "BarRax" ], "extensions": ".BarRax", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on HiddenTear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/demonslay335/status/835668540367777792" ], "screenshots": "" }, { "name": [ "Bart", "BaCrypt" ], "extensions": ".bart.zip\n.bart\n.perl", "extensionPattern": "", "ransomNoteFilenames": "recover.txt\nrecover.bmp", "comment": "Possible affiliations with RockLoader, Locky and Dridex", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://now.avg.com/barts-shenanigans-are-no-match-for-avg/", "http://phishme.com/rockloader-downloading-new-ransomware-bart/" ], "screenshots": "https://www.proofpoint.com/us/threat-insight/post/New-Bart-Ransomware-from-Threat-Actors-Spreading-Dridex-and-Locky", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "BitCryptor" ], "extensions": ".clf", "extensionPattern": "", "ransomNoteFilenames": "\n", "comment": "Has a GUI.\nCryptoGraphic Locker family. Newer CoinVault variant.", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://noransom.kaspersky.com/" ], "screenshots": "" }, { "name": [ "BitStak" ], "extensions": ".bitstak", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "Base64 + String Replacement", "decryptor": "", "resources": [ "https://download.bleepingcomputer.com/demonslay335/BitStakDecrypter.zip" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "BlackShades Crypter", "SilentShade" ], "extensions": ".Silent", "extensionPattern": "", "ransomNoteFilenames": "Hacked_Read_me_to_decrypt_files.html\nYourID.txt", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://nyxbone.com/malware/BlackShades.html" ], "screenshots": "", "microsoftDetectionName": "Ransom:JS/Brolo", "microsoftInfo": "www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:JS/Brolo", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=BlackShades+Crypter", "snort": "" }, { "name": [ "Blocatto" ], "extensions": ".blocatto", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on HiddenTear", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/614456/bloccato-ransomware-bloccato-help-support-leggi-questo-filetxt/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Blocatto", "snort": "" }, { "name": [ "Booyah", "Salam!" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "EXE was replaced to neutralize threat", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "Ransom: Win32/Cendode.A ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/Cendode.A", "sandbox": "", "iocs": "https://otx.alienvault.com/pulse/5721628cce2199015fb2b101/", "snort": "" }, { "name": [ "Brazilian" ], "extensions": ".lock", "extensionPattern": "", "ransomNoteFilenames": "MENSAGEM.txt", "comment": "Based on EDA2", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/brazilianRansom.html" ], "screenshots": "", "microsoftDetectionName": "Win32/Cerber", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/Encyclopedia/Entry.aspx?Name=Win32/Cerber", "sandbox": "https://www.hybrid-analysis.com/sample/a375201f22b6e71d8ea0f81266242e4638e1754aeee14059e9c5e39026d6c710?environmentId=4", "iocs": "https://otx.alienvault.com/browse?q=Brazilian", "snort": "" }, { "name": [ "Brazilian Globe" ], "extensions": "", "extensionPattern": ".id-%ID%_garryweber@protonmail.ch", "ransomNoteFilenames": "HOW_OPEN_FILES.html", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/821831437884211201" ], "screenshots": "" }, { "name": [ "BrLock" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "https://www.proofpoint.com/us/threat-insight/post/ransomware-explosion-continues-cryptflle2-brlock-mm-locker-discovered" ], "screenshots": "", "microsoftDetectionName": "Win32/Chicrypt ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32/Chicrypt", "sandbox": "https://www.hybrid-analysis.com/sample/a375201f22b6e71d8ea0f81266242e4638e1754aeee14059e9c5e39026d6c710?environmentId=4", "iocs": "https://otx.alienvault.com/pulse/572df3997740f10160c78d5c/", "snort": "" }, { "name": [ "Browlock" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "no local encryption, browser only", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "Ransom: MSIL/Vaultlock.A ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:MSIL/Vaultlock.A", "sandbox": "https://www.hybrid-analysis.com/sample/3ab7a35b31578b439be5d9498489b5e9d2a016db0a348a145979ed75f575dbef?environmentId=4", "iocs": "https://otx.alienvault.com/pulse/55fabc314637f26df7745efc/", "snort": "" }, { "name": [ "BTCWare" ], "extensions": ".btcware", "extensionPattern": "", "ransomNoteFilenames": "#_HOW_TO_FIX_!.hta", "comment": "Related to / new version of CryptXXX", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/845199679340011520" ], "screenshots": "" }, { "name": [ "Bucbi" ], "extensions": "", "extensionPattern": "\n", "ransomNoteFilenames": "", "comment": "no file name change, no extension", "encryptionAlgorithm": "GOST", "decryptor": "", "resources": [ "http://researchcenter.paloaltonetworks.com/2016/05/unit42-bucbi-ransomware-is-back-with-a-ukrainian-makeover/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Bucbi", "snort": "" }, { "name": [ "BuyUnlockCode" ], "extensions": "", "extensionPattern": "(.*).encoded.([A-Z0-9]{9})", "ransomNoteFilenames": "BUYUNLOCKCODE.txt", "comment": "Does not delete Shadow Copies", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Central Security Treatment Organization" ], "extensions": ".cry", "extensionPattern": "", "ransomNoteFilenames": "!Recovery_[random_chars].html\n!Recovery_[random_chars].txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/625820/central-security-treatment-organization-ransomware-help-topic-cry-extension/" ], "screenshots": "" }, { "name": [ "Cerber" ], "extensions": ".cerber\n.cerber2\n.cerber3", "extensionPattern": "", "ransomNoteFilenames": "# DECRYPT MY FILES #.html\n# DECRYPT MY FILES #.txt\n# DECRYPT MY FILES #.vbs\n# README.hta\n_{RAND}_README.jpg\n_{RAND}_README.hta\n_HELP_DECRYPT_[A-Z0-9]{4-8}_.jpg\n_HELP_DECRYPT_[A-Z0-9]{4-8}_.hta\n_HELP_HELP_HELP_%random%.jpg\n_HELP_HELP_HELP_%random%.hta\n_HOW_TO_DECRYPT_[A-Z0-9]{4-8}_.jpg\n_HOW_TO_DECRYPT_[A-Z0-9]{4-8}_.hta", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "https://blog.malwarebytes.org/threat-analysis/2016/03/cerber-ransomware-new-but-mature/" ], "screenshots": "https://community.rsa.com/community/products/netwitness/blog/2016/11/04/the-evolution-of-cerber-v410", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "CerberTear" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/795630452128227333" ], "screenshots": "" }, { "name": [ "Chimera" ], "extensions": ".crypt\n4 random characters, e.g., .PzZs, .MKJL", "extensionPattern": "", "ransomNoteFilenames": "YOUR_FILES_ARE_ENCRYPTED.HTML\nYOUR_FILES_ARE_ENCRYPTED.TXT\n.gif", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/chimera-ransomware-decryption-keys-released-by-petya-devs/", "https://blog.malwarebytes.org/threat-analysis/2015/12/inside-chimera-ransomware-the-first-doxingware-in-wild/" ], "screenshots": "", "microsoftDetectionName": "Ransom: Win32/Crowti ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/Crowti", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Chimera", "snort": "" }, { "name": [ "CHIP" ], "extensions": ".CHIP\n.DALE", "extensionPattern": "", "ransomNoteFilenames": "CHIP_FILES.txt\nDALE_FILES.TXT", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://malware-traffic-analysis.net/2016/11/17/index.html" ], "screenshots": "https://www.bleepingcomputer.com/news/security/rig-e-exploit-kit-now-distributing-new-chip-ransomware/" }, { "name": [ "Click Me Game" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.youtube.com/watch?v=Xe30kV4ip8w" ], "screenshots": "" }, { "name": [ "Clock" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Does not encrypt anything", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/794956809866018816" ], "screenshots": "" }, { "name": [ "CloudSword" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "Warning\u8b66\u544a.html", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/822653335681593345" ], "screenshots": "" }, { "name": [ "Cockblocker" ], "extensions": ".hannah", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/jiriatvirlab/status/801910919739674624" ], "screenshots": "" }, { "name": [ "CoinVault" ], "extensions": ".clf", "extensionPattern": "", "ransomNoteFilenames": "wallpaper.jpg ", "comment": "CryptoGraphic Locker family. \nHas a GUI.\nDo not confuse with CrypVault!", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://noransom.kaspersky.com/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=CoinVault", "snort": "" }, { "name": [ "Coverton" ], "extensions": ".coverton\n.enigma\n.czvxce", "extensionPattern": "", "ransomNoteFilenames": "!!!-WARNING-!!!.html\n!!!-WARNING-!!!.txt\n", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/paying-the-coverton-ransomware-may-not-get-your-data-back/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Coverton", "snort": "" }, { "name": [ "Crptxxx" ], "extensions": ".crptxxx", "extensionPattern": "", "ransomNoteFilenames": "HOW_TO_FIX_!.txt", "comment": "Uses @enigma0x3's UAC bypass", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/839467168760725508" ], "screenshots": "" }, { "name": [ "Cryaki" ], "extensions": ".{CRYPTENDBLACKDC}", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://support.kaspersky.com/viruses/disinfection/8547" ], "screenshots": "", "microsoftDetectionName": "Ransom: Win32/Crowti \nWin32/Fortrypt ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/Crowti\nhttps://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32/Fortrypt", "sandbox": "https://www.hybrid-analysis.com/sample/e12405096f83b30b712d200b2fc42ce595e1d1254a631d989714b4fa423ef4c4?environmentId=4", "iocs": "https://otx.alienvault.com/browse?q=Cryaki", "snort": "" }, { "name": [ "Crybola" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://support.kaspersky.com/viruses/disinfection/8547" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Crybola", "snort": "" }, { "name": [ "CryFile" ], "extensions": ".criptiko\n.criptoko\n.criptokod\n.cripttt\n.aga", "extensionPattern": "", "ransomNoteFilenames": "SHTODELATVAM.txt\nInstructionaga.txt", "comment": "", "encryptionAlgorithm": "Moves bytes", "decryptor": "", "resources": [ "http://virusinfo.info/showthread.php?t=185396" ], "screenshots": "" }, { "name": [ "Cry", " CSTO", " Central Security Treatment Organization", "CryLocker" ], "extensions": ".cry", "extensionPattern": "", "ransomNoteFilenames": "!Recovery_[random_chars].html\n!Recovery_[random_chars].txt", "comment": "Identifies victim locations w/Google Maps API", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/the-crylocker-ransomware-communicates-using-udp-and-stores-data-on-imgur-com/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=CryLocker", "snort": "" }, { "name": [ "CrypMIC" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "README.TXT\nREADME.HTML\nREADME.BMP", "comment": "CryptXXX clone/spinoff", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://blog.trendmicro.com/trendlabs-security-intelligence/crypmic-ransomware-wants-to-follow-cryptxxx/" ], "screenshots": "" }, { "name": [ "Crypren" ], "extensions": ".ENCRYPTED", "extensionPattern": "", "ransomNoteFilenames": "READ_THIS_TO_DECRYPT.html", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://github.com/pekeinfo/DecryptCrypren", "http://www.nyxbone.com/malware/Crypren.html" ], "screenshots": "" }, { "name": [ "Crypt38" ], "extensions": ".crypt38", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "https://download.bleepingcomputer.com/demonslay335/Crypt38Keygen.zip", "https://blog.fortinet.com/2016/06/17/buggy-russian-ransomware-inadvertently-allows-free-decryption" ], "screenshots": "", "microsoftDetectionName": "Ransom: Win32/Crilock.A", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom%3aWin32%2fCrilock.A", "sandbox": "https://www.hybrid-analysis.com/sample/0348cdd333879d139306c3ff510b902013739c6bb244e20bcc5a4f762004d354?environmentId=1", "iocs": "https://otx.alienvault.com/browse?q=Crypt38", "snort": "" }, { "name": [ "CryptConsole" ], "extensions": "random", "extensionPattern": "decipher_ne@outlook.com_[encrypted_filename]\nunCrypte@outlook.com_[encrypted_filename]", "ransomNoteFilenames": "How decrypt files.hta", "comment": "Impersonates the Globe Ransomware\nWill not actually encrypt files", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/forums/t/638344/cryptconsole-uncrypteoutlookcom-support-topic-how-decrypt-fileshta/", "https://twitter.com/PolarToffee/status/824705553201057794" ], "screenshots": "" }, { "name": [ "Cryptear", "Hidden Tear" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.utkusen.com/blog/dealing-with-script-kiddies-cryptear-b-incident.html" ], "screenshots": "" }, { "name": [ "Crypter" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Does not actually encrypt the files, but simply renames them", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/jiriatvirlab/status/802554159564062722" ], "screenshots": "" }, { "name": [ "CryptFIle2" ], "extensions": ".scl", "extensionPattern": "id[_ID]email_xerx@usa.com.scl", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "RSA", "decryptor": "", "resources": [ "https://www.proofpoint.com/us/threat-insight/post/ransomware-explosion-continues-cryptflle2-brlock-mm-locker-discovered" ], "screenshots": "" }, { "name": [ "CryptInfinite" ], "extensions": ".crinf", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/" ], "screenshots": "" }, { "name": [ "CryptoBit" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "OKSOWATHAPPENDTOYOURFILES.TXT", "comment": "sekretzbel0ngt0us.KEY\ndo not confuse with CryptorBit", "encryptionAlgorithm": "AES and RSA", "decryptor": "", "resources": [ "http://www.pandasecurity.com/mediacenter/panda-security/cryptobit/" ], "screenshots": "http://news.softpedia.com/news/new-cryptobit-ransomware-could-be-decryptable-503239.shtml", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=CryptoBit", "snort": "https://www.snort.org/search?query=cryptolocker&submit_search=" }, { "name": [ "CryptoBlock" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "RaaS", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/drProct0r/status/810500976415281154" ], "screenshots": "https://blog.malwarebytes.com/threat-analysis/2017/03/cryptoblock-and-its-c2/" }, { "name": [ "CryptoDefense" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "HOW_DECRYPT.TXT\nHOW_DECRYPT.HTML\nHOW_DECRYPT.URL", "comment": "no extension change", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=CryptoDefense", "snort": "" }, { "name": [ "CryptoDevil" ], "extensions": ".devil", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/PolarToffee/status/843527738774507522" ], "screenshots": "" }, { "name": [ "CryptoFinancial", "Ranscam" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://blog.talosintel.com/2016/07/ranscam.html" ], "screenshots": "https://nakedsecurity.sophos.com/2016/07/13/ransomware-that-demands-money-and-gives-you-back-nothing/" }, { "name": [ "CryptoFortress" ], "extensions": ".frtrss", "extensionPattern": "", "ransomNoteFilenames": "READ IF YOU WANT YOUR FILES BACK.html", "comment": "Mimics Torrentlocker. Encrypts only 50% of each file up to 5 MB", "encryptionAlgorithm": "AES(256), RSA (1024)", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "CryptoGraphic Locker" ], "extensions": ".clf", "extensionPattern": "", "ransomNoteFilenames": "wallpaper.jpg", "comment": "Has a GUI.\nSubvariants: CoinVault\nBitCryptor", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "Ransom: MSIL/Nojocrypt.A ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:MSIL/Nojocrypt.A", "sandbox": "https://www.hybrid-analysis.com/sample/cddf81997b81869ad471df6b83c2dfe63a2551f4da9bdd57bce30b8d11e61e5b?environmentId=5", "iocs": "https://otx.alienvault.com/browse?q=CryptoGraphic+Locker", "snort": "" }, { "name": [ "Manamecrypt", " Telograph", " ROI Locker", "CryptoHost" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "RAR's victim's files\nhas a GUI", "encryptionAlgorithm": "AES(256) (RAR implementation)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/cryptohost-decrypted-locks-files-in-a-password-protected-rar-file/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=CryptoHost", "snort": "" }, { "name": [ "CryptoJacky" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/jiriatvirlab/status/838779371750031360" ], "screenshots": "" }, { "name": [ "CryptoJoker" ], "extensions": ".crjoker", "extensionPattern": "", "ransomNoteFilenames": "README!!!.txt\nGetYouFiles.txt\ncrjoker.html", "comment": "", "encryptionAlgorithm": "AES-256", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=CryptoJoker", "snort": "https://www.snort.org/search?query=ctb-locker" }, { "name": [ "CryptoLocker" ], "extensions": ".encrypted \n.ENC", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "no longer relevant", "encryptionAlgorithm": "RSA", "decryptor": "", "resources": [ "https://www.fireeye.com/blog/executive-perspective/2014/08/your-locker-of-information-for-cryptolocker-decryption.html", "https://reaqta.com/2016/04/uncovering-ransomware-distribution-operation-part-2/" ], "screenshots": "" }, { "name": [ "CryptoLocker 1.0.0" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/839747940122001408" ], "screenshots": "" }, { "name": [ "CryptoLocker 5.1" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/782890104947867649" ], "screenshots": "" }, { "name": [ "CryptoLuck / YafunnLocker" ], "extensions": ".[victim_id]_luck", "extensionPattern": "[A-F0-9]{8}_luck", "ransomNoteFilenames": "%AppData%\\@WARNING_FILES_ARE_ENCRYPTED.[victim_id].txt.", "comment": "via RIG EK", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/cryptoluck-ransomware-being-malvertised-via-rig-e-exploit-kits/" ], "screenshots": "https://twitter.com/malwareforme/status/798258032115322880" }, { "name": [ "CryptoMix", "Zeta" ], "extensions": ".code\n.scl\n.rmd\n.lesli\n.rdmk\n.CRYPTOSHIELD\n.CRYPTOSHIEL", "extensionPattern": ".id_(ID_MACHINE)_email_xoomx@dr.com_.code\n.id_*_email_zeta@dr.com\n.id_(ID_MACHINE)_email_anx@dr.com_.scl\n.email[supl0@post.com]id[\\[[a-z0-9]{16}\\]].lesli\n*filename*.email[*email*]_id[*id*].rdmk", "ransomNoteFilenames": "HELP_YOUR_FILES.html (CryptXXX)\nHELP_YOUR_FILES.txt (CryptoWall 3.0, 4.0)\nINSTRUCTION RESTORE FILE.TXT", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/CryptoMix.html" ], "screenshots": "https://www.cert.pl/en/news/single/technical-analysis-of-cryptomixcryptfile2-ransomware/" }, { "name": [ "CryptON", "Nemesis\nX3M" ], "extensions": "_crypt\n.id-_locked\n.id-_locked_by_krec\n.id-_locked_by_perfect\n.id-_x3m\n.id-_r9oj\n.id-_garryweber@protonmail.ch\n.id-_steaveiwalker@india.com_\n.id-_julia.crown@india.com_\n.id-_tom.cruz@india.com_\n.id-_CarlosBoltehero@india.com_\n.id-_maria.lopez1@india.com_", "extensionPattern": "name_crypt..extension", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "RSA, AES-256 and SHA-256", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/crypton", "https://www.bleepingcomputer.com/news/security/crypton-ransomware-is-here-and-its-not-so-bad-/" ], "screenshots": "https://twitter.com/JakubKroustek/status/829353444632825856" }, { "name": [ "CryptoRansomeware" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/817672617658347521" ], "screenshots": "" }, { "name": [ "Cryptorium" ], "extensions": ".ENC", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Only renames files and does not encrypt them", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "CryptoRoger" ], "extensions": ".crptrgr", "extensionPattern": "", "ransomNoteFilenames": "!Where_are_my_files!.html", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/new-ransomware-called-cryptoroger-that-appends-crptrgr-to-encrypted-files/" ], "screenshots": "" }, { "name": [ "CryptoShadow" ], "extensions": ".doomed", "extensionPattern": "", "ransomNoteFilenames": "LEER_INMEDIATAMENTE.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/821992610164277248" ], "screenshots": "" }, { "name": [ "CryptoShield" ], "extensions": ".CRYPTOSHIELD", "extensionPattern": "grfg.wct.CRYPTOSHIELD", "ransomNoteFilenames": "# RESTORING FILES #.HTML\n# RESTORING FILES #.TXT", "comment": "CryptoMix Variant", "encryptionAlgorithm": "AES(256) / ROT-13", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/cryptomix-variant-named-cryptoshield-1-0-ransomware-distributed-by-exploit-kits/" ], "screenshots": "" }, { "name": [ "CryptoShocker" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "ATTENTION.url", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/617601/cryptoshocker-ransomware-help-and-support-topic-locked-attentionurl/" ], "screenshots": "" }, { "name": [ "CryptoTorLocker2015" ], "extensions": ".CryptoTorLocker2015!", "extensionPattern": "", "ransomNoteFilenames": "HOW TO DECRYPT FILES.txt\n%Temp%\\.bmp", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/565020/new-cryptotorlocker2015-ransomware-discovered-and-easily-decrypted/" ], "screenshots": "" }, { "name": [ "CryptoTrooper" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "http://news.softpedia.com/news/new-open-source-linux-ransomware-shows-infosec-community-divide-508669.shtml" ], "screenshots": "" }, { "name": [ "CryptoWall 1" ], "extensions": "", "extensionPattern": "no filename change", "ransomNoteFilenames": "DECRYPT_INSTRUCTION.HTML\nDECRYPT_INSTRUCTION.TXT\nDECRYPT_INSTRUCTION.URL\nINSTALL_TOR.URL", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "Ransom: Win32/DMALocker ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/DMALocker", "sandbox": "https://www.hybrid-analysis.com/sample/053369b3b63fe08c74d0269e9c29efde3500860f0394cbf6840d57032dea5b12?environmentId=4", "iocs": "https://otx.alienvault.com/browse?q=CryptoWall+1", "snort": "" }, { "name": [ "CryptoWall 2" ], "extensions": "", "extensionPattern": "no filename change", "ransomNoteFilenames": "HELP_DECRYPT.TXT\nHELP_DECRYPT.PNG\nHELP_DECRYPT.URL\nHELP_DECRYPT.HTML\n", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "Ransom: Win32/DMALocker.A ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/DMALocker.A", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=CryptoWall+2", "snort": "" }, { "name": [ "CryptoWall 3" ], "extensions": "", "extensionPattern": "no filename change", "ransomNoteFilenames": "HELP_DECRYPT.TXT\nHELP_DECRYPT.PNG\nHELP_DECRYPT.URL\nHELP_DECRYPT.HTML\n", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://blogs.technet.microsoft.com/mmpc/2015/01/13/crowti-update-cryptowall-3-0/" ], "screenshots": "https://www.virustotal.com/en/file/45317968759d3e37282ceb75149f627d648534c5b4685f6da3966d8f6fca662d/analysis/" }, { "name": [ "CryptoWall 4" ], "extensions": "", "extensionPattern": "., e.g.,\n27p9k967z.x1nep", "ransomNoteFilenames": "HELP_YOUR_FILES.HTML\nHELP_YOUR_FILES.PNG\n", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "Ransom: MSIL/Ryzerlo ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:MSIL/Ryzerlo", "sandbox": "https://www.hybrid-analysis.com/sample/d44a5f262ccb43f72ee2afde3e3ff2a55bbb3db5837bfa8aac2e8d7195014d8b?environmentId=4", "iocs": "https://otx.alienvault.com/browse?q=CryptoWall+4", "snort": "" }, { "name": [ "CryptoWire" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/791554654664552448" ], "screenshots": "https://www.bleepingcomputer.com/news/security/-proof-of-concept-cryptowire-ransomware-spawns-lomix-and-ultralocker-families/" }, { "name": [ "CryptXXX", "CryptProjectXXX" ], "extensions": ".crypt", "extensionPattern": "", "ransomNoteFilenames": "de_crypt_readme.bmp, .txt, .html", "comment": "Comes with Bedep", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://support.kaspersky.com/viruses/disinfection/8547", "http://www.bleepingcomputer.com/virus-removal/cryptxxx-ransomware-help-information" ], "screenshots": "", "microsoftDetectionName": "Ransom: PowerShell/Polock.A ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Ransom:PowerShell/Polock.A&ThreatID=-2147272113#tab=2", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=CryptXXX", "snort": "" }, { "name": [ "CryptXXX 2.0", "CryptProjectXXX" ], "extensions": ".crypt", "extensionPattern": "", "ransomNoteFilenames": ".txt, .html, .bmp", "comment": "Locks screen. Ransom note names are an ID.\nComes with Bedep.", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://support.kaspersky.com/viruses/disinfection/8547", "https://www.proofpoint.com/us/threat-insight/post/cryptxxx2-ransomware-authors-strike-back-against-free-decryption-tool" ], "screenshots": "http://blogs.cisco.com/security/cryptxxx-technical-deep-dive", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=CryptXXX+2.0", "snort": "" }, { "name": [ "CryptXXX 3.0", "UltraDeCrypter\nUltraCrypter" ], "extensions": ".crypt\n.cryp1\n.crypz\n.cryptz\nrandom", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Comes with Bedep", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://support.kaspersky.com/viruses/disinfection/8547", "http://www.bleepingcomputer.com/news/security/cryptxxx-updated-to-version-3-0-decryptors-no-longer-work/" ], "screenshots": "http://blogs.cisco.com/security/cryptxxx-technical-deep-dive" }, { "name": [ "CryptXXX 3.1" ], "extensions": ".cryp1", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "StilerX credential stealing", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://support.kaspersky.com/viruses/disinfection/8547", "https://www.proofpoint.com/us/threat-insight/post/cryptxxx-ransomware-learns-samba-other-new-tricks-with-version3100" ], "screenshots": "" }, { "name": [ "CryPy" ], "extensions": ".cry", "extensionPattern": "", "ransomNoteFilenames": "README_FOR_DECRYPT.txt", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "Crysis" ], "extensions": ".bip", "extensionPattern": ".id-[id].[email].bip", "ransomNoteFilenames": "", "comment": "Locks screen. Ransom note ask to contact 888@cock.email. Attack timeline shows machine was compromised by RDP bruteforce first then implant the ransomware as final step", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/new-arena-crysis-ransomware-variant-released/" ], "screenshots": "https://blog.trendmicro.com/trendlabs-security-intelligence/brute-force-rdp-attacks-plant-crysis-ransomware/" }, { "name": [ "CTB-Faker" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/ctb-faker-ransomware-does-a-poor-job-imitating-ctb-locker/" ], "screenshots": "" }, { "name": [ "CTB-Locker", "Citroni" ], "extensions": ".ctbl\n", "extensionPattern": ".([a-z]{6,7})", "ransomNoteFilenames": "AllFilesAreLocked .bmp\nDecryptAllFiles .txt\n.html\n", "comment": "", "encryptionAlgorithm": "RSA(2048)", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=CTB-Locker", "snort": "" }, { "name": [ "CTB-Locker WEB" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "websites only", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://thisissecurity.net/2016/02/26/a-lockpicking-exercise/" ], "screenshots": "https://github.com/eyecatchup/Critroni-php", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=CTB-Locker+WEB", "snort": "" }, { "name": [ "CuteRansomware", "my-Little-Ransomware" ], "extensions": ".\u5df2\u52a0\u5bc6\n.encrypted", "extensionPattern": "", "ransomNoteFilenames": "\u4f60\u7684\u6a94\u6848\u88ab\u6211\u5011\u52a0\u5bc6\u5566!!!.txt\nYour files encrypted by our friends !!! txt", "comment": "Based on my-Little-Ransomware", "encryptionAlgorithm": "AES(128)", "decryptor": "", "resources": [ "https://github.com/aaaddress1/my-Little-Ransomware/tree/master/decryptoTool", "https://github.com/aaaddress1/my-Little-Ransomware" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=CuteRansomware", "snort": "" }, { "name": [ "Cyber SpLiTTer Vbs", "CyberSplitter" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on HiddenTear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/778871886616862720" ], "screenshots": "https://twitter.com/struppigel/status/806758133720698881" }, { "name": [ "Damage" ], "extensions": ".damage", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Written in Delphi", "encryptionAlgorithm": "Combination of SHA-1 and Blowfish", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/damage", "https://twitter.com/demonslay335/status/835664067843014656" ], "screenshots": "" }, { "name": [ "Dharma" ], "extensions": ".dharma\n.wallet\n.zzzzz\n.adobe", "extensionPattern": "..(dharma|wallet|zzzzz)\n.id-%ID%.[moneymaker2@india.com].wallet", "ransomNoteFilenames": "README.txt\nREADME.jpg\nInfo.hta", "comment": "CrySiS variant", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/kaspersky-releases-decryptor-for-the-dharma-ransomware/", "https://www.bleepingcomputer.com/forums/t/632389/dharma-ransomware-filenameemailwalletbipcmbarena-support-topic/" ], "screenshots": "" }, { "name": [ "Deadly for a Good Purpose" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Encrypts in 2017", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/785533373007728640" ], "screenshots": "" }, { "name": [ "Death Bitches" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "READ_IT.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JaromirHorejsi/status/815555258478981121" ], "screenshots": "" }, { "name": [ "DeCrypt Protect" ], "extensions": ".html", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.malwareremovalguides.info/decrypt-files-with-decrypt_mblblock-exe-decrypt-protect/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=DeCrypt+Protect", "snort": "" }, { "name": [ "DEDCryptor" ], "extensions": ".ded", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on EDA2", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/617395/dedcryptor-ded-help-support-topic/" ], "screenshots": "http://www.nyxbone.com/malware/DEDCryptor.html", "microsoftDetectionName": "Trojan: Win32/Harasom.A ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Trojan:Win32/Harasom.A", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=DEDCryptor", "snort": "" }, { "name": [ "Demo" ], "extensions": ".encrypted", "extensionPattern": "", "ransomNoteFilenames": "HELP_YOUR_FILES.txt", "comment": "only encrypts .jpg files", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/798573300779745281" ], "screenshots": "" }, { "name": [ "Depsex", "MafiaWare" ], "extensions": ".Locked-by-Mafia", "extensionPattern": "", "ransomNoteFilenames": "READ_ME.txt", "comment": "Based on HiddenTear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/817069320937345024" ], "screenshots": "" }, { "name": [ "DeriaLock" ], "extensions": ".deria", "extensionPattern": "", "ransomNoteFilenames": "unlock-everybody.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/new-derialock-ransomware-active-on-christmas-includes-an-unlock-all-command/", "https://www.bleepingcomputer.com/news/security/new-derialock-ransomware-active-on-christmas-includes-an-unlock-all-command/" ], "screenshots": "" }, { "name": [ "DetoxCrypto", "Based on Detox:\nCalipso\nWe are all Pokemons\nNullbyte" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/new-detoxcrypto-ransomware-pretends-to-be-pokemongo-or-uploads-a-picture-of-your-screen/" ], "screenshots": "" }, { "name": [ "Digisom" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "Digisom Readme0.txt (0 to 9)", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/PolarToffee/status/829727052316160000" ], "screenshots": "" }, { "name": [ "DirtyDecrypt" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/demonslay335/status/752586334527709184" ], "screenshots": "" }, { "name": [ "DMALocker" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "cryptinfo.txt\ndecrypting.txt\nstart.txt", "comment": "no extension change\nEncrypted files have prefix:\nVersion 1: ABCXYZ11\nVersion 2: !DMALOCK\nVersion 3: !DMALOCK3.0\nVersion 4: !DMALOCK4.0\n", "encryptionAlgorithm": "AES(256) in ECB mode, \nVersion 2-4 also RSA", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/\nhttps://github.com/hasherezade/dma_unlocker\nhttps://drive.google.com/drive/folders/0Bzb5kQFOXkiSMm94QzdyM3hCdDg", "https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-a-new-ransomware-but-no-reason-to-panic/" ], "screenshots": "" }, { "name": [ "DMALocker 3.0" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "no extension change", "encryptionAlgorithm": "AES(256)\nXPTLOCK5.0", "decryptor": "", "resources": [ "https://drive.google.com/drive/folders/0Bzb5kQFOXkiSMm94QzdyM3hCdDg", "https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-strikes-back/" ], "screenshots": "" }, { "name": [ "DNRansomware" ], "extensions": ".fucked", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Code to decrypt: 83KYG9NW-3K39V-2T3HJ-93F3Q-GT", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/822500056511213568" ], "screenshots": "" }, { "name": [ "Domino" ], "extensions": ".domino", "extensionPattern": "", "ransomNoteFilenames": "README_TO_RECURE_YOUR_FILES.txt", "comment": "Based on Hidden Tear", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/Domino.html" ], "screenshots": "http://www.bleepingcomputer.com/news/security/the-curious-case-of-the-domino-ransomware-a-windows-crack-and-a-cow/" }, { "name": [ "Donald Trump" ], "extensions": ".ENCRYPTED", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/the-donald-trump-ransomware-tries-to-build-walls-around-your-files/" ], "screenshots": "" }, { "name": [ "DoNotChange" ], "extensions": ".id-7ES642406.cry\n.Do_not_change_the_filename", "extensionPattern": "", "ransomNoteFilenames": "HOW TO DECODE FILES!!!.txt\n\u041a\u0410\u041a \u0420\u0410\u0421\u0428\u0418\u0424\u0420\u041e\u0412\u0410\u0422\u042c \u0424\u0410\u0419\u041b\u042b!!!.txt", "comment": "", "encryptionAlgorithm": "AES(128)", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/forums/t/643330/donotchange-ransomware-id-7es642406cry-do-not-change-the-file-namecryp/" ], "screenshots": "" }, { "name": [ "DummyLocker" ], "extensions": ".dCrypt", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/794108322932785158" ], "screenshots": "" }, { "name": [ "DXXD" ], "extensions": ".dxxd", "extensionPattern": "", "ransomNoteFilenames": "ReadMe.TxT", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/forums/t/627831/dxxd-ransomware-dxxd-help-support-readmetxt/", "https://www.bleepingcomputer.com/news/security/the-dxxd-ransomware-displays-legal-notice-before-users-login/" ], "screenshots": "" }, { "name": [ "DynA-Crypt" ], "extensions": ".crypt", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/dyna-crypt-not-only-encrypts-your-files-but-also-steals-your-info/" ], "screenshots": "" }, { "name": [ "EDA2 / HiddenTear", "Cryptear" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Open sourced C#", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "EdgeLocker" ], "extensions": ".edgel", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/815392891338194945" ], "screenshots": "" }, { "name": [ "EduCrypt", "EduCrypter" ], "extensions": ".isis\n.locked", "extensionPattern": "", "ransomNoteFilenames": "README.txt", "comment": "Based on Hidden Tear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.filedropper.com/decrypter_1", "https://twitter.com/JakubKroustek/status/747031171347910656" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=EduCrypt", "snort": "" }, { "name": [ "EiTest" ], "extensions": ".crypted", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BroadAnalysis/status/845688819533930497" ], "screenshots": "https://twitter.com/malwrhunterteam/status/845652520202616832" }, { "name": [ "El-Polocker", "Los Pollos Hermanos" ], "extensions": ".ha3", "extensionPattern": "", "ransomNoteFilenames": "qwer.html\nqwer2.html \nlocked.bmp\n", "comment": "Has a GUI", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "Ransom: Win32/Tobfy.X ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/Tobfy.X", "sandbox": "https://www.hybrid-analysis.com/sample/1a6bed2afff1b9880e42a29cea9b8139bcb12e34085fb008de13aa983b82a4f2?environmentId=4", "iocs": "https://otx.alienvault.com/browse?q=El-Polocker", "snort": "" }, { "name": [ "Encoder.xxxx", "Trojan.Encoder.6491" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "Instructions.html", "comment": "Coded in GO", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-14-2016-exotic-lockydump-comrade-and-more/" ], "screenshots": "http://vms.drweb.ru/virus/?_is=1&i=8747343" }, { "name": [ "encryptoJJS" ], "extensions": ".enc", "extensionPattern": "", "ransomNoteFilenames": "How to recover.enc", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "Enigma" ], "extensions": ".enigma\n.1txt", "extensionPattern": "", "ransomNoteFilenames": "enigma.hta\nenigma_encr.txt\nenigma_info.txt", "comment": "", "encryptionAlgorithm": "AES(128)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/the-enigma-ransomware-targets-russian-speaking-users/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Enigma", "snort": "" }, { "name": [ "Enjey" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on RemindMe", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/839022018230112256" ], "screenshots": "" }, { "name": [ "EnkripsiPC", "IDRANSOMv3\nManifestus" ], "extensions": ".fucked", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "The encryption password is based on the computer name", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/demonslay335/status/811343914712100872", "https://twitter.com/BleepinComputer/status/811264254481494016" ], "screenshots": "https://twitter.com/struppigel/status/811587154983981056" }, { "name": [ "Erebus" ], "extensions": "", "extensionPattern": "Encrypt the extension using ROT-23", "ransomNoteFilenames": "README.HTML", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/erebus-ransomware-utilizes-a-uac-bypass-and-request-a-90-ransom-payment/" ], "screenshots": "" }, { "name": [ "Evil" ], "extensions": ".file0locked\n.evillock", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Coded in Javascript", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/jiriatvirlab/status/818443491713884161" ], "screenshots": "https://twitter.com/PolarToffee/status/826508611878793219" }, { "name": [ "Exotic" ], "extensions": ".exotic", "extensionPattern": "random.exotic", "ransomNoteFilenames": "", "comment": "Also encrypts executables", "encryptionAlgorithm": "AES(128)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/eviltwins-exotic-ransomware-targets-executable-files/" ], "screenshots": "" }, { "name": [ "FabSysCrypto" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on HiddenTear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/837565766073475072" ], "screenshots": "" }, { "name": [ "Fadesoft" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/829768819031805953" ], "screenshots": "https://twitter.com/malwrhunterteam/status/838700700586684416" }, { "name": [ "Fairware" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Target Linux O.S.", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/new-fairware-ransomware-targeting-linux-computers/" ], "screenshots": "" }, { "name": [ "Fakben" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "READ ME FOR DECRYPT.txt", "comment": "Based on Hidden Tear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://blog.fortinet.com/post/fakben-team-ransomware-uses-open-source-hidden-tear-code" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Fakben", "snort": "" }, { "name": [ "FakeGlobe aka GlobeImposter" ], "extensions": ".crypt", "extensionPattern": "", "ransomNoteFilenames": "HOW_OPEN_FILES.hta", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/globeimposter", "https://twitter.com/malwrhunterteam/status/809795402421641216" ], "screenshots": "" }, { "name": [ "FakeCryptoLocker" ], "extensions": ".cryptolocker", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/PolarToffee/status/812312402779836416" ], "screenshots": "" }, { "name": [ "Fantom", "Variants:\nComrade Circle" ], "extensions": ".fantom\n.comrade", "extensionPattern": "", "ransomNoteFilenames": "DECRYPT_YOUR_FILES.HTML\nRESTORE-FILES![id]", "comment": "Based on EDA2", "encryptionAlgorithm": "AES(128)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/fantom-ransomware-encrypts-your-files-while-pretending-to-be-windows-update/" ], "screenshots": "" }, { "name": [ "FenixLocker" ], "extensions": ".FenixIloveyou!!", "extensionPattern": "", "ransomNoteFilenames": "Help to decrypt.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/fenixlocker", "https://twitter.com/fwosar/status/777197255057084416" ], "screenshots": "" }, { "name": [ "FILE FROZR" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "RaaS", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/rommeljoven17/status/846973265650335744" ], "screenshots": "" }, { "name": [ "FileLocker" ], "extensions": ".ENCR", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/jiriatvirlab/status/836616468775251968" ], "screenshots": "" }, { "name": [ "FireCrypt" ], "extensions": ".firecrypt", "extensionPattern": "", "ransomNoteFilenames": "[random_chars]-READ_ME.html", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/firecrypt-ransomware-comes-with-a-ddos-component/" ], "screenshots": "" }, { "name": [ "Flyper" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on EDA2 / HiddenTear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/773771485643149312" ], "screenshots": "" }, { "name": [ "Fonco" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "help-file-decrypt.enc\n/pronk.txt", "comment": "contact email safefiles32@mail.ru also as prefix in encrypted file contents", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "Ransom:MSIL/JigsawLocker.A", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/Encyclopedia/Entry.aspx?Name=Ransom:MSIL/JigsawLocker.A", "sandbox": "https://www.hybrid-analysis.com/sample/3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7?environmentId=4", "iocs": "https://otx.alienvault.com/browse?q=Fonco", "snort": "" }, { "name": [ "FortuneCookie " ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/842302481774321664" ], "screenshots": "" }, { "name": [ "Free-Freedom", "Roga" ], "extensions": ".madebyadam", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Unlock code is: adam or adamdude9", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/812135608374226944" ], "screenshots": "" }, { "name": [ "FSociety" ], "extensions": ".fs0ciety\n.dll", "extensionPattern": "", "ransomNoteFilenames": "fs0ciety.html\nDECRYPT_YOUR_FILES.HTML", "comment": "Based on EDA2\nBased on RemindMe", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/forums/t/628199/fs0ciety-locker-ransomware-help-support-fs0cietyhtml/", "http://www.bleepingcomputer.com/news/security/new-fsociety-ransomware-pays-homage-to-mr-robot/" ], "screenshots": "https://twitter.com/siri_urz/status/795969998707720193" }, { "name": [ "Fury" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://support.kaspersky.com/viruses/disinfection/8547" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Fury", "snort": "" }, { "name": [ "GhostCrypt" ], "extensions": ".Z81928819", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on Hidden Tear", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://download.bleepingcomputer.com/demonslay335/GhostCryptDecrypter.zip", "http://www.bleepingcomputer.com/forums/t/614197/ghostcrypt-z81928819-help-support-topic-read-this-filetxt/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=GhostCrypt", "snort": "" }, { "name": [ "Gingerbread" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/ni_fi_70/status/796353782699425792" ], "screenshots": "" }, { "name": [ "Globe v1", "Purge" ], "extensions": ".purge", "extensionPattern": "", "ransomNoteFilenames": "How to restore files.hta", "comment": "", "encryptionAlgorithm": "Blowfish", "decryptor": "", "resources": [ "https://success.trendmicro.com/portal_kb_articledetail?solutionid=1114221", "http://www.bleepingcomputer.com/news/security/the-globe-ransomware-wants-to-purge-your-files/" ], "screenshots": "" }, { "name": [ "Globe v2", "Purge" ], "extensions": ".lovewindows\n.openforyou@india.com", "extensionPattern": "..\ne.g.: .7076.docx.okean-1955@india.com.!dsvgdfvdDVGR3SsdvfEF75sddf#xbkNY45fg6}P{cg", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "Blowfish", "decryptor": "", "resources": [ "https://success.trendmicro.com/portal_kb_articledetail?solutionid=1114221" ], "screenshots": "" }, { "name": [ "Globe v3", "Purge" ], "extensions": ".[random].blt\n.[random].encrypted\n.[random].raid10\n.[mia.kokers@aol.com]\n.[random].globe\n.unlockvt@india.com\n.rescuers@india.com.3392cYAn548QZeUf.lock\n.locked\n.decrypt2017\n.hnumkhotep", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Extesion depends on the config file. It seems Globe is a ransomware kit.", "encryptionAlgorithm": "RC4\nAES(256)", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/globe3" ], "screenshots": "" }, { "name": [ "Variants", " from old to latest:\nZyklon Locker\nWildFire locker\nHades Locker", "GNL Locker" ], "extensions": ".locked", "extensionPattern": ".locked, e.g.,\nbill.!ID!8MMnF!ID!.locked", "ransomNoteFilenames": "UNLOCK_FILES_INSTRUCTIONS.html and .txt", "comment": "Only encrypts DE or NL country", "encryptionAlgorithm": "AES (256)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/611342/gnl-locker-support-and-help-topic-locked-and-unlock-files-instructionshtml/" ], "screenshots": "" }, { "name": [ "GOG" ], "extensions": ".L0CKED", "extensionPattern": "", "ransomNoteFilenames": "DecryptFile.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/816112218815266816" ], "screenshots": "" }, { "name": [ "Gomasom" ], "extensions": ".crypt", "extensionPattern": "!___[EMAILADDRESS]_.crypt", "ransomNoteFilenames": "", "comment": "no ransom note", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/" ], "screenshots": "" }, { "name": [ "Goopic" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "Your files have been crypted.html", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://blog.trendmicro.com/trendlabs-security-intelligence/angler-shift-ek-landscape-new-crytpo-ransomware-activity/" ], "screenshots": "", "microsoftDetectionName": "Ransom: MacOS_X/KeRanger.A ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:MacOS_X/KeRanger.A", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Goopic", "snort": "" }, { "name": [ "Gopher" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "OS X ransomware (PoC)", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "Ransom: Win32/Isda\nRansom: BAT/Xibow ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/Isda\nhttps://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:BAT/Xibow", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Gopher", "snort": "" }, { "name": [ "Gremit" ], "extensions": ".rnsmwr", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/794444032286060544" ], "screenshots": "" }, { "name": [ "Guster" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/812131324979007492" ], "screenshots": "" }, { "name": [ "Hacked" ], "extensions": ".versiegelt\n.encrypted\n.payrmts\n.locked\n.Locked", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Jigsaw Ransomware variant", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/demonslay335/status/806878803507101696" ], "screenshots": "" }, { "name": [ "HappyDayzz" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "3DES\nAES(128)\nAES(192)\nAES(256)\nDES\nRC2\nRC4", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/847114064224497666" ], "screenshots": "" }, { "name": [ "Harasom" ], "extensions": ".html", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Harasom", "snort": "" }, { "name": [ "HDDCryptor", "Mamba" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Uses https://diskcryptor.net for full disk encryption", "encryptionAlgorithm": "Custom (net shares), XTS-AES (disk)", "decryptor": "", "resources": [ "https://www.linkedin.com/pulse/mamba-new-full-disk-encryption-ransomware-family-member-marinho" ], "screenshots": "blog.trendmicro.com/trendlabs-security-intelligence/bksod-by-ransomware-hddcryptor-uses-commercial-tools-to-encrypt-network-shares-and-lock-hdds/" }, { "name": [ "Heimdall" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "File marker: \"Heimdall---\"", "encryptionAlgorithm": "AES-128-CBC", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/heimdall-open-source-php-ransomware-targets-web-servers/" ], "screenshots": "" }, { "name": [ "Help_dcfile" ], "extensions": ".XXX", "extensionPattern": "", "ransomNoteFilenames": "help_dcfile.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "Herbst" ], "extensions": ".herbst", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://blog.fortinet.com/2016/06/03/cooking-up-autumn-herbst-ransomware" ], "screenshots": "" }, { "name": [ "Hermes" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "DECRYPT_INFORMATION.html\nUNIQUE_ID_DO_NOT_REMOVE", "comment": "Filemarker: \"HERMES\"", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/forums/t/642019/hermes-ransomware-help-support-decrypt-informationhtml/", "https://www.bleepingcomputer.com/news/security/hermes-ransomware-decrypted-in-live-video-by-emsisofts-fabian-wosar/" ], "screenshots": "" }, { "name": [ "Hi Buddy!" ], "extensions": ".cry\n", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on HiddenTear", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/hibuddy.html\n" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Hi+Buddy!", "snort": "" }, { "name": [ "Hitler" ], "extensions": "", "extensionPattern": "removes extensions", "ransomNoteFilenames": "", "comment": "Deletes files", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/development-version-of-the-hitler-ransomware-discovered/" ], "screenshots": "https://twitter.com/jiriatvirlab/status/825310545800740864" }, { "name": [ "HolyCrypt" ], "extensions": "(encrypted)", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/new-python-ransomware-called-holycrypt-discovered/" ], "screenshots": "" }, { "name": [ "HTCryptor" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Includes a feature to disable the victim's windows firewall\nModified in-dev HiddenTear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/803288396814839808" ], "screenshots": "" }, { "name": [ "Hucky", "Hungarian Locky (Hucky)" ], "extensions": ".locky", "extensionPattern": "[a-zA-Z0-9+_-]{1,}.[a-z0-9]{3,4}.locky", "ransomNoteFilenames": "_Adatok_visszaallitasahoz_utasitasok.txt\n_locky_recover_instructions.txt", "comment": "Based on Locky", "encryptionAlgorithm": "AES, RSA (hardcoded)", "decryptor": "", "resources": [ "https://blog.avast.com/hucky-ransomware-a-hungarian-locky-wannabe" ], "screenshots": "" }, { "name": [ "HydraCrypt" ], "extensions": "", "extensionPattern": "hydracrypt_ID_[\\w]{8}", "ransomNoteFilenames": "README_DECRYPT_HYRDA_ID_[ID number].txt", "comment": "CrypBoss Family", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/", "http://www.malware-traffic-analysis.net/2016/02/03/index2.html" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=HydraCrypt", "snort": "" }, { "name": [ "IFN643" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/791576159960072192" ], "screenshots": "" }, { "name": [ "iLock" ], "extensions": ".crime", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/817085367144873985" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=iLock", "snort": "" }, { "name": [ "iLockLight" ], "extensions": ".crime", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "Ransom: Win32/Locky \nTrojanDownloader: JS/Locky \nTrojanDownloader: Win32/Locky ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/Locky\nhttps://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=TrojanDownloader:JS/Locky\nhttps://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=TrojanDownloader:Win32/Locky", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=iLockLight", "snort": "https://www.snort.org/rule_docs/1-37844" }, { "name": [ "International Police Association" ], "extensions": "", "extensionPattern": "<6 random characters>", "ransomNoteFilenames": "%Temp%\\.bmp", "comment": "CryptoTorLocker2015 variant", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://download.bleepingcomputer.com/Nathan/StopPirates_Decrypter.exe" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "https://www.hybrid-analysis.com/sample/b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0?environmentId=4", "iocs": "https://otx.alienvault.com/browse?q=International+Police+Association", "snort": "" }, { "name": [ "iRansom" ], "extensions": ".Locked", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/demonslay335/status/796134264744083460" ], "screenshots": "" }, { "name": [ "Jack.Pot" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/791639214152617985" ], "screenshots": "" }, { "name": [ "JagerDecryptor" ], "extensions": "!ENC", "extensionPattern": "", "ransomNoteFilenames": "Important_Read_Me.html", "comment": "Prepends filenames", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/757873976047697920" ], "screenshots": "" }, { "name": [ "JapanLocker", "shc Ransomware\nSyNcryption" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "Base64 encoding, ROT13, and top-bottom swapping", "decryptor": "", "resources": [ "https://github.com/fortiguard-lion/schRansomwareDecryptor/blob/master/schRansomwarev1_decryptor.php", "https://blog.fortinet.com/2016/10/19/japanlocker-an-excavation-to-its-indonesian-roots" ], "screenshots": "" }, { "name": [ "Encryptor RaaS", " Sarento", "Jeiphoos" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "readme_liesmich_encryptor_raas.txt", "comment": "Windows, Linux. Campaign stopped. Actor claimed he deleted the master key.", "encryptionAlgorithm": "RC6 (files), RSA 2048 (RC6 key)", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/RaaS.html" ], "screenshots": "http://blog.trendmicro.com/trendlabs-security-intelligence/the-rise-and-fall-of-encryptor-raas/", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Jeiphoos", "snort": "" }, { "name": [ "Jhon Woddy" ], "extensions": ".killedXXX", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Same codebase as DNRansomware\nLock screen password is M3VZ>5BwGGVH", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://download.bleepingcomputer.com/demonslay335/DoNotOpenDecrypter.zip", "https://twitter.com/BleepinComputer/status/822509105487245317" ], "screenshots": "" }, { "name": [ "Jigsaw", "CryptoHitMan (subvariant)" ], "extensions": ".btc\n.kkk\n.fun\n.gws\n.porno\n.payransom\n.payms\n.paymst\n.AFD\n.paybtcs\n.epic\n.xyz\n.encrypted\n.hush\n.paytounlock\n.uk-dealer@sigaint.org\n.gefickt\n.nemo-hacks.at.sigaint.org", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Has a GUI", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/jigsaw-ransomware-decrypted-will-delete-your-files-until-you-pay-the-ransom/", "https://www.helpnetsecurity.com/2016/04/20/jigsaw-crypto-ransomware/\n" ], "screenshots": "https://twitter.com/demonslay335/status/795819556166139905", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Jigsaw", "snort": "http://pastebin.com/0604rgUn\nhttp://pastebin.com/F6Pyqiqg" }, { "name": [ "Job Crypter" ], "extensions": ".locked\n.css", "extensionPattern": "", "ransomNoteFilenames": "Comment d\u00e9bloquer mes fichiers.txt\nReadme.txt", "comment": "Based on HiddenTear, but uses TripleDES, decrypter is PoC", "encryptionAlgorithm": "TripleDES", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/jobcrypter.html\nhttp://forum.malekal.com/jobcrypter-geniesanstravaille-extension-locked-crypto-ransomware-t54381.html" ], "screenshots": "https://twitter.com/malwrhunterteam/status/828914052973858816", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Job+Crypter", "snort": "" }, { "name": [ "JohnyCryptor" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "Kaandsona", "K\u00e4\u00e4nds\u00f5na\nRansomTroll" ], "extensions": ".kencf", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Crashes before it encrypts", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/819927858437099520" ], "screenshots": "" }, { "name": [ "Kangaroo" ], "extensions": ".crypted_file", "extensionPattern": "", "ransomNoteFilenames": "filename.Instructions_Data_Recovery.txt", "comment": "From the developer behind the Apocalypse Ransomware, Fabiansomware, and Esmeralda", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/the-kangaroo-ransomware-not-only-encrypts-your-data-but-tries-to-lock-you-out-of-windows/" ], "screenshots": "" }, { "name": [ "Karma" ], "extensions": ".karma", "extensionPattern": "", "ransomNoteFilenames": "# DECRYPT MY FILES #.html\n# DECRYPT MY FILES #.txt", "comment": "pretends to be a Windows optimization program called Windows-TuneUp", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/researcher-finds-the-karma-ransomware-being-distributed-via-pay-per-install-network/" ], "screenshots": "" }, { "name": [ "Karmen" ], "extensions": ".grt", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "RaaS\nBased on HiddenTear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/841747002438361089" ], "screenshots": "" }, { "name": [ "Kasiski" ], "extensions": "[KASISKI]", "extensionPattern": "", "ransomNoteFilenames": "INSTRUCCIONES.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/MarceloRivero/status/832302976744173570" ], "screenshots": "" }, { "name": [ "KawaiiLocker" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "How Decrypt Files.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://safezone.cc/resources/kawaii-decryptor.195/" ], "screenshots": "" }, { "name": [ "KeRanger" ], "extensions": ".encrypted", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "OS X Ransomware", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "http://news.drweb.com/show/?i=9877&lng=en&c=5", "http://www.welivesecurity.com/2016/03/07/new-mac-ransomware-appears-keranger-spread-via-transmission-app/" ], "screenshots": "", "microsoftDetectionName": "Win32/Takabum", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32/Takabum", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=KeRanger", "snort": "" }, { "name": [ "KeyBTC" ], "extensions": "keybtc@inbox_com\n", "extensionPattern": "", "ransomNoteFilenames": "DECRYPT_YOUR_FILES.txt\nREAD.txt\nreadme.txt\n", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=KeyBTC", "snort": "" }, { "name": [ "KEYHolder" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "how_decrypt.gif\nhow_decrypt.html\n", "comment": "via remote attacker.\ntuyuljahat@hotmail.com contact address", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/559463/keyholder-ransomware-support-and-help-topic-how-decryptgifhow-decrypthtml" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=KEYHolder", "snort": "" }, { "name": [ "KillDisk" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://cyberx-labs.com/en/blog/new-killdisk-malware-brings-ransomware-into-industrial-domain/" ], "screenshots": "http://www.welivesecurity.com/2017/01/05/killdisk-now-targeting-linux-demands-250k-ransom-cant-decrypt/" }, { "name": [ "KillerLocker" ], "extensions": ".rip", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Possibly Portuguese dev", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/782232299840634881" ], "screenshots": "" }, { "name": [ "KimcilWare" ], "extensions": ".kimcilware\n.locked", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "websites only", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "https://blog.fortinet.com/post/kimcilware-ransomware-how-to-decrypt-encrypted-files-and-who-is-behind-it", "http://www.bleepingcomputer.com/news/security/the-kimcilware-ransomware-targets-web-sites-running-the-magento-platform/" ], "screenshots": "" }, { "name": [ "Kirk" ], "extensions": ".Kirked", "extensionPattern": "", "ransomNoteFilenames": "RANSOM_NOTE.txt", "comment": "Payments in Monero", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.virustotal.com/en/file/39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc/analysis/", "https://www.bleepingcomputer.com/news/security/star-trek-themed-kirk-ransomware-brings-us-monero-and-a-spock-decryptor/" ], "screenshots": "" }, { "name": [ "Koolova" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "With Italian text that only targets the Test folder on the user's desktop", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/koolova-ransomware-decrypts-for-free-if-you-read-two-articles-about-ransomware/" ], "screenshots": "" }, { "name": [ "Korean" ], "extensions": ".\uc554\ud638\ud654\ub428", "extensionPattern": "", "ransomNoteFilenames": "ReadMe.txt", "comment": "Based on HiddenTear", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/koreanRansom.html" ], "screenshots": "" }, { "name": [ "Kostya" ], "extensions": ".kostya", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-14-2016-exotic-lockydump-comrade-and-more/" ], "screenshots": "" }, { "name": [ "Kozy.Jozy", "QC" ], "extensions": ".31392E30362E32303136_[ID-KEY]_LSBJ1", "extensionPattern": ".([0-9A-Z]{20})_([0-9]{2})_([A-Z0-9]{4,5})", "ransomNoteFilenames": "w.jpg", "comment": "Potential Kit\nselectedkozy.jozy@yahoo.com\nkozy.jozy@yahoo.com\nunlock92@india.com", "encryptionAlgorithm": "RSA(2048)", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/KozyJozy.html" ], "screenshots": "http://www.bleepingcomputer.com/forums/t/617802/kozyjozy-ransomware-help-support-wjpg-31392e30362e32303136-num-lsbj1/" }, { "name": [ "Kraken" ], "extensions": ".kraken", "extensionPattern": "[base64].kraken", "ransomNoteFilenames": "_HELP_YOUR_FILES.html", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "KratosCrypt" ], "extensions": ".kratos", "extensionPattern": "", "ransomNoteFilenames": "README_ALL.html", "comment": "kratosdimetrici@gmail.com", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/demonslay335/status/746090483722686465" ], "screenshots": "" }, { "name": [ "KRider" ], "extensions": ".kr3", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/836995570384453632" ], "screenshots": "" }, { "name": [ "KryptoLocker" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "KryptoLocker_README.txt", "comment": "Based on HiddenTear", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "JS/Nemucod ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=JS/Nemucod", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=KryptoLocker", "snort": "" }, { "name": [ "LambdaLocker" ], "extensions": ".lambda_l0cked", "extensionPattern": "", "ransomNoteFilenames": "READ_IT.hTmL", "comment": "Python Ransomware", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "LanRan" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "@__help__@", "comment": "Variant of open-source MyLittleRansomware", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/847689644854595584" ], "screenshots": "" }, { "name": [ "LeChiffre" ], "extensions": ".LeChiffre", "extensionPattern": "", "ransomNoteFilenames": "How to decrypt LeChiffre files.html", "comment": "Encrypts first 0x2000 and last 0x2000 bytes.\nVia remote attacker", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/lechiffre", "https://blog.malwarebytes.org/threat-analysis/2016/01/lechiffre-a-manually-run-ransomware/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=LeChiffre", "snort": "" }, { "name": [ "Lick" ], "extensions": ".Licked", "extensionPattern": "", "ransomNoteFilenames": "RANSOM_NOTE.txt", "comment": "Variant of Kirk", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/842404866614038529" ], "screenshots": "" }, { "name": [ "Linux.Encoder.{0", "3}", "Linux.Encoder" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Linux Ransomware", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-predictable-encryption-key/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Linux.Encoder", "snort": "" }, { "name": [ "LK Encryption" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on HiddenTear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/845183290873044994" ], "screenshots": "" }, { "name": [ "LLTP Locker" ], "extensions": ".ENCRYPTED_BY_LLTP\n.ENCRYPTED_BY_LLTPp", "extensionPattern": "", "ransomNoteFilenames": "LEAME.txt", "comment": "Targeting Spanish speaking victims", "encryptionAlgorithm": "AES-256", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/new-lltp-ransomware-appears-to-be-a-rewritten-venus-locker/" ], "screenshots": "" }, { "name": [ "LockCrypt" ], "extensions": ".lock", "extensionPattern": "", "ransomNoteFilenames": "ReadMe.TxT", "comment": "", "encryptionAlgorithm": "", "decryptor": "09/29/2017", "resources": [ "https://www.bleepingcomputer.com/forums/t/648384/lockcrypt-lock-support-topic-readmetxt/" ], "screenshots": "" }, { "name": [ "Locked-In" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "RESTORE_CORUPTED_FILES.HTML", "comment": "Based on RemindMe", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/forums/t/634754/locked-in-ransomware-help-support-restore-corupted-fileshtml/", "https://twitter.com/struppigel/status/807169774098796544" ], "screenshots": "" }, { "name": [ "Locker" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "no extension change\nhas GUI", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/577246/locker-ransomware-support-and-help-topic/page-32#entry3721545" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Locker", "snort": "" }, { "name": [ "LockLock" ], "extensions": ".locklock", "extensionPattern": "", "ransomNoteFilenames": "READ_ME.TXT", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/forums/t/626750/locklock-ransomware-locklock-help-support/" ], "screenshots": "" }, { "name": [ "Locky" ], "extensions": ".locky\n.zepto\n.odin\n.shit\n.thor\n.aesir\n.zzzzz\n.osiris\n.DIABLO6\n.lukitus", "extensionPattern": "([A-F0-9]{32}).locky\n([A-F0-9]{32}).zepto\n([A-F0-9]{32}).odin\n([A-F0-9]{32}).shit\n([A-F0-9]{32}).thor\n([A-F0-9]{32}).aesir\n([A-F0-9]{32}).zzzzz\n([A-F0-9]{32}).osiris", "ransomNoteFilenames": "_Locky_recover_instructions.txt\n_Locky_recover_instructions.bmp\n_HELP_instructions.txt\n_HELP_instructions.bmp\n_HOWDO_text.html\n_WHAT_is.html\n_INSTRUCTION.html\nDesktopOSIRIS.(bmp|htm)\nOSIRIS-[0-9]{4}.htm", "comment": "Affiliations with Dridex and Necurs botnets\nIOCs: https://ghostbin.com/paste/7jm4j", "encryptionAlgorithm": "AES(128)", "decryptor": "08/08/2017 - Diablo6 Locky variant added\n09/28/2017 - Lukitus Locky varinat added", "resources": [ "http://www.bleepingcomputer.com/news/security/new-locky-version-adds-the-zepto-extension-to-encrypted-files/" ], "screenshots": "WSF variant:\nhttp://blog.trendmicro.com/trendlabs-security-intelligence/new-locky-ransomware-spotted-in-the-brazilian-underground-market-uses-windows-script-files/\n\nOdin:\nhttps://nakedsecurity.sophos.com/2016/10/06/odin-ransomware-takes-over-from-zepto-and-locky/\n\nOSIRIS:\nhttps://www.bleepingcomputer.com/news/security/locky-ransomware-switches-to-egyptian-mythology-with-the-osiris-extension/", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Locky", "snort": "" }, { "name": [ "Lock93" ], "extensions": ".lock93", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/789882488365678592" ], "screenshots": "" }, { "name": [ "Lomix" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on the idiotic open-source ransomware called CryptoWire", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/siri_urz/status/801815087082274816" ], "screenshots": "" }, { "name": [ "Lortok" ], "extensions": ".crime", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Lortok", "snort": "" }, { "name": [ "LowLevel04" ], "extensions": "oor.", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Prepends filenames", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=LowLevel04", "snort": "" }, { "name": [ "M4N1F3STO" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Does not encrypt\nUnlock code=suckmydicknigga", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/jiriatvirlab/status/808015275367002113" ], "screenshots": "" }, { "name": [ "Mabouia" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "OS X ransomware (PoC)", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "MacAndChess" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on HiddenTear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "Magic" ], "extensions": ".magic", "extensionPattern": "", "ransomNoteFilenames": "DECRYPT_ReadMe1.TXT\nDECRYPT_ReadMe.TXT", "comment": "Based on EDA2", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "MaktubLocker" ], "extensions": "", "extensionPattern": "[a-z]{4,6}", "ransomNoteFilenames": "_DECRYPT_INFO_[extension pattern].html", "comment": "", "encryptionAlgorithm": "AES(256), RSA (2048)", "decryptor": "", "resources": [ "https://blog.malwarebytes.org/threat-analysis/2016/03/maktub-locker-beautiful-and-dangerous/" ], "screenshots": "" }, { "name": [ "Marlboro" ], "extensions": ".oops", "extensionPattern": "", "ransomNoteFilenames": "_HELP_Recover_Files_.html", "comment": "", "encryptionAlgorithm": "XOR", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/marlboro", "https://www.bleepingcomputer.com/news/security/marlboro-ransomware-defeated-in-one-day/" ], "screenshots": "" }, { "name": [ "MarsJoke" ], "extensions": ".a19\n.ap19", "extensionPattern": "", "ransomNoteFilenames": "!!! Readme For Decrypt !!!.txt\nReadMeFilesDecrypt!!!.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://securelist.ru/blog/issledovaniya/29376/polyglot-the-fake-ctb-locker/", "https://www.proofpoint.com/us/threat-insight/post/MarsJoke-Ransomware-Mimics-CTB-Locker" ], "screenshots": "" }, { "name": [ "MasterBuster" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "CreatesReadThisFileImportant.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/791943837874651136" ], "screenshots": "" }, { "name": [ "Matrix" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "[5 numbers]-MATRIX-README.RTF", "comment": "", "encryptionAlgorithm": "GnuPG", "decryptor": "", "resources": [ "https://twitter.com/rommeljoven17/status/804251901529231360" ], "screenshots": "" }, { "name": [ "Meister" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Targeting French victims", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/siri_urz/status/840913419024945152" ], "screenshots": "" }, { "name": [ "Merry X-Mas!", "MRCR" ], "extensions": ".PEGS1\n.MRCR1\n.RARE1\n.MERRY\n.RMCM1", "extensionPattern": "", "ransomNoteFilenames": "YOUR_FILES_ARE_DEAD.HTA\nMERRY_I_LOVE_YOU_BRUCE.HTA", "comment": "Written in Delphi", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/mrcr", "https://www.bleepingcomputer.com/news/security/merry-christmas-ransomware-and-its-dev-comodosecurity-not-bringing-holiday-cheer/" ], "screenshots": "https://www.bleepingcomputer.com/news/security/-merry-christmas-ransomware-now-steals-user-private-data-via-diamondfox-malware/" }, { "name": [ "Meteoritan" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "where_are_your_files.txt\nreadme_your_files_have_been_encrypted.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/844614889620561924" ], "screenshots": "" }, { "name": [ "MIRCOP", "Crypt888" ], "extensions": "Lock.", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Prepends files\nDemands 48.48 BTC", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/618457/microcop-ransomware-help-support-lock-mircop/\nhttps://www.avast.com/ransomware-decryption-tools#!", "http://blog.trendmicro.com/trendlabs-security-intelligence/instruction-less-ransomware-mircop-channels-guy-fawkes/" ], "screenshots": "http://www.nyxbone.com/malware/Mircop.html", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=MIRCOP", "snort": "https://www.snort.org/search?query=Petya&submit_search=" }, { "name": [ "MireWare" ], "extensions": ".fucked\n.fuck", "extensionPattern": "", "ransomNoteFilenames": "READ_IT.txt", "comment": "Based on HiddenTear", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "Mischa", "\"Petya's little brother\"" ], "extensions": "", "extensionPattern": ".([a-zA-Z0-9]{4})", "ransomNoteFilenames": "YOUR_FILES_ARE_ENCRYPTED.HTML\nYOUR_FILES_ARE_ENCRYPTED.TXT ", "comment": "Packaged with Petya\nPDFBewerbungsmappe.exe", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/petya-is-back-and-with-a-friend-named-mischa-ransomware/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Mischa", "snort": "" }, { "name": [ "MM Locker", "Booyah" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "READ_IT.txt", "comment": "Based on EDA2", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://www.proofpoint.com/us/threat-insight/post/ransomware-explosion-continues-cryptflle2-brlock-mm-locker-discovered" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "http://www.enigmasoftware.com/prismyourcomputerhasbeenlockedransomware-removal/", "snort": "http://seclists.org/snort/2013/q3/900" }, { "name": [ "Mobef", "Yakes\nCryptoBit" ], "extensions": ".KEYZ\n.KEYH0LES", "extensionPattern": "", "ransomNoteFilenames": "4-14-2016-INFECTION.TXT\nIMPORTANT.README", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://nyxbone.com/malware/Mobef.html" ], "screenshots": "http://researchcenter.paloaltonetworks.com/2016/07/unit42-cryptobit-another-ransomware-family-gets-an-update/", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Mobef", "snort": "" }, { "name": [ "Mole", "CryptoMix" ], "extensions": ".mole\n.mole02", "extensionPattern": "", "ransomNoteFilenames": "INSTRUCTION_FOR_HELPING_FILE_RECOVERY.TXT", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/decryptor-released-for-the-mole02-cryptomix-ransomware-variant/" ], "screenshots": "" }, { "name": [ "Monument" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Use the DarkLocker 5 porn screenlocker\nJigsaw variant", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/844826339186135040" ], "screenshots": "" }, { "name": [ "MOTD" ], "extensions": ".enc", "extensionPattern": "", "ransomNoteFilenames": "motd.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/forums/t/642409/motd-ransomware-help-support-topics-motdtxt-and-enc-extension/" ], "screenshots": "" }, { "name": [ "MSN CryptoLocker" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "RESTORE_YOUR_FILES.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/810766686005719040" ], "screenshots": "" }, { "name": [ "n1n1n1" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "decrypt explanations.html", "comment": "Filemaker: \"333333333333\"", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/demonslay335/status/790608484303712256" ], "screenshots": "https://twitter.com/demonslay335/status/831891344897482754" }, { "name": [ "N-Splitter" ], "extensions": ".\u043a\u0438\u0431\u0435\u0440 \u0440\u0430\u0437\u0432\u0435\u0442\u0432\u0438\u0442\u0435\u043b\u044c", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Russian Koolova Variant", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/815961663644008448" ], "screenshots": "https://www.youtube.com/watch?v=dAVMgX8Zti4&feature=youtu.be&list=UU_TMZYaLIgjsdJMwurHAi4Q" }, { "name": [ "Nagini" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Looks for C:\\Temp\\voldemort.horcrux", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/the-nagini-ransomware-sics-voldemort-on-your-files/" ], "screenshots": "" }, { "name": [ "NanoLocker" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "ATTENTION.RTF", "comment": "no extension change\nhas a GUI", "encryptionAlgorithm": "AES (256), RSA", "decryptor": "", "resources": [ "http://github.com/Cyberclues/nanolocker-decryptor" ], "screenshots": "" }, { "name": [ "Nemucod" ], "extensions": ".crypted", "extensionPattern": "", "ransomNoteFilenames": "Decrypted.txt", "comment": "7zip (a0.exe) variant cannot be decrypted\nEncrypts the first 2048 Bytes", "encryptionAlgorithm": "XOR(255)\n7zip", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/nemucod\nhttps://github.com/Antelox/NemucodFR\nhttp://www.bleepingcomputer.com/news/security/decryptor-released-for-the-nemucod-trojans-crypted-ransomware/", "https://blog.cisecurity.org/malware-analysis-report-nemucod-ransomware/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Nemucod", "snort": "" }, { "name": [ "Netix", "RANSOM_NETIX.A" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://blog.trendmicro.com/trendlabs-security-intelligence/netflix-scam-delivers-ransomware/" ], "screenshots": "" }, { "name": [ "Nhtnwcuf" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "!_RECOVERY_HELP_!.txt\nHELP_ME_PLEASE.txt", "comment": "Does not encrypt the files / Files are destroyed", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/demonslay335/status/839221457360195589" ], "screenshots": "" }, { "name": [ "NMoreira", "XRatTeam\nXPan\nAiraCrop" ], "extensions": ".maktub\n.__AiraCropEncrypted!\n.aac", "extensionPattern": "", "ransomNoteFilenames": "Recupere seus arquivos. Leia-me!.txt\nLearn how to recover your files.txt", "comment": ".aac is the extension used by the new version seen in July, 2017", "encryptionAlgorithm": "mix of RSA and AES-256", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/nmoreira", "https://twitter.com/fwosar/status/803682662481174528" ], "screenshots": "" }, { "name": [ "NoobCrypt" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/757267550346641408" ], "screenshots": "https://www.bleepingcomputer.com/news/security/noobcrypt-ransomware-dev-shows-noobness-by-using-same-password-for-everyone/" }, { "name": [ "Nuke" ], "extensions": ".nuclear55", "extensionPattern": "", "ransomNoteFilenames": "!!_RECOVERY_instructions_!!.html\n!!_RECOVERY_instructions_!!.txt", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "Nullbyte" ], "extensions": "_nullbyte", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://download.bleepingcomputer.com/demonslay335/NullByteDecrypter.zip", "https://www.bleepingcomputer.com/news/security/the-nullbyte-ransomware-pretends-to-be-the-necrobot-pokemon-go-application/" ], "screenshots": "" }, { "name": [ "Ocelot" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Does not encrypt anything", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/817648547231371264" ], "screenshots": "" }, { "name": [ "ODCODC" ], "extensions": ".odcodc", "extensionPattern": "C-email-abennaki@india.com-(NOMBRE_ARCHIVO.ext).odcodc", "ransomNoteFilenames": "HOW_TO_RESTORE_FILES.txt", "comment": "", "encryptionAlgorithm": "XOR", "decryptor": "", "resources": [ "http://download.bleepingcomputer.com/BloodDolly/ODCODCDecoder.zip", "http://www.nyxbone.com/malware/odcodc.html" ], "screenshots": "https://twitter.com/PolarToffee/status/813762510302183424", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=ODCODC", "snort": "" }, { "name": [ "Vipasana", " Cryakl", "Offline ransomware" ], "extensions": ".cbf", "extensionPattern": "email-[params].cbf", "ransomNoteFilenames": "desk.bmp\ndesk.jpg\n", "comment": "email addresses overlap with .777 addresses", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://support.kaspersky.com/viruses/disinfection/8547", "http://bartblaze.blogspot.com.co/2016/02/vipasana-ransomware-new-ransom-on-block.html" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Offline+ransomware", "snort": "" }, { "name": [ "OMG! Ransomware", "GPCode" ], "extensions": ".LOL!\n.OMG!", "extensionPattern": "", "ransomNoteFilenames": "how to get data.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "Onyx" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Georgian ransomware", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/791557636164558848" ], "screenshots": "" }, { "name": [ "Operation Global III" ], "extensions": ".EXE", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Is a file infector (virus)", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://news.thewindowsclub.com/operation-global-iii-ransomware-decryption-tool-released-70341/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Operation+Global+III", "snort": "" }, { "name": [ "Owl", "CryptoWire" ], "extensions": "dummy_file.encrypted", "extensionPattern": "dummy_file.encrypted.[extension]", "ransomNoteFilenames": "log.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/842342996775448576" ], "screenshots": "" }, { "name": [ "OzozaLocker" ], "extensions": ".Locked", "extensionPattern": "", "ransomNoteFilenames": "HOW TO DECRYPT YOU FILES.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/ozozalocker", "https://twitter.com/malwrhunterteam/status/801503401867673603" ], "screenshots": "" }, { "name": [ "PadCrypt" ], "extensions": ".padcrypt", "extensionPattern": "", "ransomNoteFilenames": "IMPORTANT READ ME.txt\nFile Decrypt Help.html\n", "comment": "has a live support chat", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/padcrypt-the-first-ransomware-with-live-support-chat-and-an-uninstaller/" ], "screenshots": "https://twitter.com/malwrhunterteam/status/798141978810732544", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=PadCrypt", "snort": "" }, { "name": [ "Padlock Screenlocker" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Unlock code is: ajVr/G\\RJz0R", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/811635075158839296" ], "screenshots": "" }, { "name": [ "Patcher" ], "extensions": ".crypt", "extensionPattern": "", "ransomNoteFilenames": "README!.txt", "comment": "Targeting macOS users", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://blog.malwarebytes.com/cybercrime/2017/02/decrypting-after-a-findzip-ransomware-infection/", "https://www.bleepingcomputer.com/news/security/new-macos-patcher-ransomware-locks-data-for-good-no-way-to-recover-your-files/" ], "screenshots": "" }, { "name": [ "PayDay" ], "extensions": ".sexy", "extensionPattern": "", "ransomNoteFilenames": "!!!!!ATEN\u00c7\u00c3O!!!!!.html", "comment": "Based off of Hidden-Tear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/808316635094380544" ], "screenshots": "" }, { "name": [ "PayDOS", "Serpent" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Batch file\nPasscode: AES1014DW256", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/ransomware-goes-retro-with-paydos-and-serpent-written-as-batch-files/" ], "screenshots": "" }, { "name": [ "Paysafecard Generator 2016" ], "extensions": ".cry_", "extensionPattern": "test.cry_jpg", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/796083768155078656" ], "screenshots": "" }, { "name": [ "PClock", "CryptoLocker clone\nWinPlock" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "Your files are locked !.txt\nYour files are locked !!.txt\nYour files are locked !!!.txt\nYour files are locked !!!!.txt\n%AppData%\\WinCL\\winclwp.jpg ", "comment": "CryptoLocker Copycat", "encryptionAlgorithm": "XOR", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/", "https://www.bleepingcomputer.com/news/security/old-cryptolocker-copycat-named-pclock-resurfaces-with-new-attacks/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=PClock", "snort": "" }, { "name": [ "PetrWrap" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://securelist.com/blog/research/77762/petrwrap-the-new-petya-based-ransomware-used-in-targeted-attacks/" ], "screenshots": "" }, { "name": [ "Petya", "Goldeneye" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "YOUR_FILES_ARE_ENCRYPTED.TXT", "comment": "overwrites MBR\nencrypts MFT\nPDFBewerbungsmappe.exe", "encryptionAlgorithm": "Modified Salsa20", "decryptor": "", "resources": [ "http://www.thewindowsclub.com/petya-ransomware-decrypt-tool-password-generator\nhttps://www.youtube.com/watch?v=mSqxFjZq_z4", "https://blog.malwarebytes.org/threat-analysis/2016/04/petya-ransomware/" ], "screenshots": "https://www.bleepingcomputer.com/news/security/petya-ransomware-returns-with-goldeneye-version-continuing-james-bond-theme/" }, { "name": [ "Philadelphia" ], "extensions": ".locked", "extensionPattern": ".locked", "ransomNoteFilenames": "", "comment": "Coded by \"The_Rainmaker\"", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/philadelphia", "www.bleepingcomputer.com/news/security/the-philadelphia-ransomware-offers-a-mercy-button-for-compassionate-criminals/" ], "screenshots": "" }, { "name": [ "Phobos" ], "extensions": ".phobos", "extensionPattern": "file name[ID-000QQQ.hacker@AOL.com].phobos", "ransomNoteFilenames": "", "comment": "Rebranded Dharma Ransom Note", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.coveware.com/blog/phobos-ransomware-distributed-dharma-crew" ], "screenshots": "https://www.bleepingcomputer.com/forums/t/688649/phobos-ransomware-help-topic-phobos-phoboshta/page-2" }, { "name": [ "Phoenix" ], "extensions": ".R.i.P", "extensionPattern": "", "ransomNoteFilenames": "Important!.txt", "comment": "Based on HiddenTear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/804810315456200704" ], "screenshots": "" }, { "name": [ "Pickles" ], "extensions": ".EnCrYpTeD", "extensionPattern": "%random%.EnCrYpTeD", "ransomNoteFilenames": "READ_ME_TO_DECRYPT.txt", "comment": "Python Ransomware", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/834821166116327425" ], "screenshots": "" }, { "name": [ "PizzaCrypts" ], "extensions": ".id-[victim_id]-maestro@pizzacrypts.info", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://download.bleepingcomputer.com/BloodDolly/JuicyLemonDecoder.zip" ], "screenshots": "" }, { "name": [ "PokemonGO" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on Hidden Tear", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/pokemonGO.html" ], "screenshots": "http://www.bleepingcomputer.com/news/security/pokemongo-ransomware-installs-backdoor-accounts-and-spreads-to-other-drives/" }, { "name": [ "Popcorn Time" ], "extensions": ".filock", "extensionPattern": "", "ransomNoteFilenames": "restore_your_files.html\nrestore_your_files.txt", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/new-scheme-spread-popcorn-time-ransomware-get-chance-of-free-decryption-key/" ], "screenshots": "" }, { "name": [ "Polyglot" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Immitates CTB-Locker", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://support.kaspersky.com/8547", "https://securelist.com/blog/research/76182/polyglot-the-fake-ctb-locker/" ], "screenshots": "" }, { "name": [ "Potato" ], "extensions": ".potato", "extensionPattern": "", "ransomNoteFilenames": "README.png\nREADME.html", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "PowerWare", "PoshCoder" ], "extensions": ".locky", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Open-sourced PowerShell", "encryptionAlgorithm": "AES(128)", "decryptor": "", "resources": [ "https://github.com/pan-unit42/public_tools/blob/master/powerware/powerware_decrypt.py\nhttps://download.bleepingcomputer.com/demonslay335/PowerLockyDecrypter.zip\n", "https://www.carbonblack.com/2016/03/25/threat-alert-powerware-new-ransomware-written-in-powershell-targets-organizations-via-microsoft-word/" ], "screenshots": "http://researchcenter.paloaltonetworks.com/2016/07/unit42-powerware-ransomware-spoofing-locky-malware-family/", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=PowerWare", "snort": "" }, { "name": [ "PowerWorm" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "DECRYPT_INSTRUCTION.html\nlooks like CryptoWall 3, but with additional warnings at the bottom that ransom price will go up after some time", "comment": "no decryption possible", "encryptionAlgorithm": "AES, but throws key away, destroys the files", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=PowerWorm", "snort": "" }, { "name": [ "Princess Locker" ], "extensions": "", "extensionPattern": "[a-z]{4,6},[0-9]", "ransomNoteFilenames": "!_HOW_TO_RESTORE_[extension].TXT\n!_HOW_TO_RESTORE_[extension].html\n!_HOW_TO_RESTORE_*id*.txt\n.*id*\n@_USE_TO_FIX_JJnY.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://hshrzd.wordpress.com/2016/11/17/princess-locker-decryptor/", "https://www.bleepingcomputer.com/news/security/introducing-her-royal-highness-the-princess-locker-ransomware/" ], "screenshots": "https://blog.malwarebytes.com/threat-analysis/2016/11/princess-ransomware/" }, { "name": [ "PRISM" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.enigmasoftware.com/prismyourcomputerhasbeenlockedransomware-removal/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=PRISM", "snort": "" }, { "name": [ "Project34" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "\u041f\u0410\u0420\u041e\u041b\u042c.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "ProposalCrypt" ], "extensions": ".crypted", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/demonslay335/status/812002960083394560", "https://twitter.com/malwrhunterteam/status/811613888705859586" ], "screenshots": "" }, { "name": [ "Ps2exe" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/jiriatvirlab/status/803297700175286273" ], "screenshots": "" }, { "name": [ "PyL33T" ], "extensions": ".d4nk", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Python Ransomware", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/Jan0fficial/status/834706668466405377" ], "screenshots": "" }, { "name": [ "R" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "Ransomware.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/846705481741733892" ], "screenshots": "" }, { "name": [ "R980" ], "extensions": ".crypt", "extensionPattern": "", "ransomNoteFilenames": "DECRYPTION INSTRUCTIONS.txt\nrtext.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://otx.alienvault.com/pulse/57976b52b900fe01376feb01/" ], "screenshots": "" }, { "name": [ "RAA encryptor", "RAA" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "!!!README!!![id].rtf", "comment": "Possible affiliation with Pony", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://reaqta.com/2016/06/raa-ransomware-delivering-pony/" ], "screenshots": "http://www.bleepingcomputer.com/news/security/the-new-raa-ransomware-is-created-entirely-using-javascript/" }, { "name": [ "Rabion" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "RaaS\nCopy of Ranion RaaS", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/CryptoInsane/status/846181140025282561" ], "screenshots": "" }, { "name": [ "Radamant" ], "extensions": ".RDM\n.RRK\n.RAD\n.RADAMANT", "extensionPattern": "", "ransomNoteFilenames": "YOUR_FILES.url", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://decrypter.emsisoft.com/radamant", "http://www.bleepingcomputer.com/news/security/new-radamant-ransomware-kit-adds-rdm-extension-to-encrypted-files/\n" ], "screenshots": "http://www.nyxbone.com/malware/radamant.html", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Radamant", "snort": "" }, { "name": [ "Rakhni", "Agent.iih \nAura \nAutoit \nPletor \nRotor \nLamer \nIsda\nCryptokluchen\nBandarchor" ], "extensions": ".locked\n.kraken\n.darkness\n.nochance\n.oshit\n.oplata@qq_com\n.relock@qq_com\n.crypto\n.helpdecrypt@ukr.net\n.pizda@qq_com\n.dyatel@qq_com\n_ryp\n.nalog@qq_com\n.chifrator@qq_com\n.gruzin@qq_com\n.troyancoder@qq_com\n.encrypted\n.cry\n.AES256\n.enc\n.hb15", "extensionPattern": ".coderksu@gmail_com_id[0-9]{2,3}\n.crypt@india.com.[\\w]{4,12}", "ransomNoteFilenames": "\\fud.bmp\n\\paycrypt.bmp\n\\strongcrypt.bmp\n\\maxcrypt.bmp\nor a similar named bmp in the startup folder\n%APPDATA%\\Roaming\\.bmp is set as wallpaper\n", "comment": "Files might be partially encrypted", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://support.kaspersky.com/us/viruses/disinfection/10556" ], "screenshots": "" }, { "name": [ "Ramsomeer" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on the DUMB ransomware", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "Ranion" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "RaaS service", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/ranion-ransomware-as-a-service-available-on-the-dark-web-for-educational-purposes/" ], "screenshots": "" }, { "name": [ "Rannoh" ], "extensions": "", "extensionPattern": "locked-.[a-zA-Z]{4}", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://support.kaspersky.com/viruses/disinfection/8547" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Rannoh", "snort": "https://www.snort.org/search?query=samsam&submit_search=" }, { "name": [ "RanRan" ], "extensions": ".zXz", "extensionPattern": "", "ransomNoteFilenames": "VictemKey_0_5\nVictemKey_5_30\nVictemKey_30_100\nVictemKey_100_300\nVictemKey_300_700\nVictemKey_700_2000\nVictemKey_2000_3000\nVictemKey_3000\nzXz.html", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://github.com/pan-unit42/public_tools/tree/master/ranran_decryption", "http://researchcenter.paloaltonetworks.com/2017/03/unit42-targeted-ransomware-attacks-middle-eastern-government-organizations-political-purposes/" ], "screenshots": "https://www.bleepingcomputer.com/news/security/new-ranran-ransomware-uses-encryption-tiers-political-messages/" }, { "name": [ "Ransoc" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Doesn't encrypt user files", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.proofpoint.com/us/threat-insight/post/ransoc-desktop-locking-ransomware-ransacks-local-files-social-media-profiles" ], "screenshots": "https://www.bleepingcomputer.com/news/security/ransoc-ransomware-extorts-users-who-accessed-questionable-content/" }, { "name": [ "Ransom32" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "no extension change, Javascript Ransomware", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "Win32/Tescrypt ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fTescrypt", "sandbox": "https://www.hybrid-analysis.com/sample/20f8ea706350e016a5a2e926293bbc59360608bdc9d279c4635ccddeb773d392?environmentId=4", "iocs": "https://otx.alienvault.com/browse?q=Ransom32", "snort": "" }, { "name": [ "RansomLock" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Locks the desktop", "encryptionAlgorithm": "Asymmetric 1024 ", "decryptor": "", "resources": [ "https://www.symantec.com/security_response/writeup.jsp?docid=2009-041513-1400-99&tabid=2" ], "screenshots": "", "microsoftDetectionName": "Ransom: Win32/Teerac\nWin32/Fortrypt ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom%3aWin32%2fTeerac\nhttps://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32/Fortrypt", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "RansomPlus" ], "extensions": ".encrypted", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/jiriatvirlab/status/825411602535088129" ], "screenshots": "" }, { "name": [ "RarVault" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "RarVault.htm", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "Razy" ], "extensions": ".razy\n.fear", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES(128)", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/Razy(German).html" ], "screenshots": "http://nyxbone.com/malware/Razy.html" }, { "name": [ "Rector" ], "extensions": ".vscrypt\n.infected\n.bloc\n.korrektor", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://support.kaspersky.com/viruses/disinfection/4264" ], "screenshots": "" }, { "name": [ "Red Alert" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on Hidden Tear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JaromirHorejsi/status/815557601312329728" ], "screenshots": "" }, { "name": [ "RektLocker" ], "extensions": ".rekt", "extensionPattern": "", "ransomNoteFilenames": "Readme.txt", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://support.kaspersky.com/viruses/disinfection/4264" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "RemindMe" ], "extensions": ".remind\n.crashed", "extensionPattern": "", "ransomNoteFilenames": "decypt_your_files.html ", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/RemindMe.html" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Revenge" ], "extensions": ".REVENGE", "extensionPattern": "", "ransomNoteFilenames": "# !!!HELP_FILE!!! #.txt", "comment": "CryptoMix / CryptFile2 Variant", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/revenge-ransomware-a-cryptomix-variant-being-distributed-by-rig-exploit-kit/" ], "screenshots": "" }, { "name": [ "Rokku" ], "extensions": ".rokku", "extensionPattern": "", "ransomNoteFilenames": "README_HOW_TO_UNLOCK.TXT\nREADME_HOW_TO_UNLOCK.HTML", "comment": "possibly related with Chimera", "encryptionAlgorithm": "Curve25519 + ChaCha", "decryptor": "", "resources": [ "https://blog.malwarebytes.org/threat-analysis/2016/04/rokku-ransomware/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "RoshaLock" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Stores your files in a password protected RAR file", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/siri_urz/status/842452104279134209" ], "screenshots": "" }, { "name": [ "RozaLocker" ], "extensions": ".ENC", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/jiriatvirlab/status/840863070733885440" ], "screenshots": "" }, { "name": [ "Runsomewere" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on HT/EDA2\nUtilizes the Jigsaw Ransomware background", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/801812325657440256" ], "screenshots": "" }, { "name": [ "RussianRoulette" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Variant of the Philadelphia ransomware", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/823925410392080385" ], "screenshots": "" }, { "name": [ "SADStory" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Variant of CryPy", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/845356853039190016" ], "screenshots": "" }, { "name": [ "Sage 2.0" ], "extensions": ".sage", "extensionPattern": "", "ransomNoteFilenames": "!Recovery_[3_random_chars].html", "comment": "Predecessor CryLocker", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/sage-2-0-ransomware-gearing-up-for-possible-greater-distribution/" ], "screenshots": "https://www.govcert.admin.ch/blog/27/sage-2.0-comes-with-ip-generation-algorithm-ipga" }, { "name": [ "Sage 2.2" ], "extensions": ".sage", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Sage 2.2 deletes volume snapshots through vssadmin.exe, disables startup repair, uses process wscript.exe to execute a VBScript, and coordinates the execution of scheduled tasks via schtasks.exe.", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://malwarebreakdown.com/2017/03/16/sage-2-2-ransomware-from-good-man-gate" ], "screenshots": "https://malwarebreakdown.com/2017/03/10/finding-a-good-man/ " }, { "name": [ "Samas-Samsam", "samsam.exe\nMIKOPONI.exe\nRikiRafael.exe\nshowmehowto.exe" ], "extensions": ".encryptedAES\n.encryptedRSA\n.encedRSA\n.justbtcwillhelpyou\n.btcbtcbtc\n.btc-help-you\n.only-we_can-help_you\n.iwanthelpuuu\n.notfoundrans\n.encmywork\n.VforVendetta\n.theworldisyours\n.Whereisyourfiles\n.helpmeencedfiles\n.powerfulldecrypt\n.noproblemwedecfiles\n.weareyourfriends\n.otherinformation\n.letmetrydecfiles\n.encryptedyourfiles\n.weencedufiles\n.iaufkakfhsaraf\n.cifgksaffsfyghd", "extensionPattern": "", "ransomNoteFilenames": "HELP_DECRYPT_YOUR_FILES.html\n###-READ-FOR-HELLPP.html\n000-PLEASE-READ-WE-HELP.html\nCHECK-IT-HELP-FILES.html\nWHERE-YOUR-FILES.html\nHELP-ME-ENCED-FILES.html\nWE-MUST-DEC-FILES.html\n000-No-PROBLEM-WE-DEC-FILES.html\nTRY-READ-ME-TO-DEC.html\n000-IF-YOU-WANT-DEC-FILES.html\nLET-ME-TRY-DEC-FILES.html\n001-READ-FOR-DECRYPT-FILES.html\nREAD-READ-READ.html\nIF_WANT_FILES_BACK_PLS_READ.html\nREAD_READ_DEC_FILES.html", "comment": "Targeted attacks\n-Jexboss\n-PSExec\n-Hyena", "encryptionAlgorithm": "AES(256) + RSA(2096)", "decryptor": "", "resources": [ "https://download.bleepingcomputer.com/demonslay335/SamSamStringDecrypter.zip", "http://blog.talosintel.com/2016/03/samsam-ransomware.html" ], "screenshots": "http://www.intelsecurity.com/advanced-threat-research/content/Analysis_SamSa_Ransomware.pdf", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Sanction" ], "extensions": ".sanction", "extensionPattern": "", "ransomNoteFilenames": "DECRYPT_YOUR_FILES.HTML", "comment": "Based on HiddenTear, but heavily modified keygen", "encryptionAlgorithm": "AES(256) + RSA(2096)", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "Win32/Troldesh", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/Encyclopedia/Entry.aspx?Name=Win32/Troldesh", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Rokku", "snort": "" }, { "name": [ "Sanctions" ], "extensions": ".wallet", "extensionPattern": "", "ransomNoteFilenames": "RESTORE_ALL_DATA.html", "comment": "", "encryptionAlgorithm": "AES(256) + RSA(2048)", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/sanctions-ransomware-makes-fun-of-usa-sanctions-against-russia/" ], "screenshots": "" }, { "name": [ "Sardoninir" ], "extensions": ".enc", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/835955409953357825" ], "screenshots": "" }, { "name": [ "Satan" ], "extensions": ".stn", "extensionPattern": "", "ransomNoteFilenames": "HELP_DECRYPT_FILES.html", "comment": "RaaS", "encryptionAlgorithm": "AES(256) + RSA(2096)", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/new-satan-ransomware-available-through-a-ransomware-as-a-service-/" ], "screenshots": "" }, { "name": [ "Satana" ], "extensions": "Sarah_G@ausi.com___", "extensionPattern": "", "ransomNoteFilenames": "!satana!.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://blog.malwarebytes.com/threat-analysis/2016/06/satana-ransomware/" ], "screenshots": "https://blog.kaspersky.com/satana-ransomware/12558/", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Saturn" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "#DECRYPT_MY_FILES#.txt\n#DECRYPT_MY_FILES#.vbs\n#DECRYPT_MY_FILES.BMP", "comment": "VM aware, deletes volume shadow copies, disables windows startup repair, clears windows backup catalog.", "encryptionAlgorithm": "", "decryptor": "02/19/2018", "resources": [ "" ], "screenshots": "" }, { "name": [ "Scarab" ], "extensions": ".scarab", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Post encryption, text file is dropped w/personal identifier and email to contact as well as a Bitmessage account. Email = suupport[@]protonmail[.]com and Bitmessage = BM-2cTu8prUGDS6XmXqPrZiYXXeqyFw5dXEba", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "Scraper" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "no extension change", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://securelist.com/blog/research/69481/a-flawed-ransomware-encryptor/" ], "screenshots": "" }, { "name": [ "SerbRansom" ], "extensions": ".velikasrbija", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/830116190873849856" ], "screenshots": "https://www.bleepingcomputer.com/news/security/ultranationalist-developer-behind-serbransom-ransomware/" }, { "name": [ "Serpent", "PayDOS" ], "extensions": ".serpent", "extensionPattern": "", "ransomNoteFilenames": "HOW_TO_DECRYPT_YOUR_FILES_[random_3_chars].html\nHOW_TO_DECRYPT_YOUR_FILES_[random_3_chars].txt", "comment": "Batch file\nPasscode: RSA1014DJW2048", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/ransomware-goes-retro-with-paydos-and-serpent-written-as-batch-files/" ], "screenshots": "https://www.proofpoint.com/us/threat-insight/post/new-serpent-ransomware-targets-danish-speakers" }, { "name": [ "Serpico" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "DetoxCrypto Variant", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/Serpico.html" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Sanction", "snort": "" }, { "name": [ "Shark", "Atom" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "Readme.txt", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/the-shark-ransomware-project-allows-to-create-your-own-customized-ransomware/" ], "screenshots": "http://www.bleepingcomputer.com/news/security/shark-ransomware-rebrands-as-atom-for-a-fresh-start/" }, { "name": [ "ShellLocker" ], "extensions": ".L0cked", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/799388289337671680" ], "screenshots": "" }, { "name": [ "ShinoLocker" ], "extensions": ".shino", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/760560147131408384" ], "screenshots": "http://www.bleepingcomputer.com/news/security/new-educational-shinolocker-ransomware-project-released/" }, { "name": [ "Shujin", "KinCrypt" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "\u6587\u4ef6\u89e3\u5bc6\u5e2e\u52a9.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/chineseRansom.html" ], "screenshots": "http://blog.trendmicro.com/trendlabs-security-intelligence/chinese-language-ransomware-makes-appearance/" }, { "name": [ "Simple_Encoder" ], "extensions": ".~", "extensionPattern": "", "ransomNoteFilenames": "_RECOVER_INSTRUCTIONS.ini", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/the-shark-ransomware-project-allows-to-create-your-own-customized-ransomware/" ], "screenshots": "", "microsoftDetectionName": "Ransom: BAT/Xibow ", "microsoftInfo": "https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:BAT/Xibow", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Satana", "snort": "https://www.snort.org/search?query=teslacrypt&submit_search=" }, { "name": [ "SkidLocker / Pompous" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "READ_IT.txt", "comment": "Based on EDA2", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/pompous-ransomware-dev-gets-defeated-by-backdoor/", "http://www.nyxbone.com/malware/SkidLocker.html" ], "screenshots": "" }, { "name": [ "SkyName" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on HiddenTear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/817079028725190656" ], "screenshots": "" }, { "name": [ "Smash!" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/smash-ransomware-is-cute-rather-than-dangerous/" ], "screenshots": "" }, { "name": [ "Smrss32" ], "extensions": ".encrypted", "extensionPattern": "", "ransomNoteFilenames": "_HOW_TO_Decrypt.bmp", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Serpico", "snort": "https://www.snort.org/search?query=teslacrypt&submit_search=" }, { "name": [ "SNSLocker" ], "extensions": ".RSNSlocked\n.RSplited", "extensionPattern": "", "ransomNoteFilenames": "READ_Me.txt", "comment": "Based on EDA2", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://nyxbone.com/malware/SNSLocker.html" ], "screenshots": "" }, { "name": [ "Spora" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "[Infection-ID].HTML", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://blog.gdatasoftware.com/2017/01/29442-spora-worm-and-ransomware" ], "screenshots": "http://blog.emsisoft.com/2017/01/10/from-darknet-with-love-meet-spora-ransomware/" }, { "name": [ "Sport" ], "extensions": ".sport", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Simple_Encoder", "snort": "https://www.snort.org/search?query=teslacrypt&submit_search=" }, { "name": [ "Stampado" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "Random message includes bitcoin wallet address with instructions", "comment": "Coded by \"The_Rainmaker\"\nRandomly deletes a file every 6hrs up to 96hrs then deletes decryption key", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://success.trendmicro.com/portal_kb_articledetail?solutionid=1114221\nhttp://www.bleepingcomputer.com/news/security/stampado-ransomware-campaign-decrypted-before-it-started/\nhttps://decrypter.emsisoft.com/stampado", "https://cdn.streamable.com/video/mp4/kfh3.mp4" ], "screenshots": "http://blog.trendmicro.com/trendlabs-security-intelligence/the-economics-behind-ransomware-prices/", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Smrss32", "snort": "https://www.snort.org/search?query=teslacrypt&submit_search=" }, { "name": [ "Strictor" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on EDA2, shows Guy Fawkes mask", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/Strictor.html" ], "screenshots": "" }, { "name": [ "Surprise" ], "extensions": ".surprise\n.tzu", "extensionPattern": "", "ransomNoteFilenames": "DECRYPTION_HOWTO.Notepad", "comment": "Based on EDA2", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "https://otx.alienvault.com/browse?q=Sport", "snort": "https://www.snort.org/search?query=torrentlocker&submit_search=" }, { "name": [ "Survey" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "ThxForYurTyme.txt", "comment": "Still in development, shows FileIce survey", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/" ], "screenshots": "" }, { "name": [ "SynoLocker" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Exploited Synology NAS firmware directly over WAN", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "SZFLocker" ], "extensions": ".szf", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://now.avg.com/dont-pay-the-ransom-avg-releases-six-free-decryption-tools-to-retrieve-your-files/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "TeamXrat" ], "extensions": ".___xratteamLucked", "extensionPattern": "", "ransomNoteFilenames": "Como descriptografar os seus arquivos.txt", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://securelist.com/blog/research/76153/teamxrat-brazilian-cybercrime-meets-ransomware/" ], "screenshots": "" }, { "name": [ "TeleCrypt", "Trojan-Ransom.Win32.Telecrypt\nPDM:Trojan.Win32.Generic" ], "extensions": ".xcri", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Telecrypt will generate a random string to encrypt with that is between 10-20 length and only contain the letters vo,pr,bm,xu,zt,dq.", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://malwarebytes.app.box.com/s/kkxwgzbpwe7oh59xqfwcz97uk0q05kp3\nhttps://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/", "https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/" ], "screenshots": "https://securelist.com/blog/research/76558/the-first-cryptor-to-exploit-telegram/" }, { "name": [ "TeslaCrypt 0.x - 2.2.0", "AlphaCrypt" ], "extensions": ".vvv\n.ecc\n.exx\n.ezz\n.abc\n.aaa\n.zzz\n.xyz", "extensionPattern": "", "ransomNoteFilenames": "HELP_TO_SAVE_FILES.txt\nHowto_RESTORE_FILES.html", "comment": "Factorization", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/576600/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt/\nhttp://www.talosintel.com/teslacrypt_tool/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "TeslaCrypt 3.0+" ], "extensions": ".micro\n.xxx\n.ttt\n.mp3", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "4.0+ has no extension", "encryptionAlgorithm": "AES(256) + ECHD + SHA1", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/576600/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt/\nhttp://www.welivesecurity.com/2016/05/18/eset-releases-decryptor-recent-variants-teslacrypt-ransomware/\nhttps://blog.kaspersky.com/raknidecryptor-vs-teslacrypt/12169/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "TeslaCrypt 4.1A" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "RECOVER<5_chars>.html\nRECOVER<5_chars>.png\nRECOVER<5_chars>.txt\n_how_recover+.txt or .html\nhelp_recover_instructions+.BMP or .html or .txt\n_H_e_l_p_RECOVER_INSTRUCTIONS+.txt, .html or .png\nRecovery+<5 random chars>.txt, .html, e.g., Recovery+gwote.txt\nRESTORE_FILES_.TXT , e.g. restore_files_kksli.bmp\nHELP_RESTORE_FILES_.TXT , e.g. help_restore_files_kksli.bmp\nHOWTO_RECOVER_FILES_.TXT. e.g. howto_recover_files_xeyye.txt\nHELP_TO_SAVE_FILES.txt or .bmp", "comment": "no special extension", "encryptionAlgorithm": "AES(256) + ECHD + SHA1", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/576600/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt/\nhttp://www.welivesecurity.com/2016/05/18/eset-releases-decryptor-recent-variants-teslacrypt-ransomware/\nhttps://blog.kaspersky.com/raknidecryptor-vs-teslacrypt/12169/", "https://www.endgame.com/blog/your-package-has-been-successfully-encrypted-teslacrypt-41a-and-malware-attack-chain" ], "screenshots": "https://blog.kaspersky.com/raknidecryptor-vs-teslacrypt/12169/", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "TeslaCrypt 4.2" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "RECOVER<5_chars>.html\nRECOVER<5_chars>.png\nRECOVER<5_chars>.txt\n_how_recover+.txt or .html\nhelp_recover_instructions+.BMP or .html or .txt\n_H_e_l_p_RECOVER_INSTRUCTIONS+.txt, .html or .png\nRecovery+<5 random chars>.txt, .html, e.g., Recovery+gwote.txt\nRESTORE_FILES_.TXT , e.g. restore_files_kksli.bmp\nHELP_RESTORE_FILES_.TXT , e.g. help_restore_files_kksli.bmp\nHOWTO_RECOVER_FILES_.TXT. e.g. howto_recover_files_xeyye.txt\nHELP_TO_SAVE_FILES.txt or .bmp", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/576600/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt/\nhttp://www.welivesecurity.com/2016/05/18/eset-releases-decryptor-recent-variants-teslacrypt-ransomware/\nhttps://blog.kaspersky.com/raknidecryptor-vs-teslacrypt/12169/", "http://www.bleepingcomputer.com/news/security/teslacrypt-4-2-released-with-quite-a-few-modifications/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Thanksgiving" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/801486420368093184" ], "screenshots": "" }, { "name": [ "Threat Finder" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "HELP_DECRYPT.HTML", "comment": "Files cannot be decrypted\nHas a GUI", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "TorrentLocker", "Crypt0L0cker\nCryptoFortress \nTeerac" ], "extensions": ".Encrypted\n.enc", "extensionPattern": "", "ransomNoteFilenames": "HOW_TO_RESTORE_FILES.html\nDECRYPT_INSTRUCTIONS.html\nDESIFROVANI_POKYNY.html\nINSTRUCCIONES_DESCIFRADO.html\nISTRUZIONI_DECRITTAZIONE.html\nENTSCHLUSSELN_HINWEISE.html\nONTSLEUTELINGS_INSTRUCTIES.html\nINSTRUCTIONS_DE_DECRYPTAGE.html\nSIFRE_COZME_TALIMATI.html\nwie_zum_Wiederherstellen_von_Dateien.txt\n", "comment": "Newer variants not decryptable.\nOnly first 2 MB are encrypted\n", "encryptionAlgorithm": "AES(256) CBC for files\nRSA(1024) for AES key\nuses LibTomCrypt", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/547708/torrentlocker-ransomware-cracked-and-decrypter-has-been-made/", "https://twitter.com/PolarToffee/status/804008236600934403" ], "screenshots": "http://blog.talosintelligence.com/2017/03/crypt0l0cker-torrentlocker-old-dog-new.html", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "TowerWeb" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "Payment_Instructions.jpg", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/618055/towerweb-ransomware-help-support-topic-payment-instructionsjpg/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Toxcrypt" ], "extensions": ".toxcrypt", "extensionPattern": "", "ransomNoteFilenames": "tox.html", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Trojan", "BrainCrypt" ], "extensions": ".braincrypt", "extensionPattern": "", "ransomNoteFilenames": "!!! HOW TO DECRYPT FILES !!!.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://download.bleepingcomputer.com/demonslay335/BrainCryptDecrypter.zip", "https://twitter.com/PolarToffee/status/811249250285842432" ], "screenshots": "" }, { "name": [ "Troldesh", "Shade\nXTBL" ], "extensions": ".breaking_bad\n.better_call_saul\n.xtbl\n.da_vinci_code\n.windows10\n.no_more_ransom", "extensionPattern": "", "ransomNoteFilenames": "README.txt \nnomoreransom_note_original.txt", "comment": "May download additional malware after encryption", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://www.nomoreransom.org/uploads/ShadeDecryptor_how-to_guide.pdf", "http://www.nyxbone.com/malware/Troldesh.html" ], "screenshots": "https://www.bleepingcomputer.com/news/security/kelihos-botnet-delivering-shade-troldesh-ransomware-with-no-more-ransom-extension/", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "TrueCrypter" ], "extensions": ".enc", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/news/security/truecrypter-ransomware-accepts-payment-in-bitcoins-or-amazon-gift-card/" ], "screenshots": "", "microsoftDetectionName": "Win32/ZCryptor.A", "microsoftInfo": "https://blogs.technet.microsoft.com/mmpc/2016/05/26/link-lnk-to-ransom/", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Trump Locker" ], "extensions": ".TheTrumpLockerf\n.TheTrumpLockerfp", "extensionPattern": "", "ransomNoteFilenames": "What happen to my files.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/new-trump-locker-ransomware-is-a-fraud-just-venuslocker-in-disguise/" ], "screenshots": "" }, { "name": [ "Turkish" ], "extensions": ".sifreli", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/821991600637313024" ], "screenshots": "" }, { "name": [ "Turkish (Fake CTB-Locker)" ], "extensions": ".encrypted", "extensionPattern": "", "ransomNoteFilenames": "Beni Oku.txt", "comment": "keys in '%name%.manifest.xml", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/842034887397908480" ], "screenshots": "" }, { "name": [ "Turkish Ransom" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "DOSYALARINIZA ULA\u015eMAK \u0130\u00c7\u0130N A\u00c7INIZ.html", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/turkishRansom.html" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "UltraLocker" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on the idiotic open-source ransomware called CryptoWire", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/807161652663742465" ], "screenshots": "https://www.bleepingcomputer.com/news/security/-proof-of-concept-cryptowire-ransomware-spawns-lomix-and-ultralocker-families/" }, { "name": [ "UmbreCrypt" ], "extensions": "", "extensionPattern": "umbrecrypt_ID_[VICTIMID]", "ransomNoteFilenames": "README_DECRYPT_UMBRE_ID_[victim_id].jpg\nREADME_DECRYPT_UMBRE_ID_[victim_id].txt\ndefault32643264.bmp\ndefault432643264.jpg\n", "comment": "CrypBoss Family", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "http://www.thewindowsclub.com/emsisoft-decrypter-hydracrypt-umbrecrypt-ransomware" ], "screenshots": "" }, { "name": [ "UnblockUPC" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "Files encrypted.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/forums/t/627582/unblockupc-ransomware-help-support-topic-files-encryptedtxt/" ], "screenshots": "" }, { "name": [ "Ungluk" ], "extensions": ".H3LL\n.0x0\n.1999", "extensionPattern": "", "ransomNoteFilenames": "READTHISNOW!!!.txt\nHellothere.txt\nYOUGOTHACKED.TXT", "comment": "Ransom note instructs to use Bitmessage to get in contact with attacker\nSecretishere.key\nSECRETISHIDINGHEREINSIDE.KEY\nsecret.key", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Unlock26" ], "extensions": ".locked-[XXX]", "extensionPattern": "", "ransomNoteFilenames": "ReadMe-XXX.html", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/new-raas-portal-preparing-to-spread-unlock26-ransomware/" ], "screenshots": "" }, { "name": [ "Unlock92" ], "extensions": ".CRRRT\n.CCCRRRPPP", "extensionPattern": "", "ransomNoteFilenames": "READ_ME_!.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/839038399944224768" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Vanguard" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "GO Ransomware", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JAMESWT_MHT/status/834783231476166657" ], "screenshots": "" }, { "name": [ "VapeLauncher" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "CryptoWire variant", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/839771195830648833" ], "screenshots": "" }, { "name": [ "VaultCrypt", "CrypVault\nZlader" ], "extensions": ".vault\n.xort\n.trun", "extensionPattern": "", "ransomNoteFilenames": "VAULT.txt\nxort.txt\ntrun.txt\n.hta | VAULT.hta", "comment": "", "encryptionAlgorithm": "uses gpg.exe", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/russianRansom.html" ], "screenshots": "" }, { "name": [ "VBRANSOM 7" ], "extensions": ".VBRANSOM", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Does not actually encrypt", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/817851339078336513" ], "screenshots": "" }, { "name": [ "VenisRansomware" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "In dev\nVenisRansom@protonmail.com", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/Antelox/status/785849412635521024" ], "screenshots": "http://pastebin.com/HuK99Xmj" }, { "name": [ "VenusLocker" ], "extensions": ".Venusf\n.Venusp", "extensionPattern": "", "ransomNoteFilenames": "ReadMe.txt", "comment": "Based on EDA2", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "https://blog.malwarebytes.com/threat-analysis/2016/08/venus-locker-another-net-ransomware/?utm_source=twitter&utm_medium=social" ], "screenshots": "http://www.nyxbone.com/malware/venusLocker.html" }, { "name": [ "Vindows Locker" ], "extensions": ".vindows", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "AES", "decryptor": "", "resources": [ "https://malwarebytes.app.box.com/s/gdu18hr17mwqszj3hjw5m3sw84k8hlph\nhttps://rol.im/VindowsUnlocker.zip", "https://twitter.com/JakubKroustek/status/800729944112427008" ], "screenshots": "https://www.bleepingcomputer.com/news/security/vindowslocker-ransomware-mimics-tech-support-scam-not-the-other-way-around/" }, { "name": [ "Virlock" ], "extensions": ".exe", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Polymorphism / Self-replication", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/Virlock.html" ], "screenshots": "http://www.welivesecurity.com/2014/12/22/win32virlock-first-self-reproducing-ransomware-also-shape-shifter/" }, { "name": [ "Virus-Encoder", "CrySiS" ], "extensions": ".CrySiS\n.xtbl\n.crypt\n.DHARMA", "extensionPattern": ".id-########.decryptformoney@india.com.xtbl\n.[email_address].DHARMA", "ransomNoteFilenames": "How to decrypt your data.txt", "comment": "", "encryptionAlgorithm": "AES(256)", "decryptor": "", "resources": [ "http://www.welivesecurity.com/2016/11/24/new-decryption-tool-crysis-ransomware/\nhttp://media.kaspersky.com/utilities/VirusUtilities/EN/rakhnidecryptor.zip", "http://www.nyxbone.com/malware/virus-encoder.html" ], "screenshots": "http://blog.trendmicro.com/trendlabs-security-intelligence/crysis-targeting-businesses-in-australia-new-zealand-via-brute-forced-rdps/" }, { "name": [ "Vortex", "\u0166l\u0e4ft\u0454\u0433\u0e04 \u0433\u0e04\u0e20\u0e23\u0e4f\u0e53\u0e2c\u0e04\u0433\u0454" ], "extensions": ".aes", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/839778905091424260" ], "screenshots": "" }, { "name": [ "vxLock" ], "extensions": ".vxLock", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "WannaCry", "WannaCrypt\nWCry" ], "extensions": ".wcry\n.wncry\n.WNCRY\n.WCRY", "extensionPattern": "", "ransomNoteFilenames": "@Please_Read_Me@.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/846241982347427840" ], "screenshots": "https://docs.google.com/spreadsheets/d/1XNCCiiwpIfW8y0mzTUdLLVzoW6x64hkHJ29hcQW5deQ/pubhtml#" }, { "name": [ "WildFire Locker", "Hades Locker" ], "extensions": ".wflx", "extensionPattern": "", "ransomNoteFilenames": "HOW_TO_UNLOCK_FILES_README_().txt", "comment": "Zyklon variant", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://labs.opendns.com/2016/07/13/wildfire-ransomware-gaining-momentum/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Winnix Cryptor" ], "extensions": ".wnx", "extensionPattern": "", "ransomNoteFilenames": "YOUR FILES ARE ENCRYPTED!.txt", "comment": "", "encryptionAlgorithm": "GPG", "decryptor": "", "resources": [ "https://twitter.com/PolarToffee/status/811940037638111232" ], "screenshots": "" }, { "name": [ "XCrypt" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "Xhelp.jpg", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/825790584971472902" ], "screenshots": "" }, { "name": [ "XData" ], "extensions": ".~xdata~", "extensionPattern": "", "ransomNoteFilenames": "HOW_CAN_I_DECRYPT_MY_FILES.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://www.bleepingcomputer.com/news/security/xdata-ransomware-on-a-rampage-in-ukraine/#.WR-iz69z-MA.twitter" ], "screenshots": "" }, { "name": [ "Xorist" ], "extensions": ".EnCiPhErEd\n.73i87A\n.p5tkjw\n.PoAr2w\n.fileiscryptedhard\n.encoderpass\n.zc3791\n.antihacker2017", "extensionPattern": "", "ransomNoteFilenames": "HOW TO DECRYPT FILES.TXT", "comment": "encrypted files will still have the original non-encrypted header of 0x33 bytes length", "encryptionAlgorithm": "XOR or TEA", "decryptor": "", "resources": [ "https://support.kaspersky.com/viruses/disinfection/2911\nhttps://decrypter.emsisoft.com/xorist" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "XRTN " ], "extensions": ".xrtn", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "VaultCrypt family", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "" }, { "name": [ "XYZWare" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Based on HiddenTear", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/833636006721122304" ], "screenshots": "" }, { "name": [ "You Have Been Hacked!!!" ], "extensions": ".Locked", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Attempt to steal passwords", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/808280549802418181" ], "screenshots": "" }, { "name": [ "YourRansom" ], "extensions": ".yourransom", "extensionPattern": "", "ransomNoteFilenames": "README.txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/_ddoxer/status/827555507741274113" ], "screenshots": "https://www.bleepingcomputer.com/news/security/yourransom-is-the-latest-in-a-long-line-of-prank-and-educational-ransomware/" }, { "name": [ "Zcrypt", "Zcryptor" ], "extensions": ".zcrypt", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://blogs.technet.microsoft.com/mmpc/2016/05/26/link-lnk-to-ransom/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Zeta", "CryptoMix" ], "extensions": ".code\n.scl\n.rmd", "extensionPattern": "", "ransomNoteFilenames": "# HELP_DECRYPT_YOUR_FILES #.TXT", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/JakubKroustek/status/804009831518572544" ], "screenshots": "" }, { "name": [ "Zimbra" ], "extensions": ".crypto", "extensionPattern": "", "ransomNoteFilenames": "how.txt", "comment": "mpritsken@priest.com", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "http://www.bleepingcomputer.com/forums/t/617874/zimbra-ransomware-written-in-python-help-and-support-topic-crypto-howtotxt/" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "ZinoCrypt" ], "extensions": ".ZINO", "extensionPattern": "", "ransomNoteFilenames": "ZINO_NOTE.TXT", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/malwrhunterteam/status/842781575410597894" ], "screenshots": "" }, { "name": [ "Zlader / Russian", "VaultCrypt\nCrypVault" ], "extensions": ".vault", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "VaultCrypt family", "encryptionAlgorithm": "RSA", "decryptor": "", "resources": [ "http://www.nyxbone.com/malware/russianRansom.html" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" }, { "name": [ "Zorro" ], "extensions": ".zorro", "extensionPattern": "", "ransomNoteFilenames": "Take_Seriously (Your saving grace).txt", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/BleepinComputer/status/844538370323812353" ], "screenshots": "" }, { "name": [ "zScreenLocker" ], "extensions": "", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://twitter.com/struppigel/status/794077145349967872" ], "screenshots": "" }, { "name": [ "Zyka" ], "extensions": ".locked", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "https://download.bleepingcomputer.com/demonslay335/StupidDecrypter.zip", "https://twitter.com/GrujaRS/status/826153382557712385" ], "screenshots": "" }, { "name": [ "Zyklon", "GNL Locker" ], "extensions": ".zyklon", "extensionPattern": "", "ransomNoteFilenames": "", "comment": "Hidden Tear family, GNL Locker variant", "encryptionAlgorithm": "", "decryptor": "", "resources": [ "" ], "screenshots": "", "microsoftDetectionName": "", "microsoftInfo": "", "sandbox": "", "iocs": "", "snort": "" } ]