From fdf1a6c1123b71a2e76fd4069028dd625309f702 Mon Sep 17 00:00:00 2001 From: Delta-Sierra Date: Mon, 19 Apr 2021 13:24:25 +0200 Subject: [PATCH 1/3] Adding ransomware names [WIP 2] --- clusters/ransomware.json | 2738 +++++++++++++++++++++++++++++++++++++- 1 file changed, 2727 insertions(+), 11 deletions(-) diff --git a/clusters/ransomware.json b/clusters/ransomware.json index 8cab3f0..63be497 100644 --- a/clusters/ransomware.json +++ b/clusters/ransomware.json @@ -2,7 +2,8 @@ "authors": [ "https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml", "http://pastebin.com/raw/GHgpWjar", - "MISP Project" + "MISP Project", + "https://id-ransomware.blogspot.com/2016/07/ransomware-list.html" ], "category": "tool", "description": "Ransomware galaxy based on https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml and http://pastebin.com/raw/GHgpWjar", @@ -165,6 +166,9 @@ "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/rozalocker-ransomware.html", "https://twitter.com/jiriatvirlab/status/840863070733885440" + ], + "synonyms": [ + "Roza" ] }, "uuid": "f158ea74-c8ba-4e5a-b07f-52bd8fe30888", @@ -353,6 +357,9 @@ "http://www.securityweek.com/star-trek-themed-kirk-ransomware-emerges", "https://www.grahamcluley.com/kirk-ransomware-sports-star-trek-themed-decryptor-little-known-crypto-currency/", "https://www.virustotal.com/en/file/39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc/analysis/" + ], + "synonyms": [ + "Kirk & Spock Decryptor" ] }, "uuid": "6e442a2e-97db-4a7b-b4a1-9abb4a7472d8", @@ -619,6 +626,9 @@ "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/pickles-ransomware.html", "https://twitter.com/JakubKroustek/status/834821166116327425" + ], + "synonyms": [ + "Pickles" ] }, "uuid": "87171865-9fc9-42a9-9bd4-a453f556f20c", @@ -744,6 +754,9 @@ ], "refs": [ "https://www.enigmasoftware.com/youarefuckedransomware-removal/" + ], + "synonyms": [ + "FortuneCrypt" ] }, "uuid": "912af0ef-2d78-4a90-a884-41f3c37c723b", @@ -861,6 +874,9 @@ ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/suchsecurity-ransomware.html" + ], + "synonyms": [ + "Such Security" ] }, "uuid": "22481dfd-8284-4071-a76f-c9a4a5f43f00", @@ -1010,6 +1026,10 @@ ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/lovelock-ransomware.html" + ], + "synonyms": [ + "LoveLock", + "Love2Lock" ] }, "uuid": "0785bdda-7cd8-4529-b28e-787367c50298", @@ -3211,6 +3231,15 @@ "https://id-ransomware.blogspot.co.il/2016/12/goldeneye-ransomware.html", "https://www.bleepingcomputer.com/news/security/petya-ransomware-returns-with-goldeneye-version-continuing-james-bond-theme/", "https://www.bleepingcomputer.com/forums/t/634778/golden-eye-virus/" + ], + "related": [ + { + "dest-uuid": "7c5a1e93-7ab2-4b08-ada9-e82c4feaed0a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } ] }, "uuid": "ac7affb8-971d-4c05-84f0-172b61d007d7", @@ -3362,6 +3391,10 @@ "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/rip-ransomware.html", "https://twitter.com/BleepinComputer/status/804810315456200704" + ], + "synonyms": [ + "RIP", + "Phoenix" ] }, "uuid": "5705df4a-42b0-4579-ad9f-8bfa42bae471", @@ -3386,6 +3419,10 @@ "https://id-ransomware.blogspot.co.il/2016/11/novalid-ransomware.html", "https://www.bleepingcomputer.com/forums/t/634754/locked-in-ransomware-help-support-restore-corupted-fileshtml/", "https://twitter.com/struppigel/status/807169774098796544" + ], + "synonyms": [ + "Locked-In Ransomware", + "NoValid Ransomware" ] }, "uuid": "777f0b78-e778-435f-b4d5-e40f0b7f54c3", @@ -3950,7 +3987,9 @@ "https://twitter.com/JakubKroustek/status/796083768155078656" ], "synonyms": [ - "Paysafecard Generator 2016" + "Paysafecard Generator 2016", + "PaySafeCard", + "PaySafeGen" ] }, "uuid": "379d5258-6f11-4c41-a685-c2ff555c0cb9", @@ -5818,6 +5857,10 @@ "refs": [ "http://www.bleepingcomputer.com/news/security/chimera-ransomware-decryption-keys-released-by-petya-devs/", "https://blog.malwarebytes.org/threat-analysis/2015/12/inside-chimera-ransomware-the-first-doxingware-in-wild/" + ], + "synonyms": [ + "Quimera Crypter", + "Pashka" ] }, "uuid": "27b036f0-afa3-4984-95b3-47fa344b1aa7", @@ -7302,6 +7345,9 @@ "refs": [ "https://twitter.com/rommeljoven17/status/846973265650335744", "https://id-ransomware.blogspot.com/2017/03/filefrozr-ransomware.html" + ], + "synonyms": [ + "FileFrozr" ] }, "uuid": "2a50f476-7355-4d58-b0ce-4235b2546c90", @@ -7573,6 +7619,9 @@ }, { "description": "Ransomware OS X ransomware (PoC)", + "meta": { + "date": "mars 2021" + }, "uuid": "ec461b8a-5390-4304-9d2a-a20c7ed6a9db", "value": "Gopher" }, @@ -7948,7 +7997,8 @@ "https://id-ransomware.blogspot.com/2016/04/jigsaw-ransomware.html" ], "synonyms": [ - "CryptoHitMan" + "CryptoHitMan", + "Jigsaw Original" ] }, "related": [ @@ -8303,6 +8353,9 @@ "refs": [ "http://www.bleepingcomputer.com/forums/t/577246/locker-ransomware-support-and-help-topic/page-32#entry3721545", "https://id-ransomware.blogspot.com/2016/04/locker-ransomware-2015.html" + ], + "synonyms": [ + "LockeR" ] }, "uuid": "abc7883c-244a-44ac-9c86-559dafa4eb63", @@ -8373,6 +8426,12 @@ "https://nakedsecurity.sophos.com/2016/10/06/odin-ransomware-takes-over-from-zepto-and-locky/", "https://www.bleepingcomputer.com/news/security/locky-ransomware-switches-to-egyptian-mythology-with-the-osiris-extension/", "https://id-ransomware.blogspot.com/2016/02/locky.html" + ], + "synonyms": [ + "Locky-Odin", + "Locky-Osiris", + "Locky-Osiris 2016", + "Locky-Osiris 2017" ] }, "related": [ @@ -8560,7 +8619,8 @@ "https://id-ransomware.blogspot.com/2016/06/mircop-ransomware-4848.html" ], "synonyms": [ - "Crypt888" + "Crypt888", + "MicroCop" ] }, "uuid": "7dd326a5-1168-4309-98b1-f2146d9cf8c7", @@ -8604,7 +8664,10 @@ "https://id-ransomware.blogspot.com/2016/05/petya-mischa-ransomware.html" ], "synonyms": [ - "\"Petya's little brother\"" + "\"Petya's little brother\"", + "Misha", + "Petya+Mischa", + "Petya-2" ] }, "uuid": "a029df89-2bb1-409d-878b-a67572217a65", @@ -8720,6 +8783,9 @@ "https://twitter.com/demonslay335/status/790608484303712256", "https://twitter.com/demonslay335/status/831891344897482754", "http://id-ransomware.blogspot.com/2016/09/n1n1n1-ransomware.html" + ], + "synonyms": [ + "N1N1N1" ] }, "uuid": "a439b37b-e123-4b1d-9400-94aca70b223a", @@ -8769,6 +8835,10 @@ "http://www.bleepingcomputer.com/news/security/decryptor-released-for-the-nemucod-trojans-crypted-ransomware/", "https://blog.cisecurity.org/malware-analysis-report-nemucod-ransomware/", "http://id-ransomware.blogspot.com/2016/04/nemucod-ransomware.html" + ], + "synonyms": [ + "Nemucod-7z", + "Nemucod-AES" ] }, "uuid": "f1ee9ae8-b798-4e6f-8f98-874395d0fa18", @@ -9130,6 +9200,13 @@ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" + }, + { + "dest-uuid": "ac7affb8-971d-4c05-84f0-172b61d007d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" } ], "uuid": "7c5a1e93-7ab2-4b08-ada9-e82c4feaed0a", @@ -9313,6 +9390,9 @@ "refs": [ "https://twitter.com/malwrhunterteam/status/846705481741733892", "http://id-ransomware.blogspot.com/2017/03/r-ransomware.html" + ], + "synonyms": [ + "NM3" ] }, "uuid": "f7cd8956-2825-4104-94b1-e9589ab1089a", @@ -9355,7 +9435,8 @@ "https://id-ransomware.blogspot.com/2016/06/raa-ransomware-aes-256-039-250.html" ], "synonyms": [ - "RAA" + "RAA", + "RAA SEP" ] }, "uuid": "b6d4faa1-6d76-42ff-8a18-238eb70cff06", @@ -9520,6 +9601,9 @@ "https://github.com/pan-unit42/public_tools/tree/master/ranran_decryption", "http://researchcenter.paloaltonetworks.com/2017/03/unit42-targeted-ransomware-attacks-middle-eastern-government-organizations-political-purposes/", "https://www.bleepingcomputer.com/news/security/new-ranran-ransomware-uses-encryption-tiers-political-messages/" + ], + "synonyms": [ + "ZXZ" ] }, "uuid": "e01a0cfa-2c8c-4e08-963a-4fa1e8cc6a34", @@ -9831,7 +9915,8 @@ "showmehowto.exe", "SamSam Ransomware", "SamSam", - "Samsam" + "Samsam", + "Samas" ] }, "related": [ @@ -9880,6 +9965,9 @@ "refs": [ "https://www.bleepingcomputer.com/news/security/sanctions-ransomware-makes-fun-of-usa-sanctions-against-russia/", "http://id-ransomware.blogspot.com/2017/03/sanctions-2017-ransomware.html" + ], + "synonyms": [ + "Sanctions 2017" ] }, "uuid": "7b517c02-9f93-44c7-b957-10346803c43c", @@ -10054,6 +10142,9 @@ "refs": [ "http://www.bleepingcomputer.com/news/security/the-shark-ransomware-project-allows-to-create-your-own-customized-ransomware/", "https://id-ransomware.blogspot.com/2016/07/tilde-ransomware-aes-08.html" + ], + "synonyms": [ + "Tilde" ] }, "uuid": "2709b2ff-a2be-49a9-b268-2576170a5dff", @@ -10527,6 +10618,10 @@ "http://www.nyxbone.com/malware/Troldesh.html", "https://www.bleepingcomputer.com/news/security/kelihos-botnet-delivering-shade-troldesh-ransomware-with-no-more-ransom-extension/", "https://id-ransomware.blogspot.com/2016/06/troldesh-ransomware-email.html" + ], + "synonyms": [ + "Shade", + "Troldesh" ] }, "uuid": "6c3dd006-3501-4ebc-ab86-b06e4d555194", @@ -10759,6 +10854,9 @@ "refs": [ "http://www.nyxbone.com/malware/Virlock.html", "http://www.welivesecurity.com/2014/12/22/win32virlock-first-self-reproducing-ransomware-also-shape-shifter/" + ], + "synonyms": [ + "NSMF" ] }, "uuid": "5c736959-6c58-4bf2-b084-7197b42e500a", @@ -10974,7 +11072,8 @@ "http://id-ransomware.blogspot.com/2016/05/zyklon-locker-ransomware-windows-250.html" ], "synonyms": [ - "GNL Locker" + "GNL Locker", + "Zyklon Locker" ] }, "related": [ @@ -11059,6 +11158,9 @@ "refs": [ "https://www.bleepingcomputer.com/news/security/uiwix-ransomware-using-eternalblue-smb-exploit-to-infect-victims/", "http://id-ransomware.blogspot.com/2017/05/uiwix-ransomware.html" + ], + "synonyms": [ + "UIWIX" ] }, "uuid": "369d6fda-0284-44aa-9e74-f6651416fec4", @@ -11352,6 +11454,9 @@ "refs": [ "https://www.bleepingcomputer.com/news/security/qkg-ransomware-encrypts-only-word-documents-hides-and-spreads-via-macros/", "http://id-ransomware.blogspot.com/2017/11/qkg-ransomware.html" + ], + "synonyms": [ + "QkG" ] }, "uuid": "1f3eab7f-da0a-4e0b-8a9f-cda2f146c819", @@ -11436,6 +11541,9 @@ "refs": [ "https://www.bleepingcomputer.com/news/security/file-spider-ransomware-targeting-the-balkans-with-malspam/", "http://id-ransomware.blogspot.com/2017/12/file-spider-ransomware.html" + ], + "synonyms": [ + "Spider" ] }, "uuid": "3e75ce6b-b6de-4e5a-9501-8f9f847c819c", @@ -12940,6 +13048,9 @@ ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-14th-2018-kraken-dharma-and-matrix/" + ], + "synonyms": [ + "SambaCry" ] }, "uuid": "3675e50d-3f76-45f8-b3f3-4a645779e14d", @@ -13024,6 +13135,9 @@ ], "refs": [ "https://twitter.com/demonslay335/status/1060921043957755904" + ], + "synonyms": [ + "Dxh26wam" ] }, "uuid": "f7fa6978-c932-4e62-b4fc-3fbbbc195602", @@ -13316,6 +13430,9 @@ ], "refs": [ "https://twitter.com/GrujaRS/status/1072468548977680385" + ], + "synonyms": [ + "FORMA" ] }, "uuid": "ea390fa7-94ac-4287-8a2d-c211330671b0", @@ -13411,6 +13528,9 @@ "price": "0.12 (773 $)", "refs": [ "https://blog.trendmicro.com/trendlabs-security-intelligence/ransomware-as-a-service-princess-evolution-looking-for-affiliates/" + ], + "synonyms": [ + "PrincessLocker Evolution" ] }, "uuid": "53da7991-62b7-4fe2-af02-447a0734f41d", @@ -13526,6 +13646,9 @@ "payment-method": "Bitcoin", "refs": [ "https://www.zdnet.com/article/new-phobos-ransomware-exploits-weak-security-to-hit-targets-around-the-world/" + ], + "synonyms": [ + "Java NotDharma" ] }, "uuid": "d2c7fb08-293e-453b-a213-adeb79505767", @@ -13795,6 +13918,9 @@ "meta": { "refs": [ "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf" + ], + "synonyms": [ + "HelpYemen" ] }, "uuid": "000fb0bf-8be3-4ff1-8bbd-cc0513bcdd89", @@ -13859,17 +13985,20 @@ "meta": { "extensions": [ ".pyza", - ".locked" + ".locked", + ".pysa" ], "ransomnotes-filenames": [ "RECOVER_YOUR_DATA.txt" ], "refs": [ "https://www.cert.ssi.gouv.fr/cti/CERTFR-2020-CTI-002/", - "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-002.pdf" + "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-002.pdf", + "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf" ], "synonyms": [ - "Pyza" + "Pyza", + "Pysa" ] }, "uuid": "deed3c10-93b6-41b9-b150-f4dd1b665d87", @@ -13980,6 +14109,9 @@ "https://www.acronis.com/en-us/blog/posts/suncrypt-adopts-attacking-techniques-netwalker-and-maze-ransomware", "https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-sheds-light-on-the-maze-ransomware-cartel/", "https://securityboulevard.com/2020/09/the-curious-case-of-suncrypt/" + ], + "synonyms": [ + "Sun" ] }, "uuid": "4fa25527-99f6-42ee-aaf2-7ca395e5fabc", @@ -14023,6 +14155,7 @@ { "description": "Since this is the first detection of this malware in the wild, it’s not surprising that Babuk is not obsfuscated at all. Overall, it’s a pretty standard ransomware that utilizes some of the new techniques we see such as multi-threading encryption as well as abusing the Windows Restart Manager similar to Conti and REvil. For encrypting scheme, Babuk uses its own implementation of SHA256 hashing, ChaCha8 encryption, and Elliptic-curve Diffie–Hellman (ECDH) key generation and exchange algorithm to protect its keys and encrypt files. Like many ransomware that came before, it also has the ability to spread its encryption through enumerating the available network resources.", "meta": { + "date": "January 2021", "refs": [ "http://chuongdong.com//reverse%20engineering/2021/01/03/BabukRansomware/" ] @@ -14117,6 +14250,9 @@ "https://www.bleepingcomputer.com/news/security/ragnar-locker-ransomware-targets-msp-enterprise-support-tools/", "https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/", "https://www.cybersecurity-insiders.com/ransomware-attack-makes-cwt-pay-4-5-million-in-bitcoins-to-hackers/" + ], + "synonyms": [ + "RagnarLocker" ] }, "related": [ @@ -14870,6 +15006,11 @@ }, { "description": "Ransomware", + "meta": { + "synonyms": [ + "PayPalGenerator2019" + ] + }, "uuid": "92ca663a-347a-47d7-b7da-1208b84a7217", "value": "CryCipher" }, @@ -15075,26 +15216,51 @@ }, { "description": "Ransomware", + "meta": { + "synonyms": [ + "SERVER Cryptomix" + ] + }, "uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "value": "Cryptomix-SERVER" }, { "description": "Ransomware", + "meta": { + "synonyms": [ + "Shark CryptoMix" + ] + }, "uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "value": "CryptoMix-Shark" }, { "description": "Ransomware", + "meta": { + "synonyms": [ + "System CryptoMix" + ] + }, "uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "value": "CryptoMix-System" }, { "description": "Ransomware", + "meta": { + "synonyms": [ + "Tastylock CryptoMix" + ] + }, "uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "value": "CryptoMix-Tastylock" }, { "description": "Ransomware", + "meta": { + "synonyms": [ + "Test CryptoMix" + ] + }, "uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "value": "CryptoMix-Test" }, @@ -15105,21 +15271,41 @@ }, { "description": "Ransomware", + "meta": { + "synonyms": [ + "WORK CryptoMix" + ] + }, "uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "value": "Cryptomix-WORK" }, { "description": "Ransomware", + "meta": { + "synonyms": [ + "x1881 CryptoMix" + ] + }, "uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "value": "CryptoMix-x1881" }, { "description": "Ransomware", + "meta": { + "synonyms": [ + "XZZX CryptoMix" + ] + }, "uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "value": "CryptoMix-XZZX" }, { "description": "Ransomware", + "meta": { + "synonyms": [ + "Zayka CryptoMix" + ] + }, "uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "value": "CryptoMix-Zayka" }, @@ -15615,6 +15801,11 @@ }, { "description": "Ransomware", + "meta": { + "synonyms": [ + "Sextortion Scam" + ] + }, "uuid": "08890a08-8ffc-49f5-b5b9-6a89002327f3", "value": "Extortion Scam" }, @@ -15652,6 +15843,2531 @@ "description": "Ransomware", "uuid": "27e5da0f-5f6c-460c-b1b7-03e78724ab07", "value": "Fake Cerber" + }, + { + "description": "ransomware", + "uuid": "bc7a4be2-1997-40ba-beb7-553120b1411b", + "value": "Fake DMA" + }, + { + "description": "ransomware", + "uuid": "29cd31bb-819f-4d01-9805-ba9656a2d215", + "value": "FartPlz" + }, + { + "description": "ransomware", + "uuid": "6d97efca-8d12-45d3-93c3-93a4d3839110", + "value": "FBLocker" + }, + { + "description": "ransomware", + "uuid": "3a05c407-80bc-491d-9065-97b53137694c", + "value": "FCP" + }, + { + "description": "ransomware", + "uuid": "42aea797-8789-43ed-aca5-0c492a3a8970", + "value": "FCrypt" + }, + { + "description": "ransomware", + "uuid": "010a5c7b-ec43-4540-9c67-4b4f73c82c06", + "value": "FCT" + }, + { + "description": "ransomware", + "uuid": "4e344305-4a3b-43b5-a2a6-5cf669e416e7", + "value": "Fenrir" + }, + { + "description": "ransomware", + "uuid": "7c698732-90bb-4a72-a8ac-f6194761c546", + "value": "File Ripper" + }, + { + "description": "ransomware", + "uuid": "35c968af-cee9-40bf-9d62-b8ba5d6dbc8f", + "value": "FileFuck" + }, + { + "description": "ransomware", + "uuid": "bf09fca0-30ad-4c2c-a3cd-5486382e8e2c", + "value": "File-Locker" + }, + { + "description": "ransomware", + "uuid": "39a197ff-be4b-45a7-bdc8-fc17af421d63", + "value": "FilesL0cker" + }, + { + "description": "ransomware", + "uuid": "06db1c0f-5dcd-4dad-8fb5-cdf8afdf2ab6", + "value": "Final" + }, + { + "description": "ransomware", + "uuid": "02c5bf92-23e8-404c-9fe9-5e50f587d0c4", + "value": "FindZip" + }, + { + "description": "ransomware", + "uuid": "ba21bae0-8af7-492d-84b7-e424b99b5d4a", + "value": "First" + }, + { + "description": "ransomware", + "uuid": "b9f1d220-2ef0-4b1d-84ed-ae6843e5828e", + "value": "Flatcher3" + }, + { + "description": "ransomware", + "uuid": "76a372d0-93ec-45a4-912c-6695a21e047d", + "value": "FlatChestWare" + }, + { + "description": "ransomware", + "uuid": "51f42a21-1963-40c5-b644-d4c1c5c3f9eb", + "value": "Fluffy-TAR" + }, + { + "description": "ransomware", + "uuid": "f5f8939e-b001-45e1-a54d-09183b988c8c", + "value": "Flyper" + }, + { + "description": "ransomware", + "uuid": "10254366-b6d0-4266-a277-6ef4eee460b3", + "value": "Foxy" + }, + { + "description": "ransomware", + "uuid": "0b6e29d4-27e4-422b-944f-72e111462dee", + "value": "FreeMe" + }, + { + "description": "ransomware", + "uuid": "a5e54d82-cb41-420e-a03d-89b762560dcc", + "value": "Freshdesk" + }, + { + "description": "ransomware", + "uuid": "5df125ae-9362-415d-a915-f478447eece5", + "value": "Frog" + }, + { + "description": "ransomware", + "uuid": "61c215e0-835b-488a-8e82-94da05871b80", + "value": "FrozrLock" + }, + { + "description": "ransomware", + "uuid": "8467b6f2-7132-4695-87a6-6a7400c3a7d8", + "value": "FRS" + }, + { + "description": "ransomware", + "uuid": "d81208be-6715-4ef5-b354-9283d7eed531", + "value": "FScrypt" + }, + { + "description": "ransomware", + "uuid": "db9571dc-7ebc-4f2b-a31b-944851c16346", + "value": "FuckTheSystem" + }, + { + "description": "ransomware", + "uuid": "6247ab38-e6dd-4020-8771-f1fdfc9e86bd", + "value": "FuxSocy Encryptor" + }, + { + "description": "ransomware", + "uuid": "1ef5a7de-9fe2-4cfb-a6ff-7f63bc31bf94", + "value": "Galacti-Crypter" + }, + { + "description": "ransomware", + "uuid": "9734c2bc-d638-4b69-9189-c6141f66bcab", + "value": "GameOver" + }, + { + "description": "ransomware", + "uuid": "dd9dd6b6-97c6-4cd1-bd3a-f7e95526b090", + "value": "Geminis3" + }, + { + "description": "ransomware", + "uuid": "0a59664f-b447-4c5e-b8e4-8842e381390b", + "value": "Gendarmerie" + }, + { + "description": "ransomware", + "uuid": "317eee8b-2a8b-4d2a-a17c-9fa651de2f06", + "value": "Genobot" + }, + { + "description": "ransomware", + "uuid": "7f94ad48-3321-4fbb-850d-a0e6cb300815", + "value": "GermanWiper" + }, + { + "description": "ransomware", + "uuid": "857a6d87-3fe7-426a-8679-7029134800af", + "value": "GhosTEncryptor" + }, + { + "description": "ransomware", + "uuid": "66c1ee94-a302-4f25-a54a-fdc2e2c3d164", + "value": "GhostHammer" + }, + { + "description": "ransomware", + "uuid": "abf2485a-8fc6-46a5-9400-d188711a3cb2", + "value": "Gibberish" + }, + { + "description": "ransomware", + "uuid": "5845d539-8c80-4957-92ea-7aa968ec784c", + "value": "Gibon" + }, + { + "description": "ransomware", + "uuid": "f03fb4bc-7762-4529-bce1-d851619fb0d4", + "value": "Giyotin" + }, + { + "description": "ransomware", + "uuid": "c18fb798-f2f8-4119-aee3-5888241d129f", + "value": "GoCryptoLocker" + }, + { + "description": "ransomware", + "uuid": "287f5d11-c1da-4409-8404-543c68cc968e", + "value": "Godra" + }, + { + "description": "ransomware", + "uuid": "df998c50-52d0-462d-9bbb-5b93a5adc7b0", + "value": "GoGoogle" + }, + { + "description": "ransomware", + "uuid": "e88b85ed-d20d-416a-bde9-2a2ba60f9c70", + "value": "GoHack" + }, + { + "description": "ransomware", + "uuid": "c51e8939-8b5d-4b5e-a73e-92944e1392c0", + "value": "Golden Axe" + }, + { + "description": "ransomware", + "uuid": "61fbe157-557a-40c4-919f-d61f6f7b5f2f", + "value": "Gomme" + }, + { + "description": "ransomware", + "uuid": "269bae29-5955-4723-8f33-b81767f44c82", + "value": "GonnaCry Ransmware" + }, + { + "description": "ransomware", + "uuid": "9325868e-bc3a-43d7-ba18-cd5d372eea06", + "value": "Goofed HT" + }, + { + "description": "ransomware", + "uuid": "7b8f0dea-b63a-4b70-ae4b-2a06afd9d438", + "value": "GoRansom POC" + }, + { + "description": "ransomware", + "uuid": "99cf422f-785c-4459-86a0-15f4204f17d2", + "value": "Gorgon" + }, + { + "description": "ransomware", + "uuid": "a7c78489-4545-4d5f-a280-0b919ee23c3f", + "value": "Gotcha" + }, + { + "description": "ransomware", + "uuid": "c694aab7-1c1c-4a36-9fa1-da8860f75ab3", + "value": "GottaCry" + }, + { + "description": "ransomware", + "uuid": "11684b37-3bc6-4d74-b72e-8689f5340bc2", + "value": "GPAA" + }, + { + "description": "ransomware", + "uuid": "c479cd06-3935-4673-abc2-fb2a69b04c23", + "value": "GPGQwerty" + }, + { + "description": "ransomware", + "uuid": "ae7dcbb6-044a-427a-8392-7697c4e1bef7", + "value": "Craftul" + }, + { + "description": "ransomware", + "uuid": "9f7c8936-96ee-4f99-a61c-8c51b4c93c9d", + "value": "Greystars" + }, + { + "description": "ransomware", + "uuid": "e7c56607-ad06-4b6c-881d-5076e083d5d4", + "value": "GrodexCrypt" + }, + { + "description": "ransomware", + "uuid": "b7025c7b-e650-4e8e-83b8-1311bd684b65", + "value": "GrujaRSorium" + }, + { + "description": "ransomware", + "uuid": "d980b021-485e-4515-a629-11a42a67b36c", + "value": "Gruxer" + }, + { + "description": "ransomware", + "uuid": "b0d5f511-7542-46e5-b95a-53c2c56a2683", + "value": "GusCrypter" + }, + { + "description": "ransomware", + "uuid": "e9269244-a119-4c0a-92fd-a3b3617670d8", + "value": "GX40" + }, + { + "description": "ransomware", + "uuid": "9cfe0adf-72e8-44c8-bdce-4c2c2a7749bf", + "value": "H34rtBl33d" + }, + { + "description": "ransomware", + "uuid": "1d689032-cca4-4c40-86db-1eabd2a7cd29", + "value": "HackdoorCrypt3r" + }, + { + "description": "ransomware", + "uuid": "c0091a62-b1cd-495d-898b-d2f3b5af601e", + "value": "Hades Locker" + }, + { + "description": "ransomware", + "uuid": "49e5c755-510d-4eca-a45d-8561a53f6bfa", + "value": "Hakbit" + }, + { + "description": "ransomware", + "uuid": "a5c17b66-ee15-4a08-9eb6-348bb6adeb33", + "value": "HappyCrypter" + }, + { + "description": "ransomware", + "uuid": "8d551d9e-f14c-473e-a896-7cee4fc09e82", + "value": "Haze" + }, + { + "description": "ransomware", + "uuid": "e9863c6d-d081-4f8b-bffd-de2004f93897", + "value": "HCrypto" + }, + { + "description": "ransomware", + "uuid": "3347541a-772d-4b83-a7fd-b9a98569eb8e", + "value": "HELP@AUSI" + }, + { + "description": "ransomware", + "uuid": "526166b7-59a5-4946-9d50-d95788e4d28f", + "value": "HelpDCFile" + }, + { + "description": "ransomware", + "uuid": "5ad18348-acb0-430c-8439-ea2b7c6438e6", + "value": "HelpMe" + }, + { + "description": "ransomware", + "uuid": "718b274e-b547-42dc-ada4-b47e213cd625", + "value": "Hermes837" + }, + { + "description": "ransomware", + "uuid": "2b2379e5-098e-4c62-be82-79ee4e3cc61c", + "value": "HermesVirus HT" + }, + { + "description": "ransomware", + "uuid": "c7e0650f-efbe-4c2e-bef7-ff824fb5a152", + "value": "Heropoint" + }, + { + "description": "ransomware", + "uuid": "7c2a199e-1ed6-4820-a3e2-80c45ff6f709", + "value": "HiddenBeer" + }, + { + "description": "ransomware", + "uuid": "38b8fb07-8545-4f79-8094-fed524e263c4", + "value": "Honor" + }, + { + "description": "ransomware", + "uuid": "bdd46a71-888d-4091-b55e-2fb9ff11a770", + "value": "Horros" + }, + { + "description": "ransomware", + "uuid": "2e4f26d6-f220-4877-be0e-45059b0f8eeb", + "value": "Hydra" + }, + { + "description": "ransomware", + "uuid": "496e3fb8-666c-4dd0-a06f-af1358320f6e", + "value": "IGotYou" + }, + { + "description": "ransomware", + "uuid": "17e7cef2-74fb-4abc-9d83-a65a50654381", + "value": "iGZa4C" + }, + { + "description": "ransomware", + "uuid": "f7947cfd-dfac-437d-bc9d-3b71470d222a", + "value": "ILElection2020" + }, + { + "description": "ransomware", + "uuid": "03429647-cc47-49ee-b336-4fa866abf510", + "value": "Ims00ry" + }, + { + "description": "ransomware", + "uuid": "9c8eadbf-c1d0-4726-85ac-3d595efadf9d", + "value": "ImSorry" + }, + { + "description": "ransomware", + "uuid": "719a97ab-4324-433f-aee0-f42712feb00b", + "value": "Incanto" + }, + { + "description": "ransomware", + "uuid": "ddb76772-bfc9-4896-92ee-b7baf6f1a07e", + "value": "Indrik" + }, + { + "description": "ransomware", + "uuid": "de63a115-7a2b-4b0a-8898-8f3fa6768414", + "value": "InducVirus" + }, + { + "description": "ransomware", + "uuid": "40215dc5-5d28-4770-a85f-b6a71f1db5d9", + "value": "InfinityLock" + }, + { + "description": "ransomware", + "uuid": "5ec2d8cd-090d-4184-b865-53d71cbbc235", + "value": "InfoDot" + }, + { + "description": "ransomware", + "uuid": "6a4ac521-4731-4bc1-abf4-639b451018bc", + "value": "INPIVX" + }, + { + "description": "ransomware", + "uuid": "2a1ab564-52e1-4575-8184-20b68c1f23c6", + "value": "InsaneCrypt" + }, + { + "description": "ransomware", + "uuid": "82f52546-ed68-468d-96a1-d7064478d0de", + "value": "IPA" + }, + { + "description": "ransomware", + "uuid": "54c9604e-ba28-4fa7-9a39-125fe0fbf0cb", + "value": "IT.Books" + }, + { + "description": "ransomware", + "uuid": "159953eb-01f1-4325-9467-54a4c7bdeebb", + "value": "J-" + }, + { + "description": "ransomware", + "uuid": "7770c955-5d04-42c2-8421-3a38c7bebf90", + "value": "JabaCrypter" + }, + { + "description": "ransomware", + "uuid": "d712d488-e189-4fc1-82ce-ef6bb0ecad4e", + "value": "Jaffe" + }, + { + "description": "ransomware", + "uuid": "72e2f10d-9c6a-407d-9e7d-f76c1c8248f2", + "value": "James" + }, + { + "description": "ransomware", + "uuid": "5b8990a3-0e8c-4b81-8d3c-cc8e6b5024eb", + "value": "Java NotDharma" + }, + { + "description": "ransomware", + "uuid": "f1486237-a5da-48aa-8681-45b389ef2fa2", + "value": "jCandy" + }, + { + "description": "ransomware", + "uuid": "d2f5c189-5707-4bec-88d9-0d0bd864cfae", + "value": "JeepersCrypt" + }, + { + "description": "ransomware", + "uuid": "cd334e6e-893b-4dc1-beeb-484f542d0d50", + "value": "Jemd" + }, + { + "description": "ransomware", + "uuid": "07b4eda8-d346-4218-8c4d-a553ae4f684a", + "value": "JesusCrypt" + }, + { + "description": "ransomware", + "uuid": "93b502df-b300-4ea6-af49-85901d9bfc6d", + "value": "JNEC.a" + }, + { + "description": "ransomware", + "uuid": "4bbe43a3-ca75-4f93-973b-2179770ad606", + "value": "JoeGo" + }, + { + "description": "ransomware", + "uuid": "2e8763e0-5584-4f9a-ac60-d111a30a887c", + "value": "Jolly Roger" + }, + { + "description": "ransomware", + "uuid": "2e63db1d-5ce9-4cb4-a75a-86afd2d450ec", + "value": "JosepCrypt" + }, + { + "description": "ransomware", + "uuid": "41ae4021-d6a6-4f19-9414-ff4d78ae2f21", + "value": "Juwon" + }, + { + "description": "ransomware", + "uuid": "b484ef6b-ac11-4fe2-a87c-5731c280b4aa", + "value": "Kali" + }, + { + "description": "ransomware", + "uuid": "6352d423-003a-4545-91d6-bb66425a3edd", + "value": "Kamil" + }, + { + "description": "ransomware", + "uuid": "8f8e32fe-05a1-4125-a287-27ff372b9f56", + "value": "Kampret" + }, + { + "description": "ransomware", + "uuid": "e04a4847-38df-4f14-8b16-6b6da7d5e222", + "value": "Karo" + }, + { + "description": "ransomware", + "uuid": "739c4582-7471-43f3-aa21-3c181fe6713c", + "value": "Katafrank" + }, + { + "description": "ransomware", + "uuid": "3744333c-49b7-45cb-9059-6933725fa725", + "value": "Katyusha" + }, + { + "description": "ransomware", + "uuid": "b17ec2bc-bcc7-4f75-9338-ee7ec64a7a49", + "value": "KCTF Locker" + }, + { + "description": "ransomware", + "uuid": "47e97378-20da-40d4-b6bc-99dd2aba84d2", + "value": "KCW" + }, + { + "description": "ransomware", + "uuid": "a307a755-a243-4b00-b1ef-11b08049ca29", + "value": "Kee" + }, + { + "description": "ransomware", + "uuid": "ccb50fe4-dbcf-4773-933b-0cd27b08e81b", + "value": "KEKW" + }, + { + "description": "ransomware", + "uuid": "389ad313-aceb-4ee1-8554-8aec78a2f7b6", + "value": "Kerkoporta" + }, + { + "description": "ransomware", + "uuid": "55cebdaf-adfb-4943-b169-4652af84e0da", + "value": "KeyMaker" + }, + { + "description": "ransomware", + "uuid": "fc59e09e-49a2-4751-a3c8-0def51fbbd61", + "value": "KillBot_Virus" + }, + { + "description": "ransomware", + "uuid": "d6d91cbd-4ad9-4cf4-b5fa-a468da62b421", + "value": "KillDisk-Dimens" + }, + { + "description": "ransomware", + "uuid": "01dc9bbb-b888-4aa5-b6a2-d216eaa95f84", + "value": "KillRabbit" + }, + { + "description": "ransomware", + "uuid": "f4d370e2-7d91-4bd0-9b1f-33160d4b989f", + "value": "KillSwitch" + }, + { + "description": "ransomware", + "uuid": "74a66fc7-bd18-4f43-a9c1-c22cfe98d101", + "value": "Kindest" + }, + { + "description": "ransomware", + "uuid": "7a502648-9097-41ae-a686-8f9365923daa", + "value": "KKK" + }, + { + "description": "ransomware", + "uuid": "c099771d-82dd-45b6-9a1b-e5590eac897a", + "value": "Kovter" + }, + { + "description": "ransomware", + "uuid": "6ba8bc69-bd70-4672-a167-123bfb260ecb", + "value": "Kriptovor" + }, + { + "description": "ransomware", + "uuid": "d93b5179-d747-4845-b4cd-61b9566aa823", + "value": "Krypte" + }, + { + "description": "ransomware", + "uuid": "822b3254-d715-46bc-8011-c5b647d314dc", + "value": "Krypton" + }, + { + "description": "ransomware", + "uuid": "377a0893-a5f0-4b78-a410-ef814083ae27", + "value": "Kryptonite RBY" + }, + { + "description": "ransomware", + "uuid": "4a3ce744-3468-4ddf-95f9-7095bdd0d65e", + "value": "Kryptonite Snake" + }, + { + "description": "ransomware", + "uuid": "de0bf4df-c578-41f1-b7db-20a1ae481844", + "value": "Kupidon" + }, + { + "description": "ransomware", + "uuid": "a613ff2c-d23c-468b-b53f-c140be5d6457", + "value": "Ladon" + }, + { + "description": "ransomware", + "uuid": "a4a865b8-9b7c-4ec4-b448-ad8b1524f928", + "value": "Lalabitch_ransomware" + }, + { + "description": "ransomware", + "uuid": "a026f575-384f-4a5a-b76d-7baa223661b2", + "value": "LazagneCrypt" + }, + { + "description": "ransomware", + "uuid": "a7c9904b-758f-4107-bffb-12d190e08687", + "value": "Light" + }, + { + "description": "ransomware", + "uuid": "cfbc0527-0301-49f5-a38b-d9d2d73c4256", + "value": "LightningCrypt" + }, + { + "description": "ransomware", + "uuid": "2d3d3c5e-fc6b-4afb-a81b-9b0de8e78446", + "value": "LIGMA" + }, + { + "description": "ransomware", + "uuid": "dd518ffc-8f62-44f0-9eba-b565137ee4c2", + "value": "Lime" + }, + { + "description": "ransomware", + "uuid": "c96c1d9c-9f7d-47ac-9849-6a9e4c049f55", + "value": "Litra" + }, + { + "description": "ransomware", + "uuid": "0ea3f9fd-9f2a-4491-9492-e655344fd5ec", + "value": "LittleFinger" + }, + { + "description": "ransomware", + "uuid": "f3dfd38d-9795-4c2f-92f8-683f252c7935", + "value": "LMAOxUS" + }, + { + "description": "ransomware", + "uuid": "eed8bf9a-cbb6-4096-9511-7a3cf47d10c4", + "value": "LockBox" + }, + { + "description": "ransomware", + "uuid": "07b6bb3b-e738-466e-9267-78587c3dea6b", + "value": "Locked_File" + }, + { + "description": "ransomware", + "uuid": "3a29a37a-528a-4fd5-b6c8-a5be64c88c15", + "value": "LockedByte" + }, + { + "description": "ransomware", + "uuid": "d62a826b-9d74-4e04-8e12-9cb918c0ee80", + "value": "Locker-Pay" + }, + { + "description": "ransomware", + "uuid": "8622375e-47c3-4542-be21-cc76969cdaa1", + "value": "Lockify" + }, + { + "description": "ransomware", + "uuid": "c493f2e3-7fdc-41f5-8450-1e01dd92c339", + "value": "LockMe" + }, + { + "description": "ransomware", + "uuid": "229959ff-de0f-46d5-9ded-5026944adc13", + "value": "LockOn" + }, + { + "description": "ransomware", + "uuid": "70fa1062-fdb1-424b-b29e-c4497c4f9df4", + "value": "Lockout" + }, + { + "description": "ransomware", + "uuid": "23ccf1d7-4f68-4c95-a8a4-eeff5720be63", + "value": "LongTermMemoryLoss" + }, + { + "description": "ransomware", + "uuid": "1609a28b-9da4-419f-8df9-0589d842f231", + "value": "LonleyCrypt" + }, + { + "description": "ransomware", + "uuid": "706d91b7-990b-486f-bf6b-33ffdc704039", + "value": "LooCipher" + }, + { + "description": "ransomware", + "uuid": "de60a270-8ed2-4b39-b90c-ebbd7821962d", + "value": "LordOfShadow" + }, + { + "description": "ransomware", + "uuid": "98c9333d-9c94-436d-9f37-3ba4354cad32", + "value": "Losers" + }, + { + "description": "ransomware", + "uuid": "29a65541-4638-4acc-9627-f5cfd5d719d0", + "value": "Losers-Dangerous" + }, + { + "description": "ransomware", + "uuid": "2c5d28fa-1ca9-45ff-9ea6-943a1fd375af", + "value": "Lost_Files" + }, + { + "description": "ransomware", + "uuid": "92312287-ab2b-4246-a46b-c9b41714571b", + "value": "LuckyJoe" + }, + { + "description": "ransomware", + "uuid": "0e372055-134e-4360-b62e-ad65ee20a2c4", + "value": "Luxnut" + }, + { + "description": "ransomware", + "uuid": "d44c76ea-ab96-4f95-aa51-471c779de3d1", + "value": "Madafakah" + }, + { + "description": "ransomware", + "uuid": "27e23341-bbcd-4eae-992e-f0a0c87e3b40", + "value": "MadBit" + }, + { + "description": "ransomware", + "uuid": "7fe890f7-db7f-4cef-ad9f-9e44d445ef8a", + "value": "Magician" + }, + { + "description": "ransomware", + "uuid": "8ee63c4b-eb0d-47f1-b867-41afb64a5686", + "value": "Malabu" + }, + { + "description": "ransomware", + "uuid": "bd2800dc-62b8-4e77-bde5-1a1b0c4d2502", + "value": "MalwareTech's CTF" + }, + { + "description": "ransomware", + "uuid": "c430f580-6ba9-44fa-a8c5-9ccfff339940", + "value": "Mancros+AI4939" + }, + { + "description": "ransomware", + "uuid": "e1b124d6-6a92-4d0a-a116-ae8f448e5dc3", + "value": "Maoloa" + }, + { + "description": "ransomware", + "uuid": "cf316be5-f76f-4c9a-8cc1-52214bb18896", + "value": "Marozka" + }, + { + "description": "ransomware", + "uuid": "3121238f-0982-4a10-92fc-047fbd658784", + "value": "MarraCrypt" + }, + { + "description": "ransomware", + "uuid": "20f3f441-7285-4b83-a2a1-fad2d23b1048", + "value": "Matroska" + }, + { + "description": "ransomware", + "uuid": "9b9f3cc7-7cb8-4431-8187-d7494703d618", + "value": "MauriGo" + }, + { + "description": "ransomware", + "uuid": "b219c747-81da-45c5-88a6-50a1a4642ba0", + "value": "MaxiCrypt" + }, + { + "description": "ransomware", + "uuid": "d5c3b64f-c9b4-4f48-9391-6f0d5ac8f5e4", + "value": "Maykolin" + }, + { + "description": "ransomware", + "uuid": "82b3dd0f-eb99-4866-aaa2-af4f4182d612", + "value": "Maysomware" + }, + { + "description": "ransomware", + "uuid": "2a803db3-8962-4d2f-8397-e3301b57cef7", + "value": "MBR-ONI" + }, + { + "description": "ransomware", + "uuid": "627d603a-906f-4fbf-b922-f03eea4578fe", + "value": "MedusaLocker" + }, + { + "description": "ransomware", + "uuid": "6a985c3b-8ad9-4005-b363-854f6f6f4dcd", + "value": "Meduza" + }, + { + "description": "ransomware", + "uuid": "60ec39c9-25d2-4d04-ad2e-4f9293159e84", + "value": "MegaLocker" + }, + { + "description": "ransomware", + "uuid": "1d274b68-a9c9-4418-a430-df9e4f0d4f4a", + "value": "Mew767" + }, + { + "description": "ransomware", + "uuid": "08e17d21-6f58-4eef-aee5-0dd842ca6eee", + "value": "Mike NotSTOP" + }, + { + "description": "ransomware", + "uuid": "dce3f8d4-9381-4b91-8cf5-e33e55a1e199", + "value": "Mikoyan" + }, + { + "description": "ransomware", + "uuid": "ae96d561-5f2e-43ce-9b82-7a81e825758a", + "value": "MindLost" + }, + { + "description": "ransomware", + "uuid": "8051a21d-8967-4674-a6c3-dc794df43fe0", + "value": "MindSystem" + }, + { + "description": "ransomware", + "uuid": "804c576e-8679-47ff-9550-0c1abe896e46", + "value": "Mini" + }, + { + "description": "ransomware", + "uuid": "63f2149a-c736-4a7d-86f9-0993cb568630", + "value": "Minotaur" + }, + { + "description": "ransomware", + "uuid": "6c01d999-123f-4301-939d-a65bbcf00d90", + "value": "MMM" + }, + { + "description": "ransomware", + "uuid": "c4461bdf-560d-4f89-a5cb-f0960a720687", + "value": "MNS CryptoLocker" + }, + { + "description": "ransomware", + "uuid": "98c9ebce-d11c-41b7-9923-4e94dca22fb0", + "value": "MoneroPay" + }, + { + "description": "ransomware", + "uuid": "4f579928-8f50-459c-8878-df1c75437c38", + "value": "MongoLock" + }, + { + "description": "ransomware", + "uuid": "8e103d80-1e53-42b0-a21a-5a2bcefa7d3f", + "value": "MoonCryptor" + }, + { + "description": "ransomware", + "uuid": "b14d39e1-36ea-45a9-8609-95ac7ffce3cd", + "value": "Mordor" + }, + { + "description": "ransomware", + "uuid": "21181132-affd-464e-81cd-35ef575fc56d", + "value": "MorrisBatchCrypt" + }, + { + "description": "ransomware", + "uuid": "eecce3be-ba24-4cf4-b9cf-8780533dc487", + "value": "Moth" + }, + { + "description": "ransomware", + "uuid": "a319539b-ccd0-4278-83fa-9419331bb1f2", + "value": "MoWare H.F.D" + }, + { + "description": "ransomware", + "uuid": "c21111d1-fc51-437a-9c73-1b89922bea95", + "value": "Mr.Locker" + }, + { + "description": "ransomware", + "uuid": "7221c504-c3a3-4020-9490-01e569aeddcb", + "value": "Mr403Forbidden" + }, + { + "description": "ransomware", + "uuid": "754ea5a6-6d56-482c-bb0a-c6618fca4390", + "value": "MuchLove" + }, + { + "description": "ransomware", + "uuid": "7f8d5860-35db-4f23-a174-514a0066e573", + "value": "Muhstik" + }, + { + "description": "ransomware", + "uuid": "0a68c300-6ce0-4664-9956-3abafb3e526e", + "value": "Mystic" + }, + { + "description": "ransomware", + "uuid": "6aa66f32-54f7-46b7-bb5b-9e953bf97ced", + "value": "MZP" + }, + { + "description": "ransomware", + "uuid": "eeb3c94c-1424-49a9-831b-36bbd9e81a1d", + "value": "N2019cov" + }, + { + "description": "ransomware", + "uuid": "c06b039c-7a68-4f35-9948-87934f287ddd", + "value": "Naampa" + }, + { + "description": "ransomware", + "uuid": "2fe2b576-9673-46b2-b558-811c26db3f6b", + "value": "NazCrypt" + }, + { + "description": "ransomware", + "uuid": "d12f369c-f776-468a-8abf-8000b1b30642", + "value": "Nefilim" + }, + { + "description": "ransomware", + "uuid": "38fbf2d7-10a2-4cb2-9d50-cb2434a55c10", + "value": "Negozl" + }, + { + "description": "ransomware", + "uuid": "686d157c-6c30-4ffb-b192-ca99d90770da", + "value": "Neitrino" + }, + { + "description": "ransomware", + "uuid": "78c192ac-7fb6-4c85-8e20-9f86f4633873", + "value": "NewWave" + }, + { + "description": "ransomware", + "uuid": "d6899ce2-7d67-4730-9a32-4721051d33f9", + "value": "NextCry" + }, + { + "description": "ransomware", + "uuid": "e361e083-de14-4ffd-80b9-f071096ab973", + "value": "Nightmare" + }, + { + "description": "ransomware", + "uuid": "d79ab668-4720-4875-8959-436c7fd81022", + "value": "NinjaLoc" + }, + { + "description": "ransomware", + "uuid": "ab9ece36-6218-4467-929f-d07192a98b6a", + "value": "NM4" + }, + { + "description": "ransomware", + "uuid": "fd447eea-9e79-4143-8e7d-246b022c7950", + "value": "Noblis" + }, + { + "description": "ransomware", + "uuid": "6db73f66-912d-43f7-ae21-7988aed2ea22", + "value": "Nog4yH4n" + }, + { + "description": "ransomware", + "uuid": "2a0b033f-c14c-42ec-9f10-57dc2de3639e", + "value": "Nomikon" + }, + { + "description": "ransomware", + "uuid": "bf54e9f3-81af-43f7-b378-0109c4adc489", + "value": "NotAHero" + }, + { + "description": "ransomware", + "uuid": "6fc911ca-2f9c-428e-8986-aff706edee92", + "value": "Nozelesn" + }, + { + "description": "ransomware", + "uuid": "619ccdda-2f40-48fe-9492-dd12c70a4029", + "value": "Nulltica" + }, + { + "description": "ransomware", + "uuid": "8f869515-4c4e-4cd0-8b15-9dc3f9a43902", + "value": "Nx / OSR" + }, + { + "description": "ransomware", + "uuid": "e8bc21bf-ddfa-4245-89b4-19cfb430eb7d", + "value": "Nyton" + }, + { + "description": "ransomware", + "uuid": "641b511e-c974-4584-b8ab-08c1296ac73b", + "value": "NZMR" + }, + { + "description": "ransomware", + "uuid": "9686665e-b862-4399-84b9-407714df1677", + "value": "Ogre" + }, + { + "description": "ransomware", + "uuid": "c1470d12-fd35-497e-b1cf-0484e755b7a2", + "value": "OhNo!" + }, + { + "description": "ransomware", + "uuid": "652d3fdd-a641-4553-8695-69e0ef74bd1c", + "value": "Oled" + }, + { + "description": "ransomware", + "uuid": "9162c2e1-6936-4c13-a8c3-c10eab321bd5", + "value": "OmniSphere" + }, + { + "description": "ransomware", + "uuid": "47273227-8079-46e6-9b89-3abdd39c017f", + "value": "One" + }, + { + "description": "ransomware", + "uuid": "3358ae46-afcd-4685-81b6-75970f502660", + "value": "ONI" + }, + { + "description": "ransomware", + "uuid": "d056b6f3-4cb0-41a8-a0f5-4fec33871697", + "value": "OoPS Ramenware" + }, + { + "description": "ransomware", + "uuid": "3c2ce8a5-e060-4466-847a-3c2db9282bd6", + "value": "OopsLocker" + }, + { + "description": "ransomware", + "uuid": "88b486e5-ccb2-4f67-8967-f841fb28ea76", + "value": "OPdailyallowance" + }, + { + "description": "ransomware", + "uuid": "1e63a74c-a975-4997-ae2c-4ac9196412e4", + "value": "OpenToYou" + }, + { + "description": "ransomware", + "uuid": "c1a4ddf5-cfe6-4482-a8d4-69761eff0554", + "value": "Ordinal" + }, + { + "description": "ransomware", + "uuid": "c624a4b1-b4aa-4810-b860-45545c6ecb50", + "value": "Ordinypt" + }, + { + "description": "ransomware", + "uuid": "0ef81fda-237e-4d28-8bd7-f05c748eb0d8", + "value": "Pacman" + }, + { + "description": "ransomware", + "uuid": "4857ec1b-7d5f-487d-a2cd-91588158fe49", + "value": "PassLock" + }, + { + "description": "ransomware", + "uuid": "8acc6960-3eb9-479d-a745-7c7eddacc0f2", + "value": "Pay-or-Lost" + }, + { + "description": "ransomware", + "uuid": "dc5be315-4829-448a-9359-05d5b9187756", + "value": "PayForNature" + }, + { + "description": "ransomware", + "uuid": "ef63051e-a99e-43db-b81d-80ec95e74610", + "value": "Paymen45" + }, + { + "description": "ransomware", + "uuid": "7a2eeb1a-6ae3-4e1c-a4f7-af4a0be2d98e", + "value": "Payment" + }, + { + "description": "ransomware", + "uuid": "2a20dd7e-242e-45ac-8245-1864320ed157", + "value": "PClock и PClock2" + }, + { + "description": "ransomware", + "uuid": "fc91d065-21c2-44ae-9169-241d60f1a786", + "value": "PPDDDP" + }, + { + "description": "ransomware", + "uuid": "0df4ba53-b7c9-4e2a-979d-f8e3d7737aa9", + "value": "PEC 2017" + }, + { + "description": "ransomware", + "uuid": "05f9a3ce-2611-40b9-b788-c8dc7233e5a7", + "value": "Pendor" + }, + { + "description": "ransomware", + "uuid": "48bef862-8a8c-4eeb-b72c-a756762b52c7", + "value": "Pennywise" + }, + { + "description": "ransomware", + "uuid": "512d011c-81a8-4218-866c-1497f4572caf", + "value": "PewCrypt +decrypt" + }, + { + "description": "ransomware", + "uuid": "c37cf393-f299-4b02-864c-5e7e5f244d04", + "value": "PewDiePie" + }, + { + "description": "ransomware", + "uuid": "bbbfe905-6236-419a-ab21-a33202597b1c", + "value": "PhobosImposter" + }, + { + "description": "ransomware", + "uuid": "37a26943-99b6-40ae-984d-91e044546d1b", + "value": "PhoneNumber" + }, + { + "description": "ransomware", + "uuid": "70ce8986-d1c3-4e10-8096-1ee2539f11d7", + "value": "PHP" + }, + { + "description": "ransomware", + "uuid": "5822a3dc-64b3-4303-b0ba-d2e804a5015c", + "value": "Pirateware" + }, + { + "description": "ransomware", + "uuid": "88c32b3b-daa1-4cec-8e05-753ee5785704", + "value": "PoisonFang" + }, + { + "description": "ransomware", + "uuid": "fc3984d8-b1c6-45e7-8d36-e51532c9b7fc", + "value": "PonyFinal" + }, + { + "description": "ransomware", + "uuid": "bd401c00-e690-4dae-80ac-c47aab227e5f", + "value": "PooleZoor" + }, + { + "description": "ransomware", + "uuid": "d494a2e6-17e6-435f-9bcd-ef728d18f504", + "value": "PopCornTime" + }, + { + "description": "ransomware", + "uuid": "3687c99c-f44e-421d-a04d-0a80d086c53a", + "value": "PowerHentai" + }, + { + "description": "ransomware", + "uuid": "662bf791-0a13-48e8-9f21-07dfb328d02b", + "value": "PowerLocky" + }, + { + "description": "ransomware", + "uuid": "5ed83975-a681-4061-8314-9ef76f319ef2", + "value": "PowerShell Locker 2013" + }, + { + "description": "ransomware", + "uuid": "b9a6faf4-733d-44b3-889b-ec468697ba3f", + "value": "PowerShell Locker 2015" + }, + { + "description": "ransomware", + "uuid": "535916a2-283b-4512-bc8b-e5d98c055fab", + "value": "Pr0tector" + }, + { + "description": "ransomware", + "uuid": "d8da450f-5e17-4301-b1ba-5468aa69d17a", + "value": "Predator" + }, + { + "description": "ransomware", + "uuid": "bd351d3d-3633-4aba-a35e-82cb7a00b2d5", + "value": "Priapos" + }, + { + "description": "ransomware", + "uuid": "114fbac2-6d2b-46b5-bc08-ed0c94cd756e", + "value": "Project23" + }, + { + "description": "ransomware", + "uuid": "084f9aec-4ebc-46a2-be97-0d1d172be044", + "value": "Project57" + }, + { + "description": "ransomware", + "uuid": "c4417bfb-717f-48d9-bd56-bc9e85d07c19", + "value": "ProLock" + }, + { + "description": "ransomware", + "uuid": "f5390f29-d832-434d-8547-5cab7f82a93b", + "value": "Prometey" + }, + { + "description": "ransomware", + "uuid": "a732a730-3fb4-4642-a4c5-25edaf0a1b9f", + "value": "Protected" + }, + { + "description": "ransomware", + "uuid": "4274477b-65c7-4497-846b-c8beebc264a2", + "value": "PSCrypt" + }, + { + "description": "ransomware", + "uuid": "801d7e9f-8076-4d6f-894e-c557f3b9cfeb", + "value": "PshCrypt" + }, + { + "description": "ransomware", + "uuid": "7cce4912-900f-4d16-b2c5-37b9078f3d7b", + "value": "PTP" + }, + { + "description": "ransomware", + "uuid": "64c5896a-141c-41fb-bc58-705f008c7b8f", + "value": "Pulpy" + }, + { + "description": "ransomware", + "uuid": "119b0b4d-034e-4e58-a7a4-833f083848cd", + "value": "PureLocker" + }, + { + "description": "ransomware", + "uuid": "a8b6433c-fc01-4c77-9a89-5f0f57136aaa", + "value": "PwndLocker" + }, + { + "description": "ransomware", + "uuid": "bf927535-eaf2-48e4-9b38-287de9ec4a0b", + "value": "PyteHole" + }, + { + "description": "ransomware", + "uuid": "ee55d30a-8735-42f4-b8e9-3610959be772", + "value": "Python" + }, + { + "description": "ransomware", + "uuid": "b79b60a4-2b47-4bb1-b36e-602a03afc7cd", + "value": "PZDC" + }, + { + "description": "ransomware", + "uuid": "89cc64e1-d33c-4922-84d4-0467bdeddba6", + "value": "Qinynore" + }, + { + "description": "ransomware", + "uuid": "8f5b9eff-242d-4f9b-9aa6-c24f92f7f0f9", + "value": "QNAPCrypt" + }, + { + "description": "ransomware", + "uuid": "9bd4c0c6-e8fe-495a-99b8-b5ea741ff8ae", + "value": "QP" + }, + { + "description": "ransomware", + "uuid": "380c73bf-7734-44c4-9f46-063cbd20475f", + "value": "QuakeWay" + }, + { + "description": "ransomware", + "uuid": "60f4c416-8752-4d59-8e9e-b12f16afda83", + "value": "Qweuirtksd" + }, + { + "description": "ransomware", + "uuid": "2943ea4b-42e8-4e5c-9abb-d6c3e94b84ce", + "value": "R3store" + }, + { + "description": "ransomware", + "uuid": "8b1f7d30-1115-4ad2-a986-fd797edf2b4d", + "value": "RabbitFox" + }, + { + "description": "ransomware", + "uuid": "c07fd277-f133-4deb-84ef-2f651aa0d989", + "value": "Ramsey" + }, + { + "description": "ransomware", + "uuid": "93e70c60-6bd2-4f01-a28a-1ae287349d61", + "value": "RandomLocker" + }, + { + "description": "ransomware", + "uuid": "d2b23d28-c12d-422f-8558-0d79ed98d335", + "value": "RanRans" + }, + { + "description": "ransomware", + "uuid": "d2d0d87f-249f-4223-82b2-71c82df6c7f2", + "value": "Rans0mLocked" + }, + { + "description": "ransomware", + "uuid": "0c1b4371-9c6e-41f2-9410-e76a1094d0ca", + "value": "Ransed" + }, + { + "description": "ransomware", + "uuid": "dfdc4876-bc48-4748-822a-dcce1c4058c4", + "value": "Ransom102" + }, + { + "description": "ransomware", + "uuid": "493847f8-57b1-42cc-9303-6b1eb9576580", + "value": "RansomAES" + }, + { + "description": "ransomware", + "uuid": "b63ed281-5357-4d20-afef-3377b70fd48b", + "value": "RansomCuck" + }, + { + "description": "ransomware", + "uuid": "65844c85-ad66-46e9-bb44-f99e601179a2", + "value": "RansomMine" + }, + { + "description": "ransomware", + "uuid": "1f5c7ad1-5ec5-4e0f-b7e0-c87232693a5d", + "value": "Ransomnix" + }, + { + "description": "ransomware", + "uuid": "1fe7d70f-8540-4f21-8675-2fe72bacce85", + "value": "Ransom Prank" + }, + { + "description": "ransomware", + "uuid": "7ec4a72d-12d3-46bb-a796-0296db298935", + "value": "RansomUserLocker" + }, + { + "description": "ransomware", + "uuid": "8af10e62-84e7-45c5-ae10-db1106cec43a", + "value": "RansomWarrior" + }, + { + "description": "ransomware", + "uuid": "9fd0b741-44fb-42fe-bf3d-b36b807878fe", + "value": "Rapid" + }, + { + "description": "ransomware", + "uuid": "8a7c32fd-9851-40c3-9fd9-a889a015db5e", + "value": "Rapid 2.0" + }, + { + "description": "ransomware", + "uuid": "07ef8e30-7bcd-4f14-af50-a113fdf60774", + "value": "Rapid 3.0" + }, + { + "description": "ransomware", + "uuid": "84160999-eebb-4f76-8253-9e09d447f472", + "value": "Rapid-Gillette" + }, + { + "description": "ransomware", + "uuid": "8cd93feb-4bf0-4d97-b5a2-061198652f1a", + "value": "Ra" + }, + { + "description": "ransomware", + "uuid": "a9d76a58-0ab3-4942-b364-27f89a1915eb", + "value": "RaRuCrypt" + }, + { + "description": "ransomware", + "uuid": "81e4038a-5e4d-4df1-90b7-c4aef735d757", + "value": "RedBoot" + }, + { + "description": "ransomware", + "uuid": "c26438bb-5aa3-4de4-a749-329d2560a350", + "value": "Redkeeper" + }, + { + "description": "ransomware", + "uuid": "4b2746c5-77f3-4f46-90de-4a0816dcd621", + "value": "RedFox" + }, + { + "description": "ransomware", + "uuid": "56351998-4871-4b7c-9c4c-201aa2ef7eaa", + "value": "RedRum" + }, + { + "description": "ransomware", + "uuid": "7c23a477-ea87-48d9-8c7e-d9333c28e984", + "value": "Redshot" + }, + { + "description": "ransomware", + "uuid": "570ba51b-3ce7-4f5b-88a9-98b9f22f8397", + "value": "Reetner" + }, + { + "description": "ransomware", + "uuid": "ca306262-b8e9-46a1-abcd-db5df38b47d5", + "value": "RekenSom" + }, + { + "description": "ransomware", + "uuid": "f5d20d2c-2624-4a0a-a136-36457d65360b", + "value": "Relock" + }, + { + "description": "ransomware", + "uuid": "a27e94d4-9fcb-4729-926c-b507cad09674", + "value": "RensenWare" + }, + { + "description": "ransomware", + "uuid": "53386169-9045-4636-b4e9-fd9405663d71", + "value": "Rentyr" + }, + { + "description": "ransomware", + "uuid": "11367b8d-0627-4774-894a-032fde021979", + "value": "RestoLocker" + }, + { + "description": "ransomware", + "uuid": "f881e6a3-2298-4e82-9d0a-75ceddf0e822", + "value": "Resurrection" + }, + { + "description": "ransomware", + "uuid": "19274b88-c0dc-4e91-957b-93d4a992329b", + "value": "Retis" + }, + { + "description": "ransomware", + "uuid": "af2011f8-b076-43cf-afb7-a348a7b00b9a", + "value": "RetMyData" + }, + { + "description": "ransomware", + "uuid": "7f750865-50aa-40cb-9614-d7d1c357999b", + "value": "Revolution" + }, + { + "description": "ransomware", + "uuid": "8cf3f181-c136-4f09-82ea-f8c5e6ca4b64", + "value": "Reyptson" + }, + { + "description": "ransomware", + "uuid": "39e600c4-2c5b-4798-8a0e-0fa530c2bd0a", + "value": "Rhino" + }, + { + "description": "ransomware", + "uuid": "8c18e32f-0b02-4551-b53b-2ac25baaccaa", + "value": "Rijndael" + }, + { + "description": "ransomware", + "uuid": "34bdd9f9-94e6-4805-b6b5-27632686070f", + "value": "Rogue HT" + }, + { + "description": "ransomware", + "uuid": "64c573b7-80d1-42d0-9fac-dab07f5df00f", + "value": "Rontok" + }, + { + "description": "ransomware", + "uuid": "0283d153-30f5-4be0-9ab7-8eee91fccd63", + "value": "Rozlok" + }, + { + "description": "ransomware", + "uuid": "84a5bfc2-44dc-4ddf-95d7-387ff16c7415", + "value": "RSA-NI" + }, + { + "description": "ransomware", + "uuid": "ce28af26-b03e-45ca-8e6d-20fbb36233db", + "value": "RSA2048Pro" + }, + { + "description": "ransomware", + "uuid": "224966b2-8d6a-4602-8d7d-67e7c8b2068f", + "value": "Ruby" + }, + { + "description": "ransomware", + "uuid": "b48f7bab-c2ba-4f80-9547-4f2bfef38959", + "value": "Rush" + }, + { + "description": "ransomware", + "uuid": "15d0121a-aac9-41cb-a140-69c3eb739d4a", + "value": "Russenger" + }, + { + "description": "ransomware", + "uuid": "100741e9-1803-4be7-98a8-6e5eeb01a50d", + "value": "Russian EDA2" + }, + { + "description": "ransomware", + "uuid": "6c7c182b-2a7a-43be-91d8-2bc34d9273c1", + "value": "SAD" + }, + { + "description": "ransomware", + "uuid": "fb94c242-0b03-4338-8c5a-7e4357e5a69c", + "value": "SadComputer" + }, + { + "description": "ransomware", + "uuid": "a5aa9c7d-10f7-4091-9c9a-e02acdbe5ca6", + "value": "Sadogo" + }, + { + "description": "ransomware", + "uuid": "dd020ef8-0f84-4403-8e2a-09728582467f", + "value": "Salsa" + }, + { + "description": "ransomware", + "uuid": "2869ae30-4106-4080-a63b-be29caecf5b7", + "value": "Santa Encryptor" + }, + { + "description": "ransomware", + "uuid": "3f8ec946-b80d-45b6-ae82-bffbb0bb05d7", + "value": "Saramat" + }, + { + "description": "ransomware", + "uuid": "43690415-9a4f-4019-a02e-26ec3dd2961c", + "value": "SARansom" + }, + { + "description": "ransomware", + "uuid": "120b33e8-75e2-45bd-b7ba-6726ed2a4ad7", + "value": "Satan Cryptor 2.0" + }, + { + "description": "ransomware", + "uuid": "aefd8f3f-20c2-4b08-bd00-99c1e67152c4", + "value": "Satan's Doom Crypter" + }, + { + "description": "ransomware", + "uuid": "d7a08ff9-af25-45e5-9fb7-c54defd6f62c", + "value": "SatanCryptor Go" + }, + { + "description": "ransomware", + "uuid": "90db5ee9-f2de-47aa-a923-2862800b473b", + "value": "Saturn" + }, + { + "description": "ransomware", + "uuid": "3f2ed9f6-384b-4846-97d0-8dec61b9f03a", + "value": "Satyr" + }, + { + "description": "ransomware", + "uuid": "4790fcdd-deab-4a9d-a8b6-dc413dee4ff8", + "value": "SaveTheQueen" + }, + { + "description": "ransomware", + "uuid": "f9884cee-1105-4f39-9e42-dda43841fd56", + "value": "ScammerLocker HT" + }, + { + "description": "ransomware", + "uuid": "9d1e1894-28d6-412b-8014-ac6c92657bc9", + "value": "ScammerLocker Ph" + }, + { + "description": "ransomware", + "uuid": "eaea10da-947e-42f9-99c9-6a576fda3bdc", + "value": "Schwerer" + }, + { + "description": "ransomware", + "uuid": "4b6bea32-12bd-4ede-8912-f9037be3b454", + "value": "ScorpionLocker" + }, + { + "description": "ransomware", + "uuid": "23a6b580-6df0-4193-a66f-721bacbe60fc", + "value": "Scrabber" + }, + { + "description": "ransomware", + "uuid": "f13796ff-a16c-4cd0-b4e1-9f4593c90d2e", + "value": "Scroboscope" + }, + { + "description": "ransomware", + "uuid": "1b14e605-c8ce-4281-b09f-3c2478afc4f4", + "value": "SecretSystem" + }, + { + "description": "ransomware", + "uuid": "e0e111d1-8499-427d-aa37-41f1e52da79d", + "value": "SecureCryptor" + }, + { + "description": "ransomware", + "uuid": "5142f162-d123-4eca-a428-86033d9d60e0", + "value": "SeginChile" + }, + { + "description": "ransomware", + "uuid": "7e9924c3-f166-40be-b1c5-85011b77a7f2", + "value": "SEND.ID.TO" + }, + { + "description": "ransomware", + "uuid": "db6208a6-16a6-49fa-9259-ccd7626719f9", + "value": "Seon" + }, + { + "description": "ransomware", + "uuid": "de8ddc1c-3e86-46e9-abc5-4409257dd174", + "value": "Sepsis" + }, + { + "description": "ransomware", + "uuid": "75b0d6cd-477c-415b-bf3a-fd8181ea6747", + "value": "SepSys" + }, + { + "description": "ransomware", + "uuid": "8e0a2826-279a-4d7f-901f-223b65d556e2", + "value": "Shadi" + }, + { + "description": "ransomware", + "uuid": "a6a80481-0c0b-470d-bdc4-a35f75c6ec2e", + "value": "ShadowCryptor" + }, + { + "description": "ransomware", + "uuid": "14162500-23ce-47e5-8375-664516f2bf3c", + "value": "ShinigamiLocker" + }, + { + "description": "ransomware", + "uuid": "a7b363ef-7dd6-4df4-81c0-299670c11240", + "value": "ShkolotaCrypt" + }, + { + "description": "ransomware", + "uuid": "0e492b45-03c8-4f87-9038-4d37c7203b18", + "value": "Shrug" + }, + { + "description": "ransomware", + "uuid": "95b099a1-6549-4bf7-a895-3c06259ea000", + "value": "Shutdown57" + }, + { + "description": "ransomware", + "uuid": "21d4caeb-96e4-4564-8d62-6d7521b0d8ec", + "value": "ShutUpAndDance" + }, + { + "description": "ransomware", + "uuid": "92e5861f-5b20-4401-a75f-f5120269b827", + "value": "Sifreli 2017" + }, + { + "description": "ransomware", + "uuid": "87372df7-0fa1-4d1e-bf76-4cfdcdced997", + "value": "Sifreli 2019" + }, + { + "description": "ransomware", + "uuid": "364013f9-15d2-41c0-b458-fd4085466151", + "value": "SifreCozucu" + }, + { + "description": "ransomware", + "uuid": "939e7780-5c6e-43f4-9710-c0c219762bc9", + "value": "SilentSpring" + }, + { + "description": "ransomware", + "uuid": "c3a9d2d0-d239-40af-86cc-51457ed82b46", + "value": "SintaLocker" + }, + { + "description": "ransomware", + "uuid": "7c36b38e-6851-402b-93cd-195e029cba84", + "value": "Skull" + }, + { + "description": "ransomware", + "uuid": "fe5ea390-fe3a-4ec9-b0f6-8365c525f5be", + "value": "Skull HT" + }, + { + "description": "ransomware", + "uuid": "0d3634a3-1766-4b49-8ceb-2274ca2048af", + "value": "SkyStars" + }, + { + "description": "ransomware", + "uuid": "eae70261-6efc-424f-829f-4d179c7a75ae", + "value": "SlankCryptor" + }, + { + "description": "ransomware", + "uuid": "787ea4ce-23ab-464e-9dd8-bb6d24b0c481", + "value": "Snake-Ekans" + }, + { + "description": "ransomware", + "uuid": "92d45020-2aa0-49ac-8e71-be8f3a3f79eb", + "value": "SnakeLocker" + }, + { + "description": "ransomware", + "uuid": "1a58eeac-26dc-40e6-8182-22cd461ba736", + "value": "Snatch" + }, + { + "description": "ransomware", + "uuid": "f0a26e38-d67c-4215-8a9d-1723ac984d62", + "value": "SnowPicnic" + }, + { + "description": "ransomware", + "uuid": "f2125a86-a23d-4165-a6b7-821db3b48b95", + "value": "SoFucked" + }, + { + "description": "ransomware", + "uuid": "e065c7cc-061d-43a8-9668-1aa187e0fd52", + "value": "SOLO" + }, + { + "description": "ransomware", + "uuid": "48f18fa2-7dea-4bdf-8736-253672b62140", + "value": "Somik1" + }, + { + "description": "ransomware", + "uuid": "b5f99a93-0c4f-491d-a36a-617d892b5e38", + "value": "Sorry HT" + }, + { + "description": "ransomware", + "uuid": "2fab1ada-2e01-4704-b4d8-e3bb75e6488b", + "value": "SpartCrypt" + }, + { + "description": "ransomware", + "uuid": "1e968067-dd8f-4c15-a756-4f572a0ee2cf", + "value": "Spectre" + }, + { + "description": "ransomware", + "uuid": "dbe1f272-07c0-4189-ab91-4a6ee7d1ee9a", + "value": "Sphinx" + }, + { + "description": "ransomware", + "uuid": "9dad4770-3fd8-48e8-8dd3-bac621f9932a", + "value": "Spiteful Doubletake" + }, + { + "description": "ransomware", + "uuid": "a73abf3d-abda-4916-9401-8c522f87de7c", + "value": "SpongeBob" + }, + { + "description": "ransomware", + "uuid": "5eacbcf2-84b9-4467-a8de-4c8e9af2c840", + "value": "StalinLocker" + }, + { + "description": "ransomware", + "uuid": "6a9f0f9f-2033-4361-918b-fbfa1cac5e9b", + "value": "Stinger" + }, + { + "description": "ransomware", + "uuid": "e6b1ec39-e118-47d2-9205-468c87be86c2", + "value": "Storm" + }, + { + "description": "ransomware", + "uuid": "c6ab1853-d980-4eb8-b2d5-5c22d9eb882a", + "value": "StrawHat" + }, + { + "description": "ransomware", + "uuid": "928e5d57-8029-4300-be0a-5e6e43c220dd", + "value": "Streamer" + }, + { + "description": "ransomware", + "uuid": "d018d87e-4baa-45bd-880b-496c18726da3", + "value": "Striked" + }, + { + "description": "ransomware", + "uuid": "1ae8b4dd-eaef-4181-a699-02536aece63d", + "value": "Stroman" + }, + { + "description": "ransomware", + "uuid": "8371370f-8d53-4e90-95f7-e20540f5d052", + "value": "Stupid" + }, + { + "description": "ransomware", + "uuid": "b8826051-f533-4e70-b59e-166009946ee3", + "value": "StupidJapan" + }, + { + "description": "ransomware", + "uuid": "4d1c8d02-f3e2-4a95-8ca2-f3665ec6cc8d", + "value": "Styver" + }, + { + "description": "ransomware", + "uuid": "5039d334-c737-4d5b-941c-38a714a014c2", + "value": "Styx" + }, + { + "description": "ransomware", + "uuid": "41ee30d0-4c67-4445-990b-07c3c8f1aa28", + "value": "SuperB" + }, + { + "description": "ransomware", + "uuid": "f379af94-1826-41bb-a879-ff84a1319848", + "value": "SuperCrypt" + }, + { + "description": "ransomware", + "uuid": "f3673646-cfd7-4b6e-bd43-b3366d3391d9", + "value": "Suri" + }, + { + "description": "ransomware", + "uuid": "60561968-40ba-44b6-9ef5-5577c2422f72", + "value": "Symbiom" + }, + { + "description": "ransomware", + "uuid": "59863099-6ef0-4fad-87cb-adf21d22ace4", + "value": "SymmyWare" + }, + { + "description": "ransomware", + "uuid": "b779b4c0-f32c-4815-bcdf-b81f44a5efd0", + "value": "Syrk" + }, + { + "description": "ransomware", + "uuid": "a1bae9e1-2eed-4004-b289-b572936450a3", + "value": "SYSDOWN" + }, + { + "description": "ransomware", + "uuid": "ea3f6dc9-4afe-43c6-be84-1ba9c752c9c6", + "value": "SystemCrypter" + }, + { + "description": "ransomware", + "uuid": "561090ca-d8a6-43f8-acbb-c2d58d422cbd", + "value": "T1Happy" + }, + { + "description": "ransomware", + "uuid": "dcfb11cf-bc62-4c2c-9ff8-f4c019c1141d", + "value": "Takahiro Locker" + }, + { + "description": "ransomware", + "uuid": "4945d7b7-33a7-4e41-94ba-f55650f336e7", + "value": "TBHRanso" + }, + { + "description": "ransomware", + "uuid": "02467be1-ac0d-4fcd-b2b9-0d0c7d337e06", + "value": "Teamo" + }, + { + "description": "ransomware", + "uuid": "12622e89-46d4-4cd5-95be-c3a2d12e8a18", + "value": "Tear Dr0p" + }, + { + "description": "ransomware", + "uuid": "6ee1b6e3-dac1-483b-aa8c-6afe4433e1ed", + "value": "Technicy" + }, + { + "description": "ransomware", + "uuid": "db9aa4f1-5f54-4bed-9f7a-a19e906f94b4", + "value": "TeslaWare" + }, + { + "description": "ransomware", + "uuid": "d5d35c4f-ebde-43ae-acfc-d41c06210893", + "value": "TFlower" + }, + { + "description": "ransomware", + "uuid": "9867ec9e-a772-4c70-81dc-1517330e58bd", + "value": "The Brotherhood" + }, + { + "description": "ransomware", + "uuid": "cafb301d-098f-40d3-92c7-722b2cc15172", + "value": "The Magic" + }, + { + "description": "ransomware", + "uuid": "8ab31008-966e-4ad5-88a2-9e820b814292", + "value": "TheCursedMurderer" + }, + { + "description": "ransomware", + "uuid": "3ec11602-d4df-4341-a9f0-91caf2be1cc0", + "value": "TheDarkEncryptor" + }, + { + "description": "ransomware", + "uuid": "3ecf7a76-9e37-4d36-9dda-be8d0a38d56a", + "value": "Thor" + }, + { + "description": "ransomware", + "uuid": "6c01d67f-2d59-45ae-a5ba-decef1f2cc0d", + "value": "THT" + }, + { + "description": "ransomware", + "uuid": "630d46fe-306d-49fa-b2e4-9f85f8b86000", + "value": "ThunderCrypt" + }, + { + "description": "ransomware", + "uuid": "772f6749-a753-42af-8442-e6526f8b9a2a", + "value": "Tk" + }, + { + "description": "ransomware", + "uuid": "904fc008-64f6-4adf-863e-f5b6b63df65c", + "value": "Torchwood" + }, + { + "description": "ransomware", + "uuid": "dcf0947c-15f3-438c-97e0-ec65d63b80bb", + "value": "TorLocker" + }, + { + "description": "ransomware", + "uuid": "483cae7f-4554-46db-8bbc-223881ae9a1c", + "value": "TotalWipeOut" + }, + { + "description": "ransomware", + "uuid": "abdb9c59-c07b-4701-8208-e6a0cf9efe98", + "value": "TPS1.0" + }, + { + "description": "ransomware", + "uuid": "95d5eba2-dbb6-4527-9dee-ba13d1c9ac00", + "value": "Trick-Or-Treat" + }, + { + "description": "ransomware", + "uuid": "6853449b-8b09-43be-96dc-26b16b4d421b", + "value": "Trojan-Syria" + }, + { + "description": "ransomware", + "uuid": "18c91134-1df6-4853-a1c2-c8424137f2e6", + "value": "TrumpHead" + }, + { + "description": "ransomware", + "uuid": "90c6daf8-8212-4ea8-9b59-af49b290b3b9", + "value": "TurkStatik" + }, + { + "description": "ransomware", + "uuid": "93277946-177a-4f92-833d-30db9d432656", + "value": "Tyrant" + }, + { + "description": "ransomware", + "uuid": "0407e98d-cd3e-42e1-8daf-3c51d2e4906a", + "value": "UCCU" + }, + { + "description": "ransomware", + "uuid": "ba4f3704-cb2d-4a12-8d81-c825063aaaca", + "value": "Ukash" + }, + { + "description": "ransomware", + "uuid": "fbbb3784-ddf9-447a-91d8-e155317edd87", + "value": "Ultimo HT" + }, + { + "description": "ransomware", + "uuid": "911e63bc-ab09-4da1-8db7-2ad9354eafee", + "value": "UltraCrypter" + }, + { + "description": "ransomware", + "uuid": "90fa20b3-425c-4361-9f7f-e1c89f972158", + "value": "UmbreCrypt" + }, + { + "description": "ransomware", + "uuid": "bed135ea-0b1b-4928-88eb-f5d78d2ef7ec", + "value": "UnblockUPC" + }, + { + "description": "ransomware", + "uuid": "a9695d8a-9d83-4ae0-9460-f4f56c41ed90", + "value": "Unikey" + }, + { + "description": "ransomware", + "uuid": "5ee8d6db-8a82-40ee-9e8e-a96795b3fee0", + "value": "Unknown Crypted" + }, + { + "description": "ransomware", + "uuid": "348fda47-e254-479e-b702-ebefda3f490d", + "value": "Unknown Lock" + }, + { + "description": "ransomware", + "uuid": "b73d6fd8-7707-451a-a5cb-0425289b02be", + "value": "Unknown XTBL" + }, + { + "description": "ransomware", + "uuid": "f94e3dba-cdd6-438e-bc7e-b71af6e8e161", + "value": "Unlckr" + }, + { + "description": "ransomware", + "uuid": "15140e19-f09e-4543-9a4c-b0f0e96860fe", + "value": "UNNAM3D" + }, + { + "description": "ransomware", + "uuid": "d77b1546-d37d-47ed-9a46-52892bdbd639", + "value": "Unnamed Bin" + }, + { + "description": "ransomware", + "uuid": "2fe11a8a-dfc3-41c3-891f-365a10a1debd", + "value": "Unrans" + }, + { + "description": "ransomware", + "uuid": "10666f8c-9e0a-485e-88cc-98b993321d5f", + "value": "UselessDisk" + }, + { + "description": "ransomware", + "uuid": "f43f4c9a-5008-477c-9105-4d444c883caa", + "value": "UselessFiles" + }, + { + "description": "ransomware", + "uuid": "a6a04c23-9df3-47b9-9095-4b7f9799f51a", + "value": "USR0" + }, + { + "description": "ransomware", + "uuid": "edcc3607-b246-44ce-8878-5af1a09976ae", + "value": "Vaca" + }, + { + "description": "ransomware", + "uuid": "74a8637a-ac0d-45dd-91d5-326459f09cb5", + "value": "VCrypt" + }, + { + "description": "ransomware", + "uuid": "d1deeb03-5084-4b50-bb19-38d7bd36a42f", + "value": "vCrypt1" + }, + { + "description": "ransomware", + "uuid": "d9dd94aa-a646-40b3-a2d3-5870c6be66cf", + "value": "VegaLocker" + }, + { + "description": "ransomware", + "uuid": "1ccd6940-4eb7-416c-a0de-1fb672d93c80", + "value": "Velso" + }, + { + "description": "ransomware", + "uuid": "7fd558de-1dfe-432a-834b-3e2691ee7283", + "value": "Vendetta" + }, + { + "description": "ransomware", + "uuid": "3d71e8a0-d823-47c0-8a0d-62e35d348514", + "value": "VevoLocker" + }, + { + "description": "ransomware", + "uuid": "e089f805-8cc2-41d0-b67e-eae21d78bc6c", + "value": "VHD" + }, + { + "description": "ransomware", + "uuid": "99edd501-76ca-4492-a0a3-8e1c988be22a", + "value": "ViACrypt" + }, + { + "description": "ransomware", + "uuid": "777390e2-0d15-499a-8f87-5a5851cdbd09", + "value": "Viagra" + }, + { + "description": "ransomware", + "uuid": "7eb414f6-11d9-4424-b486-e1e379b6840f", + "value": "VideoBelle" + }, + { + "description": "ransomware", + "uuid": "38c94712-deed-470a-b784-0f4665aebf39", + "value": "ViiperWare" + }, + { + "description": "ransomware", + "uuid": "0fecef7e-a387-497f-bc26-9560fd943afb", + "value": "Viro" + }, + { + "description": "ransomware", + "uuid": "3f62e429-7e6d-41c5-b716-9eb2304e60dc", + "value": "ViroBotnet" + }, + { + "description": "ransomware", + "uuid": "fc8cc150-c2fb-40cd-9cca-638b8a091861", + "value": "VisionCrypt" + }, + { + "description": "ransomware", + "uuid": "dff0c92b-953d-4fef-8b36-f36906f806d2", + "value": "VMola" + }, + { + "description": "ransomware", + "uuid": "823e56de-7d4c-4914-a49b-524a5bb77b02", + "value": "VoidCrypt" + }, + { + "description": "ransomware", + "uuid": "1da33eaf-096e-4076-8676-23da3a97ed74", + "value": "Vulston" + }, + { + "description": "ransomware", + "uuid": "a5d35c2d-7d06-4539-a4f7-75499663d152", + "value": "Waffle" + }, + { + "description": "ransomware", + "uuid": "26aec13a-eaf2-4adb-9c67-e6ae8f318a0c", + "value": "Waiting" + }, + { + "description": "ransomware", + "uuid": "e5b2a647-0107-4309-9695-c7bb7859cf4c", + "value": "Waldo" + }, + { + "description": "ransomware", + "uuid": "a3be0f12-ece5-4bdb-bcb6-1f5732eb5735", + "value": "Wanna Decryptor Portuguese" + }, + { + "description": "ransomware", + "uuid": "45259e4f-7c68-4e9a-86af-078607181a84", + "value": "WannabeHappy" + }, + { + "description": "ransomware", + "uuid": "30a56d79-1dee-401e-ad3d-3ea939c4efde", + "value": "WannaCash" + }, + { + "description": "ransomware", + "uuid": "870836be-0534-437e-a25a-7f1e70f9f394", + "value": "WannaDie" + }, + { + "description": "ransomware", + "uuid": "b222ca29-29b1-4aaa-a709-a3730a70216a", + "value": "WannaPeace" + }, + { + "description": "ransomware", + "uuid": "4dd51f0f-ad6b-4117-b071-505ec4b71730", + "value": "WannaSpam" + }, + { + "description": "ransomware", + "uuid": "9540bd2d-638b-4e79-a231-6f06b055c916", + "value": "Want Money" + }, + { + "description": "ransomware", + "uuid": "0ca42fde-477c-459d-89a6-bed041a73b70", + "value": "Wesker" + }, + { + "description": "ransomware", + "uuid": "5e678363-c42e-4852-9a2e-90212310a522", + "value": "WhatAFuck" + }, + { + "description": "ransomware", + "uuid": "305b6505-1186-43c8-acd9-431322287ec6", + "value": "WhyCry" + }, + { + "description": "ransomware", + "uuid": "cb343570-c8a0-4bb6-ba3b-88126449593e", + "value": "Windows10" + }, + { + "description": "ransomware", + "uuid": "99a8b639-1b06-4e4b-9994-a6e4d0601341", + "value": "WininiCrypt" + }, + { + "description": "ransomware", + "uuid": "1942a99a-5c5a-49ef-8c6d-0cb6b0fb082b", + "value": "Winsecure" + }, + { + "description": "ransomware", + "uuid": "8ec00fe5-475b-47bc-a7fc-b470d15aaa75", + "value": "WinUpdatesDisabler" + }, + { + "description": "ransomware", + "uuid": "f14af77c-5a98-4840-953c-2f37af8cdcc5", + "value": "WTDI" + }, + { + "description": "ransomware", + "uuid": "39bcd377-24cb-42f4-8f2a-2aa17d5171dc", + "value": "X Locker 5.0" + }, + { + "description": "ransomware", + "uuid": "78e05406-ce59-478a-bf1e-1b1abe22e116", + "value": "XCry" + }, + { + "description": "ransomware", + "uuid": "88f4f772-8c6e-4201-92aa-819c5e7af5c1", + "value": "XD" + }, + { + "description": "ransomware", + "uuid": "9582a86c-c20d-4e1f-a124-bf2c6d8adf33", + "value": "XData" + }, + { + "description": "ransomware", + "uuid": "4272cc4a-9d93-4712-b641-b7f4fc9f86bc", + "value": "XeroWare" + }, + { + "description": "ransomware", + "uuid": "5ecc109c-9f04-4e56-86c4-83b37181e75b", + "value": "Xlockr" + }, + { + "description": "ransomware", + "uuid": "a0c2b579-20f0-4357-8a01-596ce20db48a", + "value": "XmdXtazX" + }, + { + "description": "ransomware", + "uuid": "95d00a69-c048-48c3-bc6b-fa6a655d8ff3", + "value": "Xncrypt" + }, + { + "description": "ransomware", + "uuid": "d650da35-7ad7-417a-902a-16ea55bd1126", + "value": "XRat" + }, + { + "description": "ransomware", + "uuid": "d2843c78-557d-4f95-a0bf-9ab3f1a4e49e", + "value": "XCry" + }, + { + "description": "ransomware", + "uuid": "f5c46d3f-404b-4640-9892-005f845d33a2", + "value": "XyuEncrypt" + }, + { + "description": "ransomware", + "uuid": "c08fd941-e54c-4ac6-b94a-fc9b5c9617da", + "value": "xXLecXx" + }, + { + "description": "ransomware", + "uuid": "ebfa8988-8063-4e3c-a635-7da898389aa4", + "value": "Yatron" + }, + { + "description": "ransomware", + "uuid": "d6791998-5c0a-4943-bda5-b378d1326a13", + "value": "Yoshikada" + }, + { + "description": "ransomware", + "uuid": "e32b8df2-6f03-4232-b64a-2de14b5642f3", + "value": "YYYYBJQOQDU" + }, + { + "description": "ransomware", + "uuid": "2f6d77c5-54df-4997-b82c-ca54d6948d6f", + "value": "ZariqaCrypt" + }, + { + "description": "ransomware", + "uuid": "463d17d4-e35e-4614-9247-47a3a50a8cda", + "value": "Zelta Free" + }, + { + "description": "ransomware", + "uuid": "fee8e9fa-68b9-4b69-bd62-6213971e7e10", + "value": "ZenCrypt" + }, + { + "description": "ransomware", + "uuid": "5e3a2958-6922-465e-bc36-3b6e59ad1bc1", + "value": "Zeoticus" + }, + { + "description": "ransomware", + "uuid": "bc62429c-1bf7-42c0-997d-d8c2f80355de", + "value": "Zeppelin" + }, + { + "description": "ransomware", + "uuid": "90ac4150-aab9-44a2-bd56-2bcfa773798b", + "value": "Zero-Fucks" + }, + { + "description": "ransomware", + "uuid": "9296d2bc-ec26-4724-88b4-82ab682ed11e", + "value": "ZeroLocker" + }, + { + "description": "ransomware", + "uuid": "03686533-7339-4401-b90d-1125eeffa07f", + "value": "Zeronine" + }, + { + "description": "ransomware", + "uuid": "4ff2a1ff-a35e-4d3a-a132-2dcefa2995f7", + "value": "ZeroRansom" + }, + { + "description": "ransomware", + "uuid": "2147b5a8-2f4a-433c-95aa-cdeb4349c542", + "value": "Zilla" + }, + { + "description": "ransomware", + "uuid": "ae9ec6c3-570f-41fc-ac18-5b129976727a", + "value": "ZimbraCryptor" + }, + { + "description": "ransomware", + "uuid": "0dfbed7c-66c5-4309-b8ba-7c7a6e659512", + "value": "ZipLocker" + }, + { + "description": "ransomware", + "uuid": "774e5809-2d72-4c3d-a28b-5c51f17f1981", + "value": "Zipper" + }, + { + "description": "ransomware", + "uuid": "a67eedaf-84c5-42ed-86fe-853c76599fe5", + "value": "Zoldon" + }, + { + "description": "ransomware", + "uuid": "03e34bcf-af8b-429d-ac66-aeff844e8fd6", + "value": "ZorgoCry" } ], "version": 95 From b7b4b356c34be7191555956c07f442ad64d565ae Mon Sep 17 00:00:00 2001 From: Delta-Sierra Date: Mon, 19 Apr 2021 14:47:10 +0200 Subject: [PATCH 2/3] Adding ransomware names [WIP 3] --- clusters/ransomware.json | 931 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 928 insertions(+), 3 deletions(-) diff --git a/clusters/ransomware.json b/clusters/ransomware.json index 63be497..4423bb0 100644 --- a/clusters/ransomware.json +++ b/clusters/ransomware.json @@ -8738,6 +8738,13 @@ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" + }, + { + "dest-uuid": "8fa6b51a-a48d-48dc-87ec-cf0d30ad66e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" } ], "uuid": "681f212a-af1b-4e40-a718-81b0dc46dc52", @@ -10911,6 +10918,15 @@ "Hades Locker" ] }, + "related": [ + { + "dest-uuid": "c0091a62-b1cd-495d-898b-d2f3b5af601e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], "uuid": "31945e7b-a734-4333-9ea2-e52051ca015a", "value": "WildFire Locker" }, @@ -14111,7 +14127,8 @@ "https://securityboulevard.com/2020/09/the-curious-case-of-suncrypt/" ], "synonyms": [ - "Sun" + "Sun", + "Suncrypt" ] }, "uuid": "4fa25527-99f6-42ee-aaf2-7ca395e5fabc", @@ -16151,8 +16168,20 @@ }, { "description": "ransomware", + "meta": { + "date": "December 2020" + }, + "related": [ + { + "dest-uuid": "31945e7b-a734-4333-9ea2-e52051ca015a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], "uuid": "c0091a62-b1cd-495d-898b-d2f3b5af601e", - "value": "Hades Locker" + "value": "Hades" }, { "description": "ransomware", @@ -18368,7 +18397,903 @@ "description": "ransomware", "uuid": "03e34bcf-af8b-429d-ac66-aeff844e8fd6", "value": "ZorgoCry" + }, + { + "description": "ransomware", + "uuid": "78541326-4aaa-4eda-8f55-bf21bb2537ab", + "value": "Smaug" + }, + { + "description": "ransomware", + "expanded": "Cat22", + "uuid": "e3cce543-64b0-4f7a-a176-f1ddc429da3f", + "value": "GammA" + }, + { + "description": "ransomware", + "uuid": "c35de33c-8f7c-41f3-9b74-6da34a0d31c6", + "value": "BlackMoon" + }, + { + "description": "ransomware", + "uuid": "ab33547b-2b6c-47ae-8fca-9747735b0955", + "value": "MilkmanVictory" + }, + { + "description": "ransomware", + "uuid": "1263f5e9-7073-443b-a884-caf9ebf47a1a", + "value": "Dragoncyber" + }, + { + "description": "ransomware", + "uuid": "61513ee1-4667-43eb-831a-3e01d8e1039f", + "value": "Solider" + }, + { + "description": "ransomware", + "uuid": "a65bde28-b74c-4ec5-ae20-01cbe101b025", + "value": "Biglock" + }, + { + "description": "ransomware", + "uuid": "c2880897-759e-4cbf-8d08-a3418567a33c", + "value": "Immuni" + }, + { + "description": "ransomware", + "uuid": "d848ca6f-c935-4dba-b706-bd06be094a87", + "value": "Black claw" + }, + { + "description": "ransomware", + "uuid": "b6096de6-c831-4a64-9108-e3fcfc7fcc44", + "value": "Banks1" + }, + { + "description": "ransomware", + "uuid": "9683775c-7d36-4a5a-9580-1038ed17d9d2", + "value": "UnluckyWare" + }, + { + "description": "ransomware", + "uuid": "7d949282-005f-45de-96b3-5584a1114cd6", + "value": "Zorab" + }, + { + "description": "ransomware", + "uuid": "b56a89d1-1748-42a0-8a78-02e882a219a9", + "value": "FonixCrypter" + }, + { + "description": "ransomware", + "uuid": "ab0f5636-38cf-4c89-a090-df4f006bd47b", + "value": "LickyAgent" + }, + { + "description": "ransomware", + "uuid": "2c6fdb78-08cc-4199-992d-0b8c8a6b1c46", + "value": "Avaddon" + }, + { + "description": "ransomware", + "uuid": "d52ba288-4bcc-4f52-be6c-0d9cfadbf194", + "value": "DualShot" + }, + { + "description": "ransomware", + "uuid": "e68a3736-1d87-4a77-9814-b23c65cee3c3", + "value": "RNS" + }, + { + "description": "ransomware", + "uuid": "b1126047-eaaa-4e2f-abc9-f64faa84d692", + "value": "Such_Crypt" + }, + { + "description": "ransomware", + "uuid": "c64d6b5d-44a1-461e-acc6-2b4571f6163d", + "value": "20dfs" + }, + { + "description": "ransomware", + "uuid": "cfa9c2ee-6a2f-4cd4-849f-bcf8e9aa77a7", + "value": "CryDroid" + }, + { + "description": "ransomware", + "uuid": "6f011a57-6a70-4e2a-9a51-36d9032bef05", + "value": "TomNom" + }, + { + "description": "ransomware", + "uuid": "ada0a2d1-f595-4988-b87a-623c5581bbad", + "value": "Yogynicof" + }, + { + "description": "ransomware", + "uuid": "d160c549-3cf8-4f20-b041-8d775469a566", + "value": "CobraLocker" + }, + { + "description": "ransomware", + "uuid": "ca9a3c5c-ef8e-4e09-bd91-0347a6967837", + "value": "PL" + }, + { + "description": "ransomware", + "uuid": "ed6f4c24-a2eb-4395-ae76-4d4992b21f5b", + "value": "CryCryptor" + }, + { + "description": "ransomware", + "uuid": "d1c43e2b-75a5-4d75-a8b7-b46fe106ed87", + "value": "Blocky" + }, + { + "description": "ransomware", + "uuid": "b7d9e0c2-e772-41e0-9202-5df2bcff9022", + "value": "OhNo-FakePDF" + }, + { + "description": "ransomware", + "uuid": "455b864e-47c0-419f-9c0c-a75bac6d5e84", + "value": "Try2Cry" + }, + { + "description": "ransomware", + "uuid": "5e1df833-e4de-44a9-8728-1681a6e6afbc", + "value": "LolKek" + }, + { + "description": "ransomware", + "uuid": "165949bf-bc59-43c8-a9b7-d281da5688ee", + "value": "FlowEncrypt" + }, + { + "description": "ransomware", + "uuid": "3ae97d00-4b38-4f81-a055-a1057e3cebae", + "value": "WhoLocker" + }, + { + "description": "ransomware", + "uuid": "ad010794-bdac-4157-adba-e87014a29708", + "value": "Pojie" + }, + { + "description": "ransomware", + "uuid": "c795358a-c462-48f0-a5ff-9bdc1dd869e5", + "value": "Aris Locker" + }, + { + "description": "ransomware", + "uuid": "7750a0ed-e17b-4eaf-97f1-ddf097c48858", + "value": "EduRansom" + }, + { + "description": "ransomware", + "uuid": "db954a2d-4602-4722-977d-3b147ebc1858", + "value": "Fastwind" + }, + { + "description": "ransomware", + "uuid": "51600819-3b88-43a9-b64e-d08bf5d29f7c", + "value": "Silvertor" + }, + { + "description": "ransomware", + "uuid": "b8b0933a-896a-45d1-8284-ebc55dff1f98", + "value": "Exorcist" + }, + { + "description": "ransomware", + "uuid": "df5ef12b-c0e3-4069-beaa-e84ea953befc", + "value": "WyvernLocker" + }, + { + "description": "ransomware", + "uuid": "58d0f5cf-5e71-44dc-b493-b0d3c0724587", + "value": "Ensiko" + }, + { + "description": "ransomware", + "uuid": "d667e11f-95d0-4c44-a0c6-b6ab617c307f", + "value": "Django" + }, + { + "description": "ransomware", + "uuid": "2c754dfc-0748-47d7-8853-652c1d6a93a7", + "value": "RansomBlox" + }, + { + "description": "ransomware", + "uuid": "a378ddf1-5981-4e76-8672-60dd4cb67dc1", + "value": "BitRansomware" + }, + { + "description": "ransomware", + "uuid": "e9cd52e1-b3e0-4da9-b969-4a3947f3f6bf", + "value": "AESMew" + }, + { + "description": "ransomware", + "uuid": "4cd34987-7b49-4a75-8668-a02498b9b1ac", + "value": "DeathOfShadow" + }, + { + "description": "ransomware", + "uuid": "9acc2bd8-9215-4795-bf2b-c4281a8ca697", + "value": "XMRLocker" + }, + { + "description": "ransomware", + "uuid": "0aada732-3b59-4410-a043-5a190d391927", + "value": "WinWord64" + }, + { + "description": "ransomware", + "uuid": "937d3070-7fc6-4967-98bc-17acb0c8da8e", + "value": "ThunderX" + }, + { + "description": "ransomware", + "uuid": "7513650c-ba09-49bf-b011-d2974c7ae023", + "value": "Mountlocket" + }, + { + "description": "ransomware", + "uuid": "09fac901-8fcf-4faa-b1e3-96407433d0f2", + "value": "Gladius" + }, + { + "description": "ransomware", + "uuid": "1ff34e4a-a205-493f-bdd0-2212d80fd83c", + "value": "Cyrat" + }, + { + "description": "ransomware", + "uuid": "705e03d1-b0c9-4c0b-9b10-fb751e09a020", + "value": "Crypt32" + }, + { + "description": "ransomware", + "uuid": "16ebc67f-96d2-4497-84da-a05713352aba", + "value": "BizHack" + }, + { + "description": "ransomware", + "uuid": "971bdbfe-d55d-410f-9b07-57ba69027eb8", + "value": "Geneve" + }, + { + "description": "ransomware", + "uuid": "361a35bc-c952-41ad-bd27-c32b690aa9e3", + "value": "Z3" + }, + { + "description": "ransomware", + "uuid": "e723285e-14ff-4d25-97c3-43e73168d606", + "value": "Leakthemall" + }, + { + "description": "ransomware", + "uuid": "201eff54-d41e-4f70-916c-5dfb9301730a", + "value": "Conti" + }, + { + "description": "ransomware", + "uuid": "f3d28719-fa72-42c3-b0fe-cda484abbaf9", + "value": "Makop" + }, + { + "description": "ransomware", + "uuid": "b0552a9f-8820-48c3-a75b-158063f17e1b", + "value": "Best Crypt" + }, + { + "description": "ransomware", + "uuid": "784c93bb-4522-4988-92c0-fef89ff6086d", + "value": "Consciousness" + }, + { + "description": "ransomware", + "uuid": "28d7d7e6-3803-4e77-bd89-8a0921a55c17", + "value": "Flamingo" + }, + { + "description": "ransomware", + "uuid": "89346526-4f9d-4369-a1a2-53974a97a651", + "value": "PewPew" + }, + { + "description": "ransomware", + "uuid": "9684f0dc-2c9d-46e3-a12f-65ea85a678e5", + "value": "DogeCrypt" + }, + { + "description": "ransomware", + "uuid": "47354b68-52c9-4750-b783-97c278ddb6a2", + "value": "Badbeeteam" + }, + { + "description": "ransomware", + "uuid": "e6b40e6b-7c3e-453c-a250-577f4b8a1a7c", + "value": "Solve" + }, + { + "description": "ransomware", + "uuid": "6f7c24e3-b7e6-483c-92f0-99bf562f6397", + "value": "RenameX12" + }, + { + "description": "ransomware", + "uuid": "e3c82188-6f63-48e1-ace8-e93484994792", + "value": "Zhen" + }, + { + "description": "ransomware", + "uuid": "e5ef8579-a215-4450-8294-c887f3d62476", + "value": "Datacloud" + }, + { + "description": "ransomware", + "uuid": "d511beb8-69c6-4ad8-aa82-fb7b56f467a5", + "value": "Ironcat" + }, + { + "description": "ransomware", + "uuid": "ea521e5d-0908-4bb4-8111-b27f56b8fb8d", + "value": "Dusk" + }, + { + "description": "ransomware", + "uuid": "966b504a-b032-4d99-80fa-5008228b2926", + "value": "Cutekitty" + }, + { + "description": "ransomware", + "uuid": "3cc0e0d6-2b19-4505-8f2f-11456efeda8f", + "value": "Babax" + }, + { + "description": "ransomware", + "uuid": "a7219d8e-e616-4808-8d5d-6eafe423405a", + "value": "Eyecry" + }, + { + "description": "ransomware", + "uuid": "9f23a356-8ae8-40b2-bbde-d2f4ba62a883", + "value": "Osno" + }, + { + "description": "ransomware", + "uuid": "1a49c0c2-3b66-4832-bf9c-d5624e6a5aaa", + "value": "Loki" + }, + { + "description": "ransomware", + "uuid": "c4390e31-fdbd-44d9-babf-adc2b20a57ff", + "value": "WoodRat" + }, + { + "description": "ransomware", + "uuid": "6d1ba8c7-3a86-4ec5-bfdf-f647c6fe984b", + "value": "Curator" + }, + { + "description": "ransomware", + "uuid": "31c20516-d4ee-46fb-a020-ccc1b44177b7", + "value": "32aa" + }, + { + "description": "ransomware", + "uuid": "6ac0f7e3-eebd-4112-a915-b069604c6d2b", + "value": "Vaggen" + }, + { + "description": "ransomware", + "uuid": "fb98368c-79fb-4d34-a7e0-c4cc9847bce0", + "value": "Clay" + }, + { + "description": "ransomware", + "uuid": "7b2f9d2c-d96a-4515-b57d-cc1cff35de3a", + "value": "Pizhon" + }, + { + "description": "ransomware", + "uuid": "8439a797-4d81-4b8c-b278-3c41c640294f", + "value": "InstallPay" + }, + { + "description": "ransomware", + "uuid": "ff711485-e052-4ca0-934a-748a7a5d6f4c", + "value": "MetadataBin" + }, + { + "description": "ransomware", + "uuid": "bd743e59-1a2a-40ad-9cd4-d1e519d3b91d", + "value": "TechandStrat" + }, + { + "description": "ransomware", + "uuid": "af35e406-7af3-46f1-b32d-305f9711f645", + "value": "Mars" + }, + { + "description": "ransomware", + "uuid": "bee837e2-8bdb-4291-a267-4211bdc2a309", + "value": "Scatterbrain" + }, + { + "description": "ransomware", + "uuid": "55d3f7c0-7aa8-4b0e-b0f9-86dd68c78968", + "value": "CCECrypt" + }, + { + "description": "ransomware", + "uuid": "5de1dec7-749e-42ad-b0bf-68d5d774d5be", + "value": "SZ40" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "678bc24d-a5c3-4ddd-9292-40958afa3492", + "value": "Pay2Key" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "ae288b5d-062c-4a11-ba81-14794dc6127f", + "value": "Tripoli" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "dcc12d6f-d59f-4451-999d-7728bf4e95aa", + "value": "Devos" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "63397164-fee2-4662-afac-cc651b0426cb", + "value": "HowAreYou" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "4be906e7-b6db-453f-8f9b-a8d8d9b29f4b", + "value": "SifreCikis" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "1bdafae9-51cd-4384-8ee7-774c9db7820f", + "value": "68-Random-HEX" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "a536a6bd-f567-4631-bdc7-ac38fd9faf81", + "value": "RedRoman" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "ce9b4949-aa84-46fe-a532-2d8b7846d1f5", + "value": "MXX" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "5553296d-2fe5-490b-bb16-bc2432ede8be", + "value": "Exerwa CTF" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "022c995a-f1ba-498f-b67e-92ef01fd06a3", + "value": "HelloKitty" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "1496ec2f-76b0-425b-badc-8b7749c7e370", + "value": "HolidayCheer" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "d4733b99-e1d7-4101-9653-65d8ed73bd47", + "value": "Joker Korean" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "c0222809-cffa-467b-a9b1-b7caaf238b14", + "value": "VenomRAT" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "2a2f3d8f-83c1-490b-94d1-b56b90e81d19", + "value": "FileEngineering" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "uuid": "77714a96-6242-416a-ba6e-a1080e71cd81", + "value": "LandSlide" + }, + { + "description": "ransomware", + "meta": { + "date": "November 2020" + }, + "related": [ + { + "dest-uuid": "681f212a-af1b-4e40-a718-81b0dc46dc52", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8fa6b51a-a48d-48dc-87ec-cf0d30ad66e8", + "value": "Mobef-JustFun" + }, + { + "description": "ransomware", + "meta": { + "date": "December 2020", + "ransomnotes": [ + "All your files have been encrypted\n\nContact us to this email to decrypt your files:\nancrypted1@gmail.com\nIn case of of no answer in 24 hours contact the secondary email:\nancrypted1@gmail.com\n\nYou can unlock them by buying the special key generated for you\n\nFree decryption as guarantee\nBefore paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived),and files should not contain valuable information. (databases,backups,large excel sheets, etc.)\n\n\nPayment is possible only with bitcoin\n\nHow to obtain bitcoins\nThe easoway to buy bitcoins is LocalBitcoins site. you have to register, click ?Buy bitcoins?, and select the seller by payment method and price.\nHttps://localbitcoins.com/buy_bitcoins\nAlso you can fund other places to buy Bitcoins and beginners guide here:\nHttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\n\nAttention !!!\n1. Do not rename encrypted files.\n2. Do not try to decrypt your data using third party softwares, it may cause permanent data loss.\n3. Decryption or your files with the help of third parties may cause increased price(they add their fee to ours) or you can become a victim of a scam" + ], + "refs": [ + "https://malware-guide.com/blog/remove-amjixius-ransomware-restore-encrypted-files" + ], + "synonyms": [ + "Ancrypted" + ] + }, + "uuid": "1efe19b7-a8f3-455b-aefc-a41a5788bf2c", + "value": "Amjixius" + }, + { + "description": "ransomware", + "meta": { + "date": "Mars 2021" + }, + "uuid": "c99e4aee-03f7-4cb6-b1ce-2394d00d1472", + "value": "DearCry" + }, + { + "description": "ransomware", + "meta": { + "date": "Mars 2021" + }, + "uuid": "0353ecc5-849c-44a1-9ace-bff14e358c7a", + "value": "JoJoCrypter" + }, + { + "description": "ransomware", + "meta": { + "date": "Mars 2021" + }, + "uuid": "3742b551-b7e8-4256-81fa-137a05693bb8", + "value": "RunExeMemory" + }, + { + "description": "ransomware", + "meta": { + "date": "Febuary 2021" + }, + "uuid": "b0b690c4-b0d3-4e5e-a855-474f312287dc", + "value": "Pay2Decrypt" + }, + { + "description": "ransomware", + "meta": { + "date": "Febuary 2021" + }, + "uuid": "c7da6edc-dd6a-4e7b-8ce2-2f97a98f6efb", + "value": "Tortoise" + }, + { + "description": "ransomware", + "meta": { + "date": "Febuary 2021" + }, + "uuid": "401a8f57-7bf6-4a2a-834c-896bc29aa73f", + "value": "EPICALLY" + }, + { + "description": "ransomware", + "meta": { + "date": "Febuary 2021" + }, + "uuid": "52a907ab-f38b-4144-ba13-cab33adaab38", + "value": "Random30" + }, + { + "description": "ransomware", + "meta": { + "date": "Febuary 2021" + }, + "uuid": "419955fb-cfe6-4eba-b2ec-de53f4266e25", + "value": "Hog" + }, + { + "description": "ransomware", + "meta": { + "date": "Febuary 2021" + }, + "uuid": "f4c25d90-fea1-4bf5-8128-108f4ed279e4", + "value": "Steel" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "8a12618d-caf0-4b97-a4d8-fb475820d6f1", + "value": "JohnBorn" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "8018e133-c4c9-4a1b-bf39-5007c35c0a54", + "value": "Egalyty" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "b7e0a8c9-ffac-416e-8c8e-1670f3b3729f", + "value": "Namaste" + }, + { + "description": "ransomware", + "meta": { + "date": "Febuary 2021" + }, + "uuid": "570382c4-7b30-4f05-a385-e0691e0abfbc", + "value": "HDLocker" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "d2776f0d-29d6-45a2-be76-9072c52ce7cc", + "value": "Epsilon" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "34865f14-c5b4-42b8-9cc1-e1325dbe0d23", + "value": "DeroHE" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "29a61b85-4c63-46b0-bca0-32525ba1c56b", + "value": "Vovalex" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "93e45f39-ee69-4907-b7c7-2eb406313b53", + "value": "Bonsoir" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "91381710-823e-4eb6-a52f-28ab163638f3", + "value": "PulpFictionQuote" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "8fc25ce2-a5f7-49dc-8480-2a7a2cb60606", + "value": "NAS Data Compromiser" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "7f3e44d7-cccb-4fc7-86c6-006d25dc3c5d", + "value": "CNH" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "5a7d70c5-c5a2-4f00-be6d-a7499ca350f1", + "value": "Lucy" + }, + { + "description": "ransomware", + "meta": { + "date": "December 2020", + "synonyms": [ + "OctEncrypt" + ] + }, + "uuid": "e0189c0e-8da9-4e48-9c09-9cb8d8eb2a8b", + "value": "OCT" + }, + { + "description": "ransomware", + "meta": { + "date": "December 2020" + }, + "uuid": "556f7792-ed79-42cf-9912-865319e10d48", + "value": "Pump" + }, + { + "description": "ransomware", + "meta": { + "date": "December 2020" + }, + "uuid": "33edc2a9-231d-4a41-8dd8-ea9697dd0e13", + "value": "LuciferCrypt" + }, + { + "description": "ransomware", + "meta": { + "date": "December 2020" + }, + "uuid": "28ca283a-221f-4e8a-bcc3-feddd67991dc", + "value": "Ziggy" + }, + { + "description": "ransomware", + "meta": { + "date": "December 2020" + }, + "uuid": "0aed6d0e-6ecc-4295-a5ef-90389f1f00f9", + "value": "CoderCrypt" + }, + { + "description": "ransomware", + "meta": { + "date": "December 2020" + }, + "uuid": "97ac3893-4331-454f-882f-1dcd9f2c6bcb", + "value": "BlueEagle" + }, + { + "description": "ransomware", + "meta": { + "date": "December 2020" + }, + "uuid": "e8c800ce-c8e3-4176-87c9-8a0c48a9b5e4", + "value": "Povisomware" + }, + { + "description": "ransomware", + "meta": { + "date": "December 2020" + }, + "uuid": "dd5712e1-efa8-4054-a5df-fdfdbc9c25b6", + "value": "JCrypt" + }, + { + "description": "ransomware", + "meta": { + "date": "December 2020" + }, + "uuid": "9a2ecc67-6462-4d6e-9f18-eacc097ce6c7", + "value": "Uh-Oh" + }, + { + "description": "ransomware", + "meta": { + "date": "December 2020" + }, + "uuid": "b539d0d8-1dad-4874-b743-e07063f8907e", + "value": "Mijnal" + }, + { + "meta": { + "date": "December 2020" + }, + "uuid": "440f9a8e-9837-433a-b2f3-c6a6914146ef", + "value": "16x" + }, + { + "description": "ransomware", + "meta": { + "date": "December 2020" + }, + "uuid": "ac805a25-0b35-4c3e-82a5-2c8d19a53294", + "value": "Lockedv1" + }, + { + "description": "ransomware", + "meta": { + "date": "JanuaryJ 2021" + }, + "uuid": "658dbbb2-c596-4ca0-a085-7b41f1fcebd0", + "value": "XD Locker" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "c47eb2fa-9fe2-42b8-8339-49e4de7296e2", + "value": "Knot" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "390fc4fc-9f46-480a-b114-aba898564c8a", + "value": "Parasite" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "9d43444d-205b-4fac-81a8-2affd49b1eb6", + "value": "Judge" + }, + { + "description": "ransomware", + "meta": { + "date": "January 2021" + }, + "uuid": "f84b92bb-d8e8-4ddd-848c-1a91df504e8e", + "value": "DEcovid19" } ], - "version": 95 + "version": 96 } From f5713a8d87597f1d3a30cb016aaf57dfffff6331 Mon Sep 17 00:00:00 2001 From: Delta-Sierra Date: Mon, 19 Apr 2021 14:53:36 +0200 Subject: [PATCH 3/3] Removing unexpected line --- clusters/ransomware.json | 1 - 1 file changed, 1 deletion(-) diff --git a/clusters/ransomware.json b/clusters/ransomware.json index 4423bb0..5db8ca2 100644 --- a/clusters/ransomware.json +++ b/clusters/ransomware.json @@ -18405,7 +18405,6 @@ }, { "description": "ransomware", - "expanded": "Cat22", "uuid": "e3cce543-64b0-4f7a-a176-f1ddc429da3f", "value": "GammA" },