{ "authors": [ "https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml", "http://pastebin.com/raw/GHgpWjar", "MISP Project", "https://id-ransomware.blogspot.com/2016/07/ransomware-list.html" ], "category": "tool", "description": "Ransomware galaxy based on https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml and http://pastebin.com/raw/GHgpWjar", "name": "Ransomware", "source": "Various", "type": "ransomware", "uuid": "10cf658b-5d32-4c4b-bb32-61760a640372", "values": [ { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES", "extensions": [ "RANDOM 3 LETTERS ARE ADDED" ], "payment-method": "Bitcoin", "price": "1(300$)", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-OkiR6pVmYUw/WMFiLGPuJhI/AAAAAAAAEME/wccYzFDIzJYWKXVxaTQeB4vM-4X6h3atgCLcB/s1600/note-nhtnwcuf.gif" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/nhtnwcuf-ransomware.html" ] }, "uuid": "81b4e3ac-aa83-4616-9899-8e19ee3bb78b", "value": "Nhtnwcuf Ransomware (Fake)" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES", "extensions": [ "RANDOM 3 LETTERS ARE ADDED" ], "payment-method": "Bitcoin", "price": "250 €", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-pSmSehFx0bI/WL8Rp7RoMHI/AAAAAAAAEKw/eyfsAjikl9sDHlcjdyQeRxZsLto4hxvGwCLcB/s1600/note-1-2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/cryptojacky-ransomware.html", "https://twitter.com/jiriatvirlab/status/838779371750031360" ] }, "uuid": "a8187609-329a-4de0-bda7-7823314e7db9", "value": "CryptoJacky Ransomware" }, { "description": "About: This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES-128", "payment-method": "Bitcoin", "price": "1", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-yTOgGw5v_vo/WMBUGHN7bnI/AAAAAAAAELY/8DDyxB4pSWgje_-iVbXgy2agNty1X6D6ACLcB/s1600/C6TUfkZWAAEewi_.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/kaenlupuf-ransomware.html" ] }, "uuid": "b97f07c4-136a-488a-9fa0-35ab45fbfe36", "value": "Kaenlupuf Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES-256", "extensions": [ "example:.encrypted.contact_here_me@india.com.enjey" ], "payment-method": "Bitcoin", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-rkOR4L9jDZc/WMG1uI6vqQI/AAAAAAAAEMk/SAu_FleTLHcagf_maS31xt3D_qnwAx2RQCLcB/s1600/note-enjey_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/enjey-crypter-ransomware.html", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-march-10th-2017-spora-cerber-and-technical-writeups/", "https://www.bleepingcomputer.com/news/security/embittered-enjey-ransomware-developer-launches-ddos-attack-on-id-ransomware/" ] }, "uuid": "e98e6b50-00fd-484e-a5c1-4b2363579447", "value": "EnjeyCrypter Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES-128", "ransomnotes": [ "DANGEROUS_RANSOM\nHacked.\nPlease contact\nhakermail@someting.com" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/dangerous-ransomware.html" ] }, "uuid": "7dbdb949-a53b-4ebe-bc9a-7f49a7c5fd78", "value": "Dangerous Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "extensions": [ ".aes" ], "payment-method": "Dollars", "price": "199", "ransomnotes": [ "Vortex Ransomware\nCan not find the files on the hard drive? The contents of the files do not open?This is the result of the work of the program, which encrypts a lot of your data with the help of a strong algorithm AES-256, used by power structures to mask the data transferred in electronic form.The only way to recover your files is to buy a decryption program from us, using a one-time key created for you!When you decide to restore your data, please contact us by e-mail: rsapl@openmailbox.org or poiskiransom@airmail.cc2 files will be decrypted in vain to prove that we can do it, for the others, unfortunately, have to pay!\nPrice for the decryption of all files: $ 199\nAttention! Do not waste your time,time is money, after 4 days the price will increase by 100%!\nIP = ID =" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/vortex-ransomware.html", "https://twitter.com/struppigel/status/839778905091424260" ], "synonyms": [ "Ŧl๏tєгค гคภร๏๓ฬคгє" ] }, "uuid": "04a5889d-b97d-4653-8a0f-d2df85f93430", "value": "Vortex Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES-128", "extensions": [ ".fuck_you" ], "payment-method": "Bitcoin", "price": "0,0361312 (50$)", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-i4i0joM4qRk/WMO7sKLu4dI/AAAAAAAAENU/vLR4B1Xg39wduycHe2f0vEYSv_dtJ-gxwCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/gc47-ransomware.html" ] }, "uuid": "2069c483-4701-4a3b-bd51-3850c7aa59d2", "value": "GC47 Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. ", "meta": { "date": "March 2017", "encryption": "AES-128", "extensions": [ ".enc", ".ENC" ], "payment-method": "Bitcoin", "price": "10000 Rubles (135€)", "ransomnotes": [ "OUR FILES are encrypted (EVEN NOT LOOKING THAT THEY ARE PARTIALLY OPEN). WE HAVE YOUR LOGIN AND PASSWORD FROM THE ENTERTAINMENT, ONE-CLASSICS, ONLINE BANKS AND OTHERS.\nYOU HAVE 6 HOURS TO PAY FOR A PURCHASE FOR THEM, OTHERWISE WE SHOULD PUT INTO OPEN ACCESS!\nINSTRUCTION:\n1) Find 10 000 (10 thousand) rubles, not less. Suitable for the following - (Qiwi, Sberbank, Yandex.Money, Tinkoff Bank, VTB, but better Qiwi (faster)\n2) In the browser, open the site https://x-pay.cc/ - through this site you will transfer money\n3) In the column I DELETE where you will translate (according to item 1) and above enter the amount - 10,000 rubles.\n4) In the RIGHT I select Bitcoin and on top the amount should automatically be transferred tobtc\n5) In the column DATA ENTRY, fill in your requisites from where you will pay and where to transfer (Bitcoin wallet)\nATTENTION-ATTENTION,CORRECTly copy this number to a purse (yes, it's so strange)3FjtFZWjyj46UcfDY4AiUrEv7wLtyzZv5o After inserting, carefully, again check whether it is copied correctly.\n6) Click on GO TO PAY and follow the instructions on the site.\nIn a couple of hours we'll write you on the desktop and return everything to you.\nIf there are difficulties, then write on the mailbox - aoneder@mail.ru" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/rozalocker-ransomware.html", "https://twitter.com/jiriatvirlab/status/840863070733885440" ], "synonyms": [ "Roza" ] }, "uuid": "f158ea74-c8ba-4e5a-b07f-52bd8fe30888", "value": "RozaLocker Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES-128", "extensions": [ ".enc" ], "payment-method": "Bitcoin", "price": "0.1", "ransomnotes": [ "Blocked Your computer has been blocked All your files are encrypted. To access your PC, you need to send to Bitcoin at the address below loading Step 1: Go to xxxxs : //wvw.coinbase.com/ siqnup Step 2: Create an account and follow the instructions Step 3: Go to the \"Buy Bitcoins\" section and then buy Bitcoin Step 4: Go to the \"Send\" section, enter the address above and the amount (0.1 Bitcoin) Step 5: Click on the button below to verify the payment, your files will be decrypted and the virus will disappear 'Check' If you try to bypass the lock, all files will be published on the Internet, as well as your login for all sites." ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/cryptomeister-ransomware.html" ] }, "uuid": "4c76c845-c5eb-472c-93a1-4178f86c319b", "value": "CryptoMeister Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Poses as Hewlett-Packard 2016", "meta": { "date": "March 2017", "encryption": "AES-128", "extensions": [ ".GG" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/gg-ransomware.html" ] }, "uuid": "f62eb881-c6b5-470c-907d-072485cd5860", "value": "GG Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES-128", "extensions": [ ".Project34" ], "payment-method": "MoneyPak", "price": "300$", "ransomnotes": [ "(TRANSLATED BY THE SITE EDITOR) YOUR FILES HAVE BEEN LOCKED WITH A PASSWORD TO GET THE PASSWORD WRITE TO US AT project34@india.com WE WILL RESPOND TO YOU WITHIN 20 HOURS IN A MESSAGE, SPECIFY YOUR IP ADDRESS. YOU CAN FIND OUT AT 2IP.RU" ], "ransomnotes-filenames": [ "ПАРОЛЬ.txt" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/project34-ransomware.html" ] }, "uuid": "4af0d2bd-46da-44da-b17e-987f86957c1d", "value": "Project34 Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES-128", "payment-method": "Bitcoin", "price": "300$", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-ZbWrN1LR-14/WMhPB7M8LBI/AAAAAAAAERQ/ZGG3RDHd8V0hwK_pf-vYChTn9VRpLBgNQCLcB/s1600/petya-based_ru_3.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/petrwrap-ransomware.html", "https://www.bleepingcomputer.com/news/security/petrwrap-ransomware-is-a-petya-offspring-used-in-targeted-attacks/", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-march-17th-2017-revenge-petrwrap-and-captain-kirk/", "https://securelist.com/blog/research/77762/petrwrap-the-new-petya-based-ransomware-used-in-targeted-attacks/" ] }, "uuid": "e11da570-e38d-4290-8a2c-8a31ae832ffb", "value": "PetrWrap Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. RaaS, baed on HiddenTear", "meta": { "date": "March 2017", "encryption": "AES-128", "extensions": [ ".grt" ], "payment-method": "Bitcoin", "price": "1.2683", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-OmuOKzLOHnw/WMl74fSSaJI/AAAAAAAAESg/4CsOYOSuUeEhsO4jSi6k10sbb_1NnfYxACLcB/s1600/lock-screen.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-march-17th-2017-revenge-petrwrap-and-captain-kirk/", "https://id-ransomware.blogspot.co.il/2017/03/karmen-ransomware.html", "https://twitter.com/malwrhunterteam/status/841747002438361089" ] }, "uuid": "da7de60e-0725-498d-9a35-303ddb5bf60a", "value": "Karmen Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. CryptoMix / CryptFile2 Variant", "meta": { "date": "March 2017", "encryption": "AES-256 + RSA-1024", "extensions": [ ".REVENGE" ], "ransomnotes": [ "===ENGLISH=== All of your files were encrypted using REVENGE Ransomware. The action required to restore the files. Your files are not lost, they can be returned to their normal state by decoding them. The only way to do this is to get the software and your personal decryption key. Using any other software that claims to be able to recover your files will result in corrupted or destroyed files. You can purchase the software and the decryption key by sending us an email with your ID. And we send instructions for payment. After payment, you receive the software to return all files. For proof, we can decrypt one file for free. Attach it to an e-mail." ], "ransomnotes-filenames": [ "# !!!HELP_FILE!!! #.txt" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-KkPVDxjy8tk/WM7LtYHmuAI/AAAAAAAAEUw/kDJghaq-j1AZuqjzqk2Fkxpp4yr9Yeb5wCLcB/s1600/revenge-note-2.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/revenge-ransomware-a-cryptomix-variant-being-distributed-by-rig-exploit-kit/", "https://id-ransomware.blogspot.co.il/2017/03/revenge-ransomware.html" ] }, "uuid": "987d36d5-6ba8-484d-9e0b-7324cc886b0e", "value": "Revenge Ransomware" }, { "description": "his is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES", "extensions": [ ".encrypted" ], "payment-method": "Bitcoin", "price": "150$", "ransomnotes": [ "FILES NUMBERED Your local drives, network folders, your external drives are encrypted using 256-bit encryption technology, this means your files are encrypted with a key. They cannot be opened without buying a decryption program and a private key, after the purchase, our program decrypts all your files and they will work like before. If you do not buy the program within 24 hours, then all your files will be permanently deleted. See the \"My Documents\" folder for more information in the file \"Beni Oku.txt\". Contact address: d3crypt0r@lelantos.org BTC address: 13hp68keuvogyjhvlf7xqmeox8dpr8odx5 You have to pay at BTC to the above address $ 150 Bitcoin You can do this by purchasing Bitcoinat www.localbitcoins.co Information: Using a computer recovery does not help. Antivirus scanning does not help to recover files, but can lead to loss." ], "ransomnotes-filenames": [ "Beni Oku.txt" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-ccU4txzjpWg/WMl33c7YD3I/AAAAAAAAESU/moLHgQnVMYstKuHKuNgWKz8VbNv5ECdzACLcB/s1600/lock-note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/turkish-fileencryptor.html", "https://twitter.com/JakubKroustek/status/842034887397908480" ], "synonyms": [ "Fake CTB-Locker" ] }, "uuid": "a291ac4c-7851-480f-b317-e977a616ac9d", "value": "Turkish FileEncryptor Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Payments in Monero", "meta": { "date": "March 2017", "encryption": "AES+RSA", "extensions": [ ".kirked", ".Kirked" ], "payment-method": "Monero", "price": "1100 roupies (14€)", "ransomnotes": [ "!IMPORTANT ! READ CAREFULLY: Your computer has fallen victim to the Kirk malware and important files have been encrypted - locked up so they don't work. This may have broken some software, including games, office suites etc. Here's a list of some the file extensions that were targetted : *** There are an additional 441 file extensions that are targetted\n. They are mostly to do with games. To get your files back, you need to pay. Now. Payments\nrecieved more than 48 hours after the time of infection will be charged double. Further time penalties are listed below. The time of infection has been logged. Any files with the extensions listed above will now have the extra extension '.kirked\n', these files are encrypted using military grade encryption.In the place you ran this program from, you should find a note (named RANSOM_NOTE.txt) similar to this one.\nYou will also find a file named 'pwd' - this is your encrypted password file. Although it was generated by your computer, you have no way of ever decrypting it. This is due to the security of both the way it was generated and the way it was encrypted. Your files were encrypted using this password. SPOCK TO THE RESCUE!\n\"Logic, motherfucker.\" ~ Spock.\nDecrypting your files is easy. Take a deep breath and follow the steps below.1) Make the proper payment. Payments are made in Monero. This is a crypto-currency, like bitcoin. You can buy Monero, and send it, from the same places you can any othercrypto-currency. If you're still unsure, google' bitcoin exchange'. Sign up at one of these exchange sites and send the payment to the address below. Make note of the payment / transaction ID, or make one up if you have the option. Payment Address (Monero Wallet): 3000375 -199390 0 0 4AqSwfTexbNaHcn8giSJw3KPiWYHGBaCF9bdgPxvHbd5A8Q3Fc7n6FQCReEns8uEg8jUo4BeB79rwf4XSfQPVL1SKdVp2jz Prices: Days :Monero: Offer Expires\n 0-2 : 50 : 03/18/17 15:32:14\n 3-7 : 100 : 03/23/17 15:32:14\n 8-14 : 200 : 03/30/17 15:32:14\n 15-30 : 500 : 04/15/17 15:32:14 Note: In 31 days your password decryption key gets permanently deleted. You then have no way to ever retrieve your files. So pay now \n2) Email us Send your pwd file as an email attachment to one of the email addresses below. Include the payment ID from step 1. Active email addresses: kirk.help@scryptmail.com kirk.payments@scryptmail.com \n3) Decrypt your files. You will recieve your decrypted password file and a program called 'Spock'. Download these both to the same place and run Spock. Spock reads in your decrypted password file and uses it to decrypt all of the affected files on your computer. > IMPORTANT ! The password is unique to this infection. Using an old password or one from another machine will result in corrupted files. Corrupted files cannot be retrieved. Don't fuck around. \n4) Breathe. \nLIVE LONG AND PROSPER" ], "ransomnotes-filenames": [ "RANSOM_NOTE.txt" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-USLFJX6OMD4/WMwmKIsJnEI/AAAAAAAAETQ/S8uzyHF5mWQZjra6EGBidZ6wqgzrNqIMgCLcB/s1600/full-ransom-note.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/kirkspock-ransomware.html", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-march-17th-2017-revenge-petrwrap-and-captain-kirk/", "https://www.bleepingcomputer.com/forums/t/642239/kirk-ransomware-help-support-topic-kirk-extension-ransom-notetxt/", "http://www.networkworld.com/article/3182415/security/star-trek-themed-kirk-ransomware-has-spock-decryptor-demands-ransom-be-paid-in-monero.html", "http://www.securityweek.com/star-trek-themed-kirk-ransomware-emerges", "https://www.grahamcluley.com/kirk-ransomware-sports-star-trek-themed-decryptor-little-known-crypto-currency/", "https://www.virustotal.com/en/file/39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc/analysis/" ], "synonyms": [ "Kirk & Spock Decryptor" ] }, "uuid": "6e442a2e-97db-4a7b-b4a1-9abb4a7472d8", "value": "Kirk Ransomware & Spock Decryptor" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES", "extensions": [ ".ZINO" ], "payment-method": "Bitcoin", "ransomnotes-filenames": [ "ZINO_NOTE.TXT" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-t1Q-a7sJlag/WMw8MBNIrkI/AAAAAAAAET4/aycY-m5GXVYQjcbZJ8N0kIfUZ3onYt8AgCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/zinocrypt-ransomware.html", "https://twitter.com/demonslay335?lang=en", "https://twitter.com/malwrhunterteam/status/842781575410597894" ] }, "uuid": "719c8ba7-598e-4511-a851-34e651e301fa", "value": "ZinoCrypt Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Uses @enigma0x3's UAC bypass", "meta": { "date": "March 2017", "encryption": "AES", "extensions": [ ".crptxxx" ], "ransomnotes-filenames": [ "HOW_TO_FIX_!.txt" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-itq9nR2EedY/WM2OPtDKCgI/AAAAAAAAEUI/KcC8vtnmlHENz0CSOvxqoYeZL8qdx1IZgCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/crptxxx-ransomware.html", "https://www.bleepingcomputer.com/forums/t/609690/ultracrypter-cryptxxx-ultradecrypter-ransomware-help-topic-crypt-cryp1/page-84", "http://www.fixinfectedpc.com/uninstall-crptxxx-ransomware-from-pc", "https://twitter.com/malwrhunterteam/status/839467168760725508" ] }, "uuid": "786ca8b3-6915-4846-8f0f-9865fbc295f5", "value": "Crptxxx Ransomware" }, { "description": "About: This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "extensions": [ ".enc" ], "payment-method": "Bitcoin", "price": "2", "ransomnotes-filenames": [ "motd.txt" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-suCNGXgzWuM/WM7HPujx_qI/AAAAAAAAEUk/gIvzbsbB_BUrBmmBsgpb_8w7zjwudu_mACLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/motd-ransomware.html", "https://www.bleepingcomputer.com/forums/t/642409/motd-of-ransome-hostage/", "https://www.bleepingcomputer.com/forums/t/642409/motd-ransomware-help-support-topics-motdtxt-and-enc-extension/" ] }, "uuid": "5d1a3631-165c-4091-ba55-ac8da62efadf", "value": "MOTD Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES", "extensions": [ ".devil" ], "payment-method": "Dollars", "price": "20 - 100", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-i5iUwC8XWDo/WM7dSVNQ8UI/AAAAAAAAEVY/uXmUErkLgHcWbfpdw1zGTvwY9DimiAH8wCLcB/s1600/lock-panel.jpg", "https://1.bp.blogspot.com/-9ovaMSUgtFQ/WM7dXo84tlI/AAAAAAAAEVc/_Zx9gZuvHA0tU9-jtzP492bXa5fQiL7kgCLcB/s1600/key-price.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/cryptodevil-ransomware.html", "https://twitter.com/PolarToffee/status/843527738774507522" ] }, "uuid": "f3ead274-6c98-4532-b922-03d5ce4e7cfc", "value": "CryptoDevil Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on HiddenTear", "meta": { "date": "February 2017", "encryption": "AES-256+RSA", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-QuBYcLAKRPU/WLnE3Rn3MhI/AAAAAAAAEH4/WnC5Ke11j4MO7wmnfqBhtA-hpx6YN6TBgCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/fabsyscrypto-ransomware.html", "https://twitter.com/struppigel/status/837565766073475072" ] }, "uuid": "e4d36930-2e00-4583-b5f5-d8f83736d3ce", "value": "FabSysCrypto Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES+RSA", "extensions": [ "[file_name.file_ext].id-[UserID]__contact_me_lock2017@protonmail.com_or_lock2017@unseen.is" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-FllHGqIx_JQ/WL1QF2uMCCI/AAAAAAAAEJQ/Fn-8j2t8dwgSo8YTHM1iOkL-3U_hbcaKwCLcB/s1600/Note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/lock2017-ransomware.html" ] }, "uuid": "cf47a853-bc1d-42ae-8542-8a7433f6c9c2", "value": "Lock2017 Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES", "extensions": [ ".Horas-Bah" ], "payment-method": "Bitcoin", "price": "0.5", "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/redants-ransomware.html" ] }, "uuid": "dd3601f1-df0a-4e67-8a20-82e7ba0ed13c", "value": "RedAnts Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "0.5", "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/consoleapplication1-ransomware.html" ] }, "uuid": "4c3788d6-30a9-4cad-af33-81f9ce3a0d4f", "value": "ConsoleApplication1 Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "March 2017", "encryption": "AES", "extensions": [ ".kr3" ], "payment-method": "no ransom", "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/krider-ransomware.html", "https://twitter.com/malwrhunterteam/status/836995570384453632" ] }, "uuid": "f5ac03f1-4f6e-43aa-836a-cc7ece40aaa7", "value": "KRider Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. The following note is what you get if you put in the wrong key code: https://3.bp.blogspot.com/-qsS0x-tHx00/WLM3kkKWKAI/AAAAAAAAEDg/Zhy3eYf-ek8fY5uM0yHs7E0fEFg2AXG-gCLcB/s1600/failed-key.jpg", "meta": { "date": "February 2017", "payment-method": "Bitcoin", "price": "0.5 (300$)", "refs": [ "https://id-ransomware.blogspot.co.il/search?updated-min=2017-01-01T00:00:00-08:00&updated-max=2018-01-01T00:00:00-08:00&max-results=50" ] }, "uuid": "44f6d489-f376-4416-9ba4-e153472f75fc", "value": "CYR-Locker Ransomware (FAKE)" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "encryption": "AES", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "0.1", "ransomnotes": [ "DotRansomware Setup Guide \nAttention!!! \nWe recommend you to build your ransomware inside virtual machine! (But it is safe to use builder on your PC, just don't run builded exe file on your PC!) \nRecommendation: If you have got possibility to run ransomware on victim's computer with administrator privileges then do it. Because it will provide better conversion. Recommended decryption price: 0.1 Recommended special decryption prices: FR|0.15|FI|0.15|IE|0.15|IS|0.15|AU|0.15|BE|0.15|CA|0.15|AT|0.15|DK|0.15|SE|0.15|DE|0.15|NL|0.15|SA|0.2|US|0.2|HK|0.2|LU|0.2|CH|0.2|NO|0.2|AE|0.2|SG|0.2|KW|0.2|MO|0.2|QA|0.2 Recommended attacked extensions: *** Recommendation: You need to test builded exe file inside virtual machine, because operability can be broken after crypt/pack of core! \nLinks to website: ***" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-BoKI2-Lhsp8/WLHq34zCtdI/AAAAAAAAECo/YkfIG29vRRsLvdn51ctrMEypptRzZS2IgCLcB/s1600/raas.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/dotransomware.html" ] }, "uuid": "0570e09d-10b9-448c-87fd-c1c4063e6592", "value": "DotRansomware" }, { "description": "About: This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments.All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "encryption": "AES", "extensions": [ ".locked-[3_random_chars]" ], "payment-method": "Bitcoin", "price": "0.01 - 0.06", "ransomnotes-filenames": [ "ReadMe-[3_random_chars].html" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-92aP_sumdLo/WLAy3D2kLvI/AAAAAAAAEAQ/FA1j--rOIygsNbDAWqrDqufT7zSwuEnvQCLcB/s1600/note-html_2.png", "https://3.bp.blogspot.com/-E1vV0sqaw2o/WLB1OvOLCPI/AAAAAAAAEAg/D4OkAOBT_uM4DeVS1hAu6eBGcmga8CSYwCLcB/s1600/site1.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/unlock26-ransomware.html", "https://www.bleepingcomputer.com/news/security/new-raas-portal-preparing-to-spread-unlock26-ransomware/" ] }, "uuid": "37b9a28d-8554-4233-b130-efad4be97bc0", "value": "Unlock26 Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Python Ransomware", "meta": { "date": "February 2017", "encryption": "AES", "extensions": [ ".EnCrYpTeD" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "READ_ME_TO_DECRYPT.txt" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/pickles-ransomware.html", "https://twitter.com/JakubKroustek/status/834821166116327425" ], "synonyms": [ "Pickles" ] }, "uuid": "87171865-9fc9-42a9-9bd4-a453f556f20c", "value": "PicklesRansomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. This ransomware poses at MSOffice to fool users into opening the infected file. GO Ransomware", "meta": { "date": "February 2017", "encryption": "ChaCha20 and Poly1305", "payment-method": "Bitcoin", "price": "1", "ransomnotes": [ "NOT YOUR LANGUAGE? https://translate.google.com Your personal files and documents have been encrypted withAES-256 and RSA-2048! Decrypting your files is only possible with decrypt key stored on our server. Price for key is % bitcoin % BTC (Bitcoin).\n1. Send % bitcoin % BTC to % bitcoinaddress % http://www.coindesk.com/information/how-can-i-buy-bitcoins/ https://www.bitcoin.com/buy-bitcoin \n2. Wait some time for transaction to process \n3. PRIVATE KEY WILL BE DOWNLOADED AND SYSTEM WILL AUTOMATICALLY DECRYPT YOUR FILES! \nIf you do not pay within % hoursvalid % hours key will become DESTROYED and your files LOST forever! Removing this software will make recovering files IMPOSSIBLE! Disable your antivirus for safety." ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/vanguard-ransomware.html", "https://twitter.com/JAMESWT_MHT/status/834783231476166657" ] }, "uuid": "6a6eed70-3f90-420b-9e4a-5cce9428dc06", "value": "Vanguard Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "encryption": "ChaCha20 and Poly1305", "extensions": [ ".d4nk" ], "ransomnotes": [ "ATTENTION You Have Been Infected With Ransomware. Please Make Note of Your Unique Idenfier : *** " ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/pyl33t-ransomware.html", "https://twitter.com/Jan0fficial/status/834706668466405377" ] }, "uuid": "305cb1fb-d43e-4477-8edc-90b34aaf227f", "value": "PyL33T Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. This is the old VenusLocker in disquise .To delete shadow files use the following commend: C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete&exit https://2.bp.blogspot.com/-8qIiBHnE9yU/WK1mZn3LgwI/AAAAAAAAD-M/ZKl7_Iwr1agYtlVO3HXaUrwitcowp5_NQCLcB/s1600/lock.jpg", "meta": { "date": "February 2017", "encryption": "AES-128", "extensions": [ ".trumplockerf", ".TheTrumpLockerf", ".TheTrumpLockerfp" ], "payment-method": "Bitcoin", "price": "1(50 - 165$)", "ransomnotes-filenames": [ "What happen to my files.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/u/986406/Ransomware/TrumpLocker/TrumpLocker-wallpaper.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/new-trump-locker-ransomware-is-a-fraud-just-venuslocker-in-disguise/", "https://id-ransomware.blogspot.co.il/2017/02/trumplocker.html", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-february-24th-2017-trump-locker-macos-rw-and-cryptomix/" ] }, "uuid": "63bd845c-94f6-49dc-8f0c-22e6f67820f7", "value": "TrumpLocker Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Written in Delphi", "meta": { "date": "February 2017", "encryption": "AES-128 OR Combination of SHA-1 and Blowfish", "extensions": [ ".damage" ], "ransomnotes": [ "TtWGgOd57SvPlkgZ***\n ==========\n end of secret_key \nTo restore your files - send e-mail to damage@india.com" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/damage-ransomware.html", "https://decrypter.emsisoft.com/damage", "https://twitter.com/demonslay335/status/835664067843014656" ] }, "uuid": "fbcb6a4f-1d31-4e31-bef5-e162e35649de", "value": "Damage Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on HiddenTear", "meta": { "date": "February 2017", "encryption": "AES-128", "extensions": [ "your files get marked with: “youarefucked”" ], "payment-method": "Bitcoin", "price": "0.1 - 0.2", "ransomnotes": [ "All your files has been encrypted with RSA-2048 and AES-128. There is no way to decrypt without private key and decrypt program. You can buy the private key and the decrypt program just for 0.2 BTC (Bitcoin) You have 48 hours to buy it. After that, your private key will gone and we can't guarantee to decrypt.Email me for more information about how to buy it at cyberking@indonesianbacktrack.or.id" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/xyzware-ransomware.html", "https://twitter.com/malwrhunterteam/status/833636006721122304" ] }, "uuid": "f0652feb-a104-44e8-91c7-b0435253352b", "value": "XYZWare Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "encryption": "AES-128", "extensions": [ "your files get marked with: “youarefucked”" ], "payment-method": "Bitcoin", "price": "0.1 (250$)", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-S0-Bop8XUgk/WLD_RVgldgI/AAAAAAAAEBU/r2LmgjTHUbMTtIKGH2pHdKfFXcUEOQdMgCLcB/s1600/lock-act2.png" ], "refs": [ "https://www.enigmasoftware.com/youarefuckedransomware-removal/" ], "synonyms": [ "FortuneCrypt" ] }, "uuid": "912af0ef-2d78-4a90-a884-41f3c37c723b", "value": "YouAreFucked Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. ", "meta": { "date": "February 2017", "encryption": "AES", "payment-method": "Bitcoin", "price": "0.5 - 0.7", "ransomnotes-filenames": [ "How decrypt files.hta" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-M2CMU8RPgqw/WLfqOCgNXrI/AAAAAAAAEGA/W-uAf30qQgoZxqRwblUcSKzYrM5QmcLfgCLcB/s1600/note-html_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/cryptconsole-2-ransomware.html", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-8th-2018-crybrazil-cryptconsole-and-magniber/" ] }, "uuid": "7343da8f-fe18-46c9-8cda-5b04fb48e97d", "value": "CryptConsole 2.0 Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on HiddenTear", "meta": { "date": "February 2017", "encryption": "AES", "extensions": [ ".barRex", ".BarRax" ], "payment-method": "Bitcoin", "price": "0.5", "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/barraxcrypt-ransomware.html", "https://twitter.com/demonslay335/status/835668540367777792" ], "synonyms": [ "BarRaxCrypt Ransomware" ] }, "uuid": "c0ee166e-273f-4940-859c-ba6f8666247c", "value": "BarRax Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "encryption": "AES", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-hvTBarxSO8Y/WKs5kjdpgDI/AAAAAAAAD9Q/m3louiSE6xY0BcGjnWvg_NNDU6K1ok3ggCLcB/s1600/lock.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/cryptolocker-by-ntk-ransomware.html" ] }, "uuid": "51bcbbc6-d8e0-4d2b-b5ce-79f26d669567", "value": "CryptoLocker by NTK Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "encryption": "AES-256+RSA", "extensions": [ ".ENCR" ], "payment-method": "Bitcoin", "price": "0.8 - 2", "ransomnotes": [ "All of your personal information, unfortunately for you, were encrypted\nStep 1 - PAYMENT\nStep 2 - Tell us\nStep 3 - Data Recovery\nYour data and files were encrypted, unfortunately, you need our key. For the encryption each key is unique AES-256 is created on the computer. At the moment, all the files are already encrypted and the keys securely stored in an encrypted form with RSA-2048. \nOnly one way you can recover your files - make payment in Bitcoins and get our key for decryption. Do not believe in any fairy tales on the Internet, it can be circumvented if it was easy, a lot of things in the world stopped working. \nPay according to the instructions, click through the tabs, and wait for your keys. We value the market professional customer service and reputation, so will try to unlock your files as soon as possible.\nPayment Amount: 0,8 BTC\nPayment Amount: 2.1 BTC (another option)" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-0D8XdlTNIsA/WLXFiBWz5II/AAAAAAAAEFQ/Hojw0BHHysUieiCnidoVwTrqXVCckLkSQCLcB/s1600/lock-screen.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/userfileslocker-ransomware.html" ], "synonyms": [ "CzechoSlovak Ransomware" ] }, "uuid": "c9e29151-7eda-4192-9c34-f9a81b2ef743", "value": "UserFilesLocker Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. PAYING RANSOM IS USELESS, YOUR FILES WILL NOT BE FIXED. THE DAMAGE IS PERMENENT!!!!", "meta": { "date": "February 2017", "encryption": "AES-256+RSA", "extensions": [ ".A9v9Ahu4-000" ], "payment-method": "Bitcoin", "price": "6", "refs": [ "https://id-ransomware.blogspot.co.il/2017_03_01_archive.html", "https://id-ransomware.blogspot.co.il/2017/03/avastvirusinfo-ransomware.html" ] }, "uuid": "78649172-cf5b-4e8a-950b-a967ff700acf", "value": "AvastVirusinfo Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "encryption": "AES", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-OCBIabrrZNg/WLm1RGFVKEI/AAAAAAAAEHY/1MASb-0Y7jsBlE2TzyqgknrfDhuEsNx2gCLcB/s1600/Screenshot_1.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/03/suchsecurity-ransomware.html" ], "synonyms": [ "Such Security" ] }, "uuid": "22481dfd-8284-4071-a76f-c9a4a5f43f00", "value": "SuchSecurity Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "encryption": "AES-256", "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-viZiAZr3_ns/WKrIDWEEBXI/AAAAAAAAD8c/8n1RJ9m2Odoe3bvMMmIm421NdxS-OIRzQCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/vhd-ransomware.html" ], "synonyms": [ "VHDLocker Ransomware" ] }, "uuid": "9de7a1f2-cc21-40cf-b44e-c67f0262fbce", "value": "PleaseRead Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "extensions": [ "[KASISKI]" ], "payment-method": "Dollars", "price": "500", "ransomnotes-filenames": [ "INSTRUCCIONES.txt" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-ehXlWPLxtR8/WKdHF_Y-MeI/AAAAAAAAD5A/KKXO-S9OtMQAcNM-IOV2ees8qKlAJ3pzACLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/kasiski-ransomware.html", "https://twitter.com/MarceloRivero/status/832302976744173570", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-february-17th-2017-live-hermes-reversing-and-scada-poc-ransomware/" ] }, "uuid": "59b537dc-3764-42fc-a416-92d2950aaff1", "value": "Kasiski Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "encryption": "AES", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes": [ "Files has been encrypted with Locky Ransomware, Do not alter your files or you will not be able to recover anything nobody will be able to recover your data since its set to AES-256 and requires our Key Send me 1.0 bitcoins Send payment to this Address: 13DYdAKb8nfo1AYeGpJXwKZYupyeqYu2QZ For Instructions on how to Purchase & send bitcoin refer to this link : *** for support Email: lockyransomware666@sigaint.net After 48 Hours your ransom doubles to 2.0 BTC After 72 Hours we will delete your recovery keys" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-locky-ransomware-encrypts-local-files-and-unmapped-network-shares/", "https://id-ransomware.blogspot.co.il/2017/02/locky-impersonator.html", "https://www.bleepingcomputer.com/news/security/locky-ransomware-switches-to-thor-extension-after-being-a-bad-malware/" ], "synonyms": [ "Locky Impersonator Ransomware" ] }, "uuid": "26a34763-a70c-4877-b99f-ae39decd2107", "value": "Fake Locky Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. CryptoShield 1.0 is a ransomware from the CryptoMix family.", "meta": { "date": "January 2017", "encryption": "AES(256)/ROT-13", "extensions": [ ".CRYPTOSHIELD (The name is first changed using ROT-13, and after a new extension is added.)" ], "payment-method": "Email", "ransomnotes-filenames": [ "# RESTORING FILES #.txt", "# RESTORING FILES #.html" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-A-N9zQgZrhE/WJHAHzuitvI/AAAAAAAADhI/AHkLaL9blZgqQWc-sTevVRTxVRttbugoQCLcB/s1600/note-2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/cryptoshield-2-ransomware.html", "https://www.bleepingcomputer.com/news/security/cryptomix-variant-named-cryptoshield-1-0-ransomware-distributed-by-exploit-kits/" ] }, "uuid": "1f915f16-2e2f-4681-a1e8-e146a0a4fcdf", "value": "CryptoShield 1.0 Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Filemarker: \"HERMES\"", "meta": { "date": "February 2017", "encryption": "AES", "extensions": [ ".locked" ], "payment-method": "Email - Bitcoin", "ransomnotes": [ "UNIQUE_ID_DO_NOT_REMOVE" ], "ransomnotes-filenames": [ "DECRYPT_INFORMATION.html" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-nzY6thZOXSk/WKbYmWxa0rI/AAAAAAAAD3s/t_3d90FGOe8je8rfeeYLF1jzJinG5JMVgCLcB/s1600/note_2_2.png", "https://3.bp.blogspot.com/-Yisae5e5Pjs/WKbXmIXU8YI/AAAAAAAAD3g/WZs5XzL4l4snT2j4yfc3CAaF7KonH_DQACLcB/s1600/note_1.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/hermes-ransomware.html", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-february-17th-2017-live-hermes-reversing-and-scada-poc-ransomware/", "https://www.bleepingcomputer.com/forums/t/642019/hermes-ransomware-help-support-decrypt-informationhtml/", "https://www.bleepingcomputer.com/news/security/hermes-ransomware-decrypted-in-live-video-by-emsisofts-fabian-wosar/" ] }, "related": [ { "dest-uuid": "4d8da0af-cfd7-4990-b211-af0e9906eca0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "b7102922-8aad-4b29-8518-6d87c3ba45bb", "value": "Hermes Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "encryption": "AES", "extensions": [ ".hasp" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-YdCKWLUFBOo/WKRCD2BLzTI/AAAAAAAAD14/BPtYMLvQpEMAbT-ZdiCVPi_LZCrXYJMhwCLcB/s1600/ReadME%2521.txt.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/lovelock-ransomware.html" ], "synonyms": [ "LoveLock", "Love2Lock" ] }, "uuid": "0785bdda-7cd8-4529-b28e-787367c50298", "value": "LoveLock Ransomware or Love2Lock Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "encryption": "AES", "extensions": [ ".wcry" ], "payment-method": "Bitcoin", "price": "0.1", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-iUq492KUatk/WKH-GXnO4-I/AAAAAAAADzw/9uwo1LF5ciIvMJ6jAn3mskSqtdiTkxvlACLcB/s1600/lock-note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/wcry-ransomware.html" ] }, "uuid": "0983bdda-c637-4ad9-a56f-615b2b052740", "value": "Wcry Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "encryption": "AES", "payment-method": "Bitcoin", "price": "0,3169", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-_Udncaac_gM/WKROBN00ORI/AAAAAAAAD2U/HsHkEspG85YSfPg-8MbPYYTYmBU4PAJAgCLcB/s1600/note_2.png", "https://4.bp.blogspot.com/-Vx9ZtCODajg/WKiMr2QX5cI/AAAAAAAAD64/QAh37o_CRIImaxUfIhoEh8qE4JLn5HaNwCLcB/s1600/dumb.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/dumb-ransomware.html", "https://twitter.com/bleepincomputer/status/816053140147597312?lang=en" ] }, "uuid": "27feba66-e9c7-4414-a560-1e5b7da74d08", "value": "DUMB Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "February 2017", "encryption": "AES", "extensions": [ ".b0C", ".b0C.x" ], "payment-method": "Bitcoin", "price": "0,2", "refs": [ "https://id-ransomware.blogspot.co.il/2017_02_01_archive.html", "https://id-ransomware.blogspot.co.il/2017/02/x-files-ransomware.html" ] }, "uuid": "c24f48ca-060b-4164-aafe-df7b3f43f40e", "value": "X-Files" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The Ransom is 249$ and the hacker demands that the victim gets in contact through e-mail and a Polish messenger called Gadu-Gadu.", "meta": { "date": "February 2017", "encryption": "AES-256", "extensions": [ ".aes" ], "payment-method": "Dollars", "price": "249", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-ahpZEI1FHQM/WJd7_dpYlyI/AAAAAAAADm8/4-nFXqc9bjEI93VDJRdsLSlBOwQiaM7swCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/polski-ransomware.html" ] }, "uuid": "b50265ac-ee45-4f5a-aca1-fabe3157fc14", "value": "Polski Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. This hacker demands that the victim contacts him through email and decrypts the files for FREE.(moreinfo in the link below)", "meta": { "date": "February 2016", "encryption": "AES-256", "extensions": [ ".yourransom" ], "payment-method": "Email", "ransomnotes-filenames": [ "README.txt" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-dFQlF_6uTkI/WJYigC5GwiI/AAAAAAAADlk/jm-ZwqJ2mVYd2gtAQgYW_lOd78u5N2x0ACLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/yourransom-ransomware.html", "https://www.bleepingcomputer.com/news/security/yourransom-is-the-latest-in-a-long-line-of-prank-and-educational-ransomware/", "https://twitter.com/_ddoxer/status/827555507741274113" ] }, "uuid": "908b914b-6744-4e16-b014-121cf2106b5f", "value": "YourRansom Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ranion Raas gives the opportunity to regular people to buy and distribute ransomware for a very cheap price. (More info in the link below). RaaS service", "meta": { "date": "February 2016", "encryption": "AES-256", "payment-method": "Bitcoin", "price": "0.6 - 0.95", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-ORiqmM6oWXc/WJV7X4IvTWI/AAAAAAAADlE/wXvz5Hsv1gQ-UrLoA1plVjLTVD7iDDxwQCLcB/s1600/buy_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/ranion-raas.html", "https://www.bleepingcomputer.com/news/security/ranion-ransomware-as-a-service-available-on-the-dark-web-for-educational-purposes/" ] }, "uuid": "b4de724f-add4-4095-aa5a-e4d039322b59", "value": "Ranion RaasRansomware" }, { "description": "Wants a ransom to get the victim’s files back . Originated in English. Spread worldwide.", "meta": { "date": "January 2017", "encryption": "AES-256", "extensions": [ ".potato" ], "payment-method": "Email", "ransomnotes-filenames": [ "How to recover my files.txt", "README.png", "README.html" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-E9GDxEoz95k/WIop79nWZ2I/AAAAAAAADZU/CnsvOl96yesoH07BZ2Q05Fp40kLcTMmqQCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/polato-ransomware.html" ] }, "uuid": "378cb77c-bb89-4d32-bef9-1b132343f3fe", "value": "Potato Ransomware" }, { "description": "This ransomware is originated in English, therefore could be used worldwide. Ransomware is spread with the help of email spam, fake ads, fake updates, infected install files.", "meta": { "date": "December 2016/January 2017", "encryption": "RC4", "extensions": [ ".-opentoyou@india.com" ], "payment-method": "Email", "ransomnotes": [ "Your files are encrypted! To decrypt write on email - opentoyou@india.comIdentification key - 5E1C0884" ], "ransomnotes-filenames": [ "!!!.txt", "1.bmp", "1.jpg" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-RPeHrC9Trqk/WGk1kQlBQQI/AAAAAAAAC6o/FutnWrlUf44hq54_xI_6Uz2migCR0rwlwCLcB/s1600/Note-wallp.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/opentodecrypt-ransomware.html" ] }, "uuid": "e290fa29-6fc1-4fb5-ac98-44350e508bc1", "value": "of Ransomware: OpenToYou (Formerly known as OpenToDecrypt)" }, { "description": "Author of this ransomware is sergej. Ransom is 0.25 bitcoins for the return of files. Originated in English. Used worldwide. This ransomware is spread with the help of email spam, fake ads, fake updates, infected install files.", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".encrypted" ], "payment-method": "Bitcoin", "price": "0.25", "ransomnotes": [ "YOUR FILES ARE ENCRYPTED!!! To restore (decrypt) them you must:\n1. Pay 0.25 bitcoin (btc) to address 36QLSB*** You can get BTC on this site http://localbitcoins.com \n2. After payment you must send Bitcoin Transacation ID to E-mail: andresaha82@gmail.com Then we will send you decryption tool." ], "ransomnotes-filenames": [ "YOUR FILES ARE ENCRYPTED!!!.txt" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-uIb_TdWTk3Q/WI2qRSlsXJI/AAAAAAAADcE/h92XEY6AraQMUwEIOBZ9moxN1J2So8xpwCLcB/s1600/note_2.png" ], "refs": [ "http://www.2-spyware.com/remove-ransomplus-ransomware-virus.html", "https://id-ransomware.blogspot.co.il/2017/01/ransomplus-ransomware.html", "https://twitter.com/jiriatvirlab/status/825411602535088129" ] }, "uuid": "c039a50b-f5f9-4ad0-8b66-e1d8cc86717b", "value": "RansomPlus" }, { "description": "This ransomware does not actually encrypt your file, but only changes the names of your files, just like Globe Ransomware. This ransomware is spread with the help of email spam, fake ads, fake updates, infected install files", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".unCrypte@outlook.com_<random_numbers_and_upper_alphabetic_characters> ", ".decipher_ne@outlook.com_<random_numbers_and_upper_alphabetic_characters" ], "payment-method": "Bitcoin", "price": "0.2", "ransomnotes": [ "Your files are encrypted! Your personal ID764F6A6664514B414373673170615339554A534A5832546A55487169644B4A35 Discovered a serious vulnerability in your network security. No data was stolen and no one will be able to do it while they are encrypted. For you we have automatic decryptor and instructions for remediation. How to get the automatic decryptor : \n1) Pay 0,25 BTC Buy BTC on one of these sites: https://localbitcoins.com https://www.coinbase.com https://xchange.cc bitcoin adress for pay: 1KG8rWYWRYHfvjVe8ddEyJNCg6HxVWYSQm Send 0,25 BTC \n2) Send screenshot of payment to unCrypte@outlook.com. In the letter include your personal ID (look at the beginning of this document). \n3) You will receive automatic decryptor and all files will be restored \n* To be sure in getting the decryption, you can send one file (less than 10MB) to unCrypte@outlook.com In the letter include your personal ID (look at the beginning of this document). But this action will increase the cost of the automatic decryptor on 0,25 btc... \nAttention! \n• No Payment = No decryption \n• You really get the decryptor after payment \n• Do not attempt to remove the program or run the anti-virus tools \n• Attempts to self-decrypting files will result in the loss of your data \n• Decoders other users are not compatible with your data, because each user's unique encryption key" ], "ransomnotes-filenames": [ "How decrypt files.hta" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/cryptconsole-ransomware.html", "https://www.bleepingcomputer.com/forums/t/638344/cryptconsole-uncrypteoutlookcom-support-topic-how-decrypt-fileshta/", "https://twitter.com/PolarToffee/status/824705553201057794", "https://twitter.com/demonslay335/status/1004351990493741057", "https://twitter.com/demonslay335/status/1004803373747572736" ] }, "uuid": "42508fd8-3c2d-44b2-9b74-33c5d82b297d", "value": "CryptConsole" }, { "description": "Originated in English, could affect users worldwide, however so far only reports from Saudi Arabia. The malware name founded by a windows server tools is called win32/wagcrypt.A", "meta": { "date": "January 2017", "extensions": [ ".zxz" ], "payment-method": "Email", "refs": [ "https://www.bleepingcomputer.com/forums/t/638191/zxz-ransomware-support-help-topic-zxz/?hl=%2Bzxz#entry4168310", "https://id-ransomware.blogspot.co.il/2017/01/zxz-ransomware.html" ] }, "uuid": "e4932d1c-2f97-474d-957e-c7df87f9591e", "value": "ZXZ Ramsomware" }, { "description": "Developed in Visual Studios in 2010. Original name is VxCrypt. This ransomware encrypts your files, including photos, music, MS office, Open Office, PDF… etc", "meta": { "date": "January 2017", "encryption": "AES+RSA", "extensions": [ ".vxlock" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/vxlock-ransomware.html" ] }, "uuid": "14deb95c-7af3-4fb1-b2c1-71087e1bb156", "value": "VxLock Ransomware" }, { "description": "Funfact uses an open code for GNU Privacy Guard (GnuPG), then asks to email them to find out the amout of bitcoin to send (to receive a decrypt code). Written in English, can attach all over the world. The ransom is 1.22038 BTC, which is 1100USD.", "meta": { "date": "January 2017", "encryption": "AES+RSA", "payment-method": "Bitcoin", "price": "0,65806", "ransomnotes": [ "Important Information!!!! You had bad luck. All your files are encrypted with RSA and AES ciphers. to get your files back read carefully. if you do not understand, Read again. All your documents are recoverable only with our software and key file. To decrypt files you need to contact worldfunfact@sigaint.org or funfacts11@tutanota.com and set your ID as email title and send clsign.dll file from your computer. That is the key file and yes, it’s encrypted. Search your computer for filename “clsign.dll” attach it to email. if you wish we will decrypt one of your encrypted file for free! It’s your guarantee. After you made payment you will receive decryption software with key and necessary instructions. if you don’t contact us within 72 hours we will turn on sanctions. you’ll have to pay more. Recovery is only possible during 7 days. after that don’t contact us. Remember you are just single payment away from all your files If your files are urgent pay exactly requested amount to Bitcoin (BTC) address and send clsign.dll file to us. We will send your decryption software within 24 hours; remember if you contact us first maybe you’ll have to pay less\nUser ID: 658061***\nBTC Address: 1AQrj***\nAmount(BTC): 1.65806\n-----BEGIN PGP PUBLIC KEY BLOCK-----\nVersion:\nGnuPG\nv2\n*******************************\n-----END PGP PUBLIC KEY BLOCK-----" ], "ransomnotes-filenames": [ "note.iti" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/funfact.html", "http://www.enigmasoftware.com/funfactransomware-removal/" ] }, "uuid": "2bfac605-a2c5-4742-92a2-279a08a4c575", "value": "FunFact Ransomware" }, { "description": "First spotted in May 2016, however made a big comeback in January 2017. It’s directed to English speaking users, therefore is able to infect worldwide. Ransomware is spread with the help of email spam, fake ads, fake updates, infected install files.", "meta": { "date": "January 2017", "encryption": "AES+RSA", "extensions": [ ".<7_random_letters>" ], "payment-method": "Email", "ransomnotes": [ "WARNING! Your personal files are encrypted! Your most important files on this computer have been encrypted: photos, documents, videos, music, etc. You can verify this by trying to open such files. Encryption was produced using an UNIQUE public RSA-4096 key, specially generated for this computer only, thus making it impossible to decrypt such files without knowing private key and comprehensive decipher software. We have left on our server a copy of the private key, along with all required software for the decryption. To make sure that software is working as intended you have a possibility to decrypt one file for free, see contacts below. The private key will be destroyed after 7 days, afterwards making it impossible to decrypt your files. Encryption date: *** Private key destruction date: *** For obtaining decryption software, please, contact: myserverdoctor@gmail.com or XMPP jabber: doctordisk@jabbim.com" ], "ransomnotes-filenames": [ "encrypted_readme.txt", "__encrypted_readme.txt" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-CLo4JTpveKY/WI4sVXEQSPI/AAAAAAAADcU/n8qrwehDEQMlG845cjNow_fC4PDqlvPIQCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/06/zekwacrypt-ransomware.html", "http://www.2-spyware.com/remove-zekwacrypt-ransomware-virus.html" ] }, "uuid": "89d5a541-ef9a-4b18-ac04-2e1384031a2d", "value": "ZekwaCrypt Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. This ransomware attacks your MS Office by offering a Micro to help with your program, but instead incrypts all your files if the used id not protected. Predecessor CryLocker", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".sage" ], "payment-method": "Bitcoin", "price": "2,15555 (2000$)", "ransomnotes-filenames": [ "!Recovery_[3_random_chars].html" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-6YhxRaqa_9Q/WISA9dW31bI/AAAAAAAADUE/78mNNKpPMyc2Gzi1N9CooyQp7RNT40NNgCLcB/s1600/note1_2.png", "https://1.bp.blogspot.com/-_c5vGu4nCvE/WIT_pWP_FSI/AAAAAAAADUs/8hK8a4E48sY3U_aAHC2qNzYDBL0bQcNjgCLcB/s1600/note-wallp111.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/sage-2-ransomware.html", "https://isc.sans.edu/forums/diary/Sage+20+Ransomware/21959/", "http://www.securityweek.com/sage-20-ransomware-demands-2000-ransom", "https://www.bleepingcomputer.com/news/security/sage-2-0-ransomware-gearing-up-for-possible-greater-distribution/", "https://www.govcert.admin.ch/blog/27/sage-2.0-comes-with-ip-generation-algorithm-ipga" ] }, "uuid": "9174eef3-65f7-4ab5-9b55-b323b36fb962", "value": "Sage 2.0 Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. Uses the name “Window Update” to confuse its victims. Then imitates the window update process , while turning off the Window Startup Repair and changes the BootStatusPolicy using these commands: bcdedit.exe /set {default} recoveryenabled No bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures", "meta": { "date": "January 2017", "encryption": "AES", "payment-method": "Bitcoin", "ransomnotes-filenames": [ "Warning警告.html" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-OTxFEWf7LiY/WIO0rJmBgJI/AAAAAAAADTQ/U3BLcd2-CPQQ_73eIKIyg28cKFmw4nctgCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/cloudsword.html", "http://bestsecuritysearch.com/cloudsword-ransomware-virus-removal-steps-protection-updates/", "https://twitter.com/BleepinComputer/status/822653335681593345" ] }, "uuid": "a89e0ae0-e0e2-40c5-83ff-5fd672aaa2a4", "value": "CloudSword Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. Uses the name “Chrome Update” to confuse its victims. Then imitates the chrome update process ,while encrypting the files. DO NOT pay the ransom, since YOUR COMPUTER WILL NOT BE RESTORED FROM THIS MALWARE!!!!", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".killedXXX" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-llR46G5zOBE/WIJuTTHImXI/AAAAAAAADS8/Ww_QU1Z7Q3geZgiSStJB3siO3oQJpIcowCLcB/s1600/note.jpg", "https://4.bp.blogspot.com/-ilIaUD5qOuk/WIJuV1TuC1I/AAAAAAAADTA/SOj8St_qXMsgDexK1BGgZT0yFDkNDz_7QCLcB/s1600/lock.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/dn-donotopen.html" ], "synonyms": [ "Fake" ] }, "uuid": "327eb8b4-5793-42f0-96c0-7f651a0debdc", "value": "DN" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. Its original name is FileSpy and FileSpy Application. It is spread using email spam, fake updates, infected attachments and so on. It encryps all your files, including: music, MS Office, etc..", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".id-_garryweber@protonmail.ch" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "HOW_OPEN_FILES.html" ], "ransomnotes-refs": [ "https://1.bp.blogspot.com/-w6lxK0qHj8A/WIO_iAngUzI/AAAAAAAADTk/dLGlrwwOh508AlG2ojLRszpUxL0tHrtSQCLcB/s1600/note-html.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/garryweber.html" ] }, "uuid": "b6e6da33-bf23-4586-81cf-dcfe10e13a81", "value": "GarryWeber Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. Its original name is RAAS RANSOMWARE. It is spread using email spam, fake updates, infected attachments and so on. It encryps all your files, including: music, MS Office, Open Office, pictures etc.. This ransomware promotes other to download viruses and spread them as ransomware to infect other users and keep 70% of the ransom. (leaving the other 30% to Satan) https://3.bp.blogspot.com/-7fwX40eYL18/WH-tfpNjDgI/AAAAAAAADPk/KVP_ji8lR0gENCMYhb324mfzIFFpiaOwACLcB/s1600/site-raas.gif RaaS", "meta": { "date": "January 2017", "encryption": "AES-256 + RSA-2048", "extensions": [ ".stn" ], "payment-method": "Bitcoin", "price": "0.1 - your choice", "ransomnotes-filenames": [ "HELP_DECRYPT_FILES.html" ], "ransomnotes-refs": [ "https://1.bp.blogspot.com/-5BgSHIym-8Y/WIH92q4ymHI/AAAAAAAADSk/MF2T-mmhuY4irQZFqmpGZjmUI2onlNCyACLcB/s1600/ransom-note.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/satan-raas.html", "https://www.bleepingcomputer.com/forums/t/637811/satan-ransomware-help-support-topic-stn-extension-help-decrypt-fileshtml/", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-january-20th-2017-satan-raas-spora-locky-and-more/", "https://www.bleepingcomputer.com/news/security/new-satan-ransomware-available-through-a-ransomware-as-a-service-/", "https://twitter.com/Xylit0l/status/821757718885236740" ] }, "related": [ { "dest-uuid": "5639f7db-ab70-4b86-8a2f-9c4e3927ba91", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "61d8bba8-7b22-493f-b023-97ffe7f17caf", "value": "Satan Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, infected attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures , videos, shared online files etc..", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".HavocCrypt" ], "payment-method": "Bitcoin", "price": "150 $", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-Xs7yigomWw8/WH0mqn0QJLI/AAAAAAAADKA/0Fk5QroMsgQ3AsXbHsbVtopcJN4qzDgdACLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/havoc-ransomware.html" ], "synonyms": [ "HavocCrypt Ransomware" ] }, "uuid": "c6bef9c8-becb-4bee-bd97-c1c655133396", "value": "Havoc" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Its fake name is Bitcoin and maker’s name is Santiago. Work of the encrypted requires the user to have .NET Framework 4.5.2. on his computer.", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-filenames": [ "IMPORTANTE_LEER.html", "RECUPERAR_ARCHIVOS.html" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-KE6dziEK4To/WHnvPzKOs7I/AAAAAAAADHI/KPBjmO9iChgAa12-f1VOxF49Pv27-0XfQCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/cryptosweettooth.html", "http://sensorstechforum.com/remove-cryptosweettooth-ransomware-restore-locked-files/" ] }, "uuid": "ca831782-fcbf-4984-b04e-d79b14e48a71", "value": "CryptoSweetTooth Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The word Kaandsona is Estonian, therefore the creator is probably from Estonia. Crashes before it encrypts", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".kencf" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes": [ "You have been struck by the holy Kaandsona ransomware Either you pay 1 BTC in 24 hours or you lose ALL FILES \nbutton 'Show all encrypted files' \nbutton 'PAY'" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-v3jncd77m3U/WHkjPoEusKI/AAAAAAAADGE/xJOIgzm-ST0L4kpNeThKTyfukq3e1Th-QCLcB/s1600/troll-22.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/kaandsona-ransomtroll.html", "https://twitter.com/BleepinComputer/status/819927858437099520" ], "synonyms": [ "RansomTroll Ransomware", "Käändsõna Ransomware" ] }, "uuid": "aed61a0a-dc48-43ac-9c33-27e5a286899e", "value": "Kaandsona Ransomware" }, { "description": "It’s directed to English and Chinese speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Python Ransomware", "meta": { "date": "January 2017", "encryption": "AES-256", "extensions": [ ".lambda_l0cked" ], "payment-method": "Bitcoin", "price": "0.5 - 1", "ransomnotes-filenames": [ "READ_IT.hTmL" ], "ransomnotes-refs": [ "https://1.bp.blogspot.com/-B3o6bGziu_M/WHkyueI902I/AAAAAAAADGw/la7psCE9JEEe17GipFh69xVnIDYGFF38wCLcB/s1600/note-1-2.gif" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/lambdalocker.html", "http://cfoc.org/how-to-restore-files-affected-by-the-lambdalocker-ransomware/" ] }, "uuid": "0d1b35e9-c87a-4972-8c27-a11c13e351d7", "value": "LambdaLocker Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".HakunaMatata" ], "payment-method": "Website (onion)", "ransomnotes-filenames": [ "Recovers files yako.html" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-DUXeyyzqwKs/WHkrGvLyFvI/AAAAAAAADGg/SPfrNMZYGs8edE7X5z-3MBroIqS5GQ8kACLcB/s1600/note_1-str_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/hakunamatata.html", "https://id-ransomware.blogspot.co.il/2016_03_01_archive.html" ], "synonyms": [ "HakunaMatataRansomware" ] }, "uuid": "0645cae2-bda9-4d68-8bc3-c3c1eb9d1801", "value": "NMoreia 2.0 Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is .2 bitcoin, however there is no point of even trying to pay, since this damage is irreversible. Once the ransom is paid the hacker does not return decrypt the files. Another name is DeMarlboro and it is written in language C++. Pretend to encrypt using RSA-2048 and AES-128 (really it’s just XOR)", "meta": { "date": "January 2017", "encryption": "XOR", "extensions": [ ".oops" ], "payment-method": "Bitcoin", "price": "0.2", "ransomnotes-filenames": [ "_HELP_Recover_Files_.html" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-7UmhPM2VSKY/WHe5tDsHfuI/AAAAAAAADFM/FRdUnAyxAggvF0hX0adtrpq48F7HXPbawCLcB/s1600/check-decrypt.png", "https://1.bp.blogspot.com/-MWRTa6aXtdk/WHflJFyb-GI/AAAAAAAADFs/dc-l-RrWSCAPE8akw2SCb1uuj-a-2shiwCLcB/s1600/docm.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/marlboro.html", "https://decrypter.emsisoft.com/marlboro", "https://www.bleepingcomputer.com/news/security/marlboro-ransomware-defeated-in-one-day/" ] }, "uuid": "4ae98da3-c667-4c6e-b0fb-5b52c667637c", "value": "Marlboro Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Sample of a spam email with a viral attachment: https://4.bp.blogspot.com/-KkJXiHG80S0/WHX4TBpkamI/AAAAAAAADDg/F_bN796ndMYnzfUsgSWMXhRxFf3Ic-HtACLcB/s1600/spam-email.png", "meta": { "date": "January 2017", "encryption": "AES+RSA", "payment-method": "Bitcoin", "price": "79$", "ransomnotes-filenames": [ "[Infection-ID].HTML" ], "ransomnotes-refs": [ "https://1.bp.blogspot.com/-0COE3ADdaYk/WHpnHzuo7OI/AAAAAAAADHY/yfDF3XG720Yyn3xQHwFngt1T99cT-Xt3wCLcB/s1600/rus-note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/spora-ransomware.html", "https://blog.gdatasoftware.com/2017/01/29442-spora-worm-and-ransomware", "http://blog.emsisoft.com/2017/01/10/from-darknet-with-love-meet-spora-ransomware/" ] }, "uuid": "46601172-d938-47af-8cf5-c5a796ab68ab", "value": "Spora Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The files get encrypted, but the decrypt key is not available. NO POINT OF PAYING THE RANSOM, THE FILES WILL NOT BE RETURNED.", "meta": { "date": "January 2017", "encryption": "AES+RSA", "extensions": [ ".crypto" ], "payment-method": "Bitcoin", "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/cryptokill-ransomware.html" ] }, "uuid": "7ae2f594-8a72-4ba8-a37a-32457d1d3fe8", "value": "CryptoKill Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "January 2017", "extensions": [ "AES+RSA" ], "payment-method": "Bitcoin", "price": "0.35", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-mwIvQNkFH4g/WKAydZnGn_I/AAAAAAAADxs/6xHgbD3OUFUbebeuNVkI6tp_cMRVUQHtQCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/allyourdocuments-ransomware.html" ] }, "uuid": "62120e20-21f6-474b-9dc1-fc871d25c798", "value": "All_Your_Documents Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The ransom is 500$ in bitcoins. The name of the hacker is R4z0rx0r Serbian Hacker.", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".velikasrbija" ], "payment-method": "Bitcoin", "price": "500$", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-OY8jgTN5Y9Q/WKAI6a9xfMI/AAAAAAAADwc/ng36hAXsvfYQ5rdkSFeVgEvLY88pJmnWACLcB/s1600/note-html-wallp.jpg", "https://3.bp.blogspot.com/-DQQ5tk0C9lY/WKALND0dYPI/AAAAAAAADwo/EuKiO_F0Mn0ImrGLVE-Sks-j93pHoTjKACLcB/s1600/konstr.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/serbransom-2017.html", "https://www.bleepingcomputer.com/news/security/ultranationalist-developer-behind-serbransom-ransomware/", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-february-10th-2017-serpent-spora-id-ransomware/", "https://twitter.com/malwrhunterteam/status/830116190873849856" ] }, "uuid": "fb1e99cb-73fa-4961-a052-c90b3f383542", "value": "SerbRansom 2017 Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The ransom is 0.33 bitcoins.", "meta": { "date": "January 2017", "encryption": "AES", "payment-method": "Bitcoin", "price": "0.33", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-5t-5eBl4Tng/WKARmYV5GVI/AAAAAAAADxA/OuS7Eo__z1sh2tRbBpQIxJQ6IVbSiQakwCLcB/s1600/lock-note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/fadesoft-ransomware.html", "https://twitter.com/malwrhunterteam/status/829768819031805953", "https://twitter.com/malwrhunterteam/status/838700700586684416" ] }, "uuid": "ccfe7f6a-9c9b-450a-a4c7-5bbaf4a82e37", "value": "Fadesoft Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "January 2017", "encryption": "AES-256 + RSA-2048", "extensions": [ ".encypted" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-kolk6sABFzQ/WJ95ddcAxNI/AAAAAAAADwI/oP8ZFD7KnqoQWgpfgEHId843x3l0xfhjACLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/hugeme-ransomware.html", "https://www.ozbargain.com.au/node/228888?page=3", "https://id-ransomware.blogspot.co.il/2016/04/magic-ransomware.html" ] }, "uuid": "681ad7cc-fda0-40dc-83b3-91fdfdec81e1", "value": "HugeMe Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "January 2017", "encryption": "AES-256 + RSA-2048", "extensions": [ ".crypt" ], "payment-method": "Bitcoin", "price": "50$", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-Qx8RhielSbI/WJypR9Zw9nI/AAAAAAAADus/Opsfy8FxRIIBmouywdl7uT94ZpfwKr6JACLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/dyna-crypt-ransomware.html", "https://www.bleepingcomputer.com/news/security/dyna-crypt-not-only-encrypts-your-files-but-also-steals-your-info/" ], "synonyms": [ "DynA CryptoLocker Ransomware" ] }, "uuid": "9979ae53-98f7-49a2-aa1e-276973c2b44f", "value": "DynA-Crypt Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "January 2017", "encryption": "AES-256 + RSA-2048", "extensions": [ ".crypt" ], "payment-method": "Bitcoin", "price": "0.75 (787.09$) - 2.25 (2366.55$ after 7 days)", "ransomnotes": [ "==== NEED HELP WITH TRANSLATE? USE https://translate.google.com ====\n================ PLEASE READ THIS MESSAGE CAREFULLY ================\n Your documents, photos, videos, databases and other important files have been encrypted! The files have been encrypted using AES256 and RSA2048 encryption (unbreakable) To decrypt your files you need to buy the special software 'SerpentDecrypter'.You can buy this software on one of the websites below. xxxx://vdpbkmwbnp.pw/00000000-00000000-00000000-00000000 xxxx://hnxrvobhgm.pw/00000000-00000000-00000000-00000000 If the websites above do not work you can use a special website on the TOR network. Follow the steps below\n1. Download the TOR browser https://www.torproject.org/projects/torbrowser.html.en#downloads\n2. Inside the TOR browser brower navigate to : 3o4kqe6khkfgx25g.onion/00000000-00000000-00000000-00000000 \n3. Follow the instructions to buy 'Serpent Decrypter'\n================ PLEASE READ THIS MESSAGE CAREFULLY ================" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/serpent-danish-ransomware.html" ], "synonyms": [ "Serpent Danish Ransomware" ] }, "uuid": "3b472aac-085b-409e-89f1-e8c766f7c401", "value": "Serpent 2017 Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "January 2017", "encryption": "ROT-23", "payment-method": "Bitcoin", "price": "0.085", "ransomnotes-filenames": [ "README.HTML" ], "ransomnotes-refs": [ "https://1.bp.blogspot.com/-tAp9wE6CJxM/WJrvOOyIfRI/AAAAAAAADts/iMfaiDRyRcQuPXgtQV--qt7q8ZI3ZV0tQCLcB/s1600/note1%252B.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/erebus-2017-ransomware.html", "https://www.bleepingcomputer.com/news/security/erebus-ransomware-utilizes-a-uac-bypass-and-request-a-90-ransom-payment/" ] }, "uuid": "c21e637c-6611-47e1-a191-571409b6669a", "value": "Erebus 2017 Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "January 2017", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "0.085", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-7KRVg6kt418/WJnwxDOV5NI/AAAAAAAADrk/or9DbPMl-7ksN7OwIAH6BMJwE5fGc_BfgCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/ransomuhahawhere.html" ], "synonyms": [ "Ransomuhahawhere" ] }, "uuid": "dcb183d1-11b5-464c-893a-21e132cb7b51", "value": "Cyber Drill Exercise " }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. This is a trollware that does not encrypt your files but makes your computer act crazy (like in the video in the link below). It is meant to be annoying and it is hard to erase from your PC, but possible.", "meta": { "date": "February 2017", "extensions": [ ".cancer" ], "payment-method": "no ransom", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-ozPs6mwKfEI/WJjTwbrOx9I/AAAAAAAADqE/4gewG-f_dLQQDevajtn8CnX69lvWgCZQACLcB/s1600/wallp.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/cancer-ransomware.html", "https://www.bleepingcomputer.com/news/security/watch-your-computer-go-bonkers-with-cancer-trollware/" ] }, "uuid": "ef747d7f-894e-4c0c-ac0f-3fa1ef3ef17f", "value": "Cancer Ransomware FAKE" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Poses as Microsoft Copyright 2017 and requests ransom in bitcoins.", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".locked" ], "payment-method": "Email - Bitcoin", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-BOmKmroIvEI/WJn-LAUmyyI/AAAAAAAADsI/W987TEaOnEAd45AOxO1cFyFvxEx_RfehgCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/02/updatehost-ransomware.html", "https://www.bleepingcomputer.com/startups/Windows_Update_Host-16362.html" ] }, "uuid": "ed5b30b0-2949-410a-bc4c-3d90de93d033", "value": "UpdateHost Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 10 bitcoins.", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".v8dp" ], "payment-method": "Bitcoin", "price": "10", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-dLSbqOiIbLU/WHPh-akYinI/AAAAAAAADC0/6nFQClDBJ5M7ZhrjkhnxfkdboOh7SlE-ACLcB/s1600/v5YZMxt.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/nemesis-ransomware.html" ] }, "uuid": "b5942085-c9f2-4d1a-aadf-1061ad38fb1d", "value": "Nemesis Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Domain KZ is used, therefore it is assumed that the decrypter is from Kazakhstan. Coded in Javascript", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".file0locked", ".evillock" ], "payment-method": "Email", "ransomnotes-filenames": [ "HOW_TO_DECRYPT_YOUR_FILES.TXT", "HOW_TO_DECRYPT_YOUR_FILES.HTML" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-0NFy_yDghZ0/WHO_ClbPdMI/AAAAAAAADCQ/RX2cgYg3z381gro6UUQtAED7JgXHbvGLgCLcB/s1600/note-txt_2.png", "https://4.bp.blogspot.com/-xxJ9xdRuWis/WHO_FL-hWcI/AAAAAAAADCU/VqI02AhzopQY1WKk-k6QYSdHFWFzg1NcACLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/evil-ransomware.html", "http://www.enigmasoftware.com/evilransomware-removal/", "http://usproins.com/evil-ransomware-is-lurking/", "https://twitter.com/jiriatvirlab/status/818443491713884161", "https://twitter.com/PolarToffee/status/826508611878793219" ], "synonyms": [ "File0Locked KZ Ransomware" ] }, "uuid": "57933295-4a0e-4f6a-b06b-36807ff150cd", "value": "Evil Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. This is a fake ransomware. Your files are not really encrypted, however the attacker does ask for a ransom of .03 bitcoins. It is still dangerous even though it is fake, he still go through to your computer.", "meta": { "date": "January 2017", "payment-method": "Bitcoin", "price": "0.03", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-3iMAtqvAmts/WHEyA_dW5OI/AAAAAAAADAY/tE5FtaVMJcc3aQQvWI4XOdjtvbXufFgywCLcB/s1600/lock1.jpg", "https://3.bp.blogspot.com/-DMxJm5GT0VY/WHEyEOi_vZI/AAAAAAAADAc/6Zi3IBuBz1I7jdQHcSrzhUGagGCUfs6iACLcB/s1600/lock2.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/ocelot-ransomware.html", "https://twitter.com/malwrhunterteam/status/817648547231371264" ], "synonyms": [ "Ocelot Locker Ransomware" ] }, "uuid": "054b9fbd-72fa-464f-a683-a69ab3936d69", "value": "Ocelot Ransomware (FAKE RANSOMWARE)" }, { "description": "It’s directed to Czechoslovakianspeaking users. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on HiddenTear", "meta": { "date": "January 2017", "encryption": "AES", "payment-method": "Bitcoin", "price": "1000 CZK", "ransomnotes-filenames": [ "INFOK1.txt" ], "ransomnotes-refs": [ "https://1.bp.blogspot.com/-i4ksJq-UzX8/WHFFXQL5wAI/AAAAAAAADA8/awfsqj1lr7IMBAPtE0tB44PNf1N6zkGDwCLcB/s1600/note_2.png", "https://1.bp.blogspot.com/-OlKgHvtAUHg/WHFDCx4thaI/AAAAAAAADAw/wzBXV17Xh-saaFGlrxw3CDNhGSTaVe2dQCLcB/s1600/lock1.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/skyname-ransomware.html", "https://twitter.com/malwrhunterteam/status/817079028725190656" ], "synonyms": [ "Blablabla Ransomware" ] }, "uuid": "00b8ff33-1504-49a4-a025-b761738eed68", "value": "SkyName Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 155$ inbitcoins. Creator of ransomware is called Mafia. Based on HiddenTear", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".locked-by-mafia" ], "payment-method": "Bitcoin", "price": "155$", "ransomnotes-filenames": [ "READ_ME.txt" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-BclLp7x1sUM/WG6acqtDBbI/AAAAAAAAC_I/ToVEXx-G2DcKD4d7TZ0RkVqA1wRicxnZQCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/mafiaware.html", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-january-6th-2017-fsociety-mongodb-pseudo-darkleech-and-more/", "https://twitter.com/BleepinComputer/status/817069320937345024" ], "synonyms": [ "Depsex Ransomware" ] }, "uuid": "e5a60429-ae5d-46f4-a731-da9e2fcf8b92", "value": "MafiaWare Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 3 bitcoins. Extesion depends on the config file. It seems Globe is a ransomware kit.", "meta": { "date": "January 2017", "encryption": "AES-256+RSA or RC4", "extensions": [ ".badnews", ".globe", ".[random].bit", ".[random].encrypted", ".[random].raid10", ".[random].globe", ".[mia.kokers@aol.com]", ".unlockv@india.com", ".rescuers@india.com.3392cYAn548QZeUf.lock", ".locked", ".decrypt2017", ".hnumkhotep" ], "payment-method": "Bitcoin", "price": "3", "ransomnotes-filenames": [ "How To Recover Encrypted Files.hta" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-Wk1_IdcEHbk/WG6FVnoaKlI/AAAAAAAAC-4/WeHzJAUJ0goxxuAoGUUebSgzGHrnD6LQQCLcB/s1600/Globe-ransom-note_2.png.png", "https://3.bp.blogspot.com/-lYkopoRH0wQ/WHOt1KhhzhI/AAAAAAAADCA/nPdhHK3wEucAK1GHodeh5w3HcpdugzSHwCLcB/s1600/globe3-9-1-17.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/globe3-ransomware.html", "https://www.bleepingcomputer.com/forums/t/624518/globe-ransomware-help-and-support-purge-extension-how-to-restore-fileshta/", "https://www.bleepingcomputer.com/news/security/the-globe-ransomware-wants-to-purge-your-files/", "https://decryptors.blogspot.co.il/2017/01/globe3-decrypter.html", "https://decrypter.emsisoft.com/globe3" ], "synonyms": [ "Purge Ransomware" ] }, "related": [ { "dest-uuid": "5541471c-8d15-4aec-9996-e24b59c3e3d6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "fe16edbe-3050-4276-bac3-c7ff5fd4174a", "value": "Globe3 Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 500$ in bitcoins. Requires .NET Framework 4.0. Gets into your startup system and sends you notes like the one below: https://4.bp.blogspot.com/-xrr6aoB_giw/WG1UrGpmZJI/AAAAAAAAC-Q/KtKdQP6iLY4LHaHgudF5dKs6i1JHQOBmgCLcB/s1600/green1.jpg", "meta": { "date": "January 2017", "encryption": "AES-256", "extensions": [ ".firecrypt" ], "payment-method": "Bitcoin", "price": "500$", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-np8abNpYeoU/WG1KX4_H0yI/AAAAAAAAC98/gxRJeDb01So5yTboXYP7sZWurJFBbWziACLcB/s1600/note-html.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/bleedgreen-ransomware.html", "https://www.bleepingcomputer.com/news/security/firecrypt-ransomware-comes-with-a-ddos-component/" ], "synonyms": [ "FireCrypt Ransomware" ] }, "uuid": "fbb3fbf9-50d7-4fe1-955a-fd4defa0cb08", "value": "BleedGreen Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Original name is Mission 1996 or Mission: “Impossible” (1996) (like the movie)", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".BTC" ], "payment-method": "Email", "ransomnotes-filenames": [ "BTC_DECRYPT_FILES.txt", "BTC_DECRYPT_FILES.html" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-uiHluU553MU/WGzoFpEWkfI/AAAAAAAAC9o/M34ndwHUsoEfZiLJv9j4PCgBImS8oyYaACLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/btcamant.html" ] }, "uuid": "a5826bd3-b457-4aa9-a2e7-f0044ad9992f", "value": "BTCamant Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. It is also possible to break in using RDP Windows with the help of Pass-the-Hash system, PuTTY, mRemoteNG, TightVNC, Chrome Remote Desktop, modified version of TeamViewer, AnyDesk, AmmyyAdmin, LiteManager, Radmin and others. Ransom is 700$ in Bitcoins.", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ "_x3m", "_r9oj", "_locked" ], "payment-method": "Bitcoin", "price": "700$", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-hMAakgAORvg/WG_i-lk09II/AAAAAAAADAI/Uq2iCHC5ngYzeVcuxQF0mcbrLqyOGcA_wCLcB/s1600/note.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/x3m-ransomware.html" ] }, "uuid": "192bc3e8-ace8-4229-aa88-37034a11ef5b", "value": "X3M Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".LOCKED" ], "payment-method": "Bitcoin - WebSite (onion)", "ransomnotes-filenames": [ "DecryptFile.txt" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-cAnilnXjK7k/WG_OHhC_UdI/AAAAAAAAC_4/sdbzTx9hP4sryM7xE59ONdk7Zr8D_m6XwCLcB/s1600/note-txt_2.png", "https://1.bp.blogspot.com/-TDK91s7FmNM/WGpcwq5HmwI/AAAAAAAAC8Q/i0Q66vE7m-0kmrKPXWdwnYQg6Eaw2KSDwCLcB/s1600/note-pay_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/gog-ransomware.html", "https://twitter.com/BleepinComputer/status/816112218815266816" ] }, "uuid": "c3ef2acd-cc5d-4240-80e7-47e85b46db96", "value": "GOG Ransomware" }, { "description": "RegretLocker is a new ransomware that has been found in the wild in the last month that does not only encrypt normal files on disk like other ransomwares. When running, it will particularly search for VHD files, mount them using Windows Virtual Storage API, and then encrypt all the files it finds inside of those VHD files.", "meta": { "date": "November 2020", "encryption": "AES", "extensions": [ ".mouse" ], "refs": [ "http://chuongdong.com/reverse%20engineering/2020/11/17/RegretLocker/" ] }, "uuid": "9479d372-605e-408e-a2a3-ea971ad4ad78", "value": "RegretLocker" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 0.1 Bitcoins. Original name is TrojanRansom.", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".edgel" ], "payment-method": "Bitcoin", "price": "0.1", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-dNBgohC1UYg/WGnXhem546I/AAAAAAAAC7w/Wv0Jy4173xsBJDZPLMxe6lXBgI5BkY4BgCLcB/s1600/note-lock.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/edgelocker-ransomware.html", "https://twitter.com/BleepinComputer/status/815392891338194945" ] }, "uuid": "ecfa106d-0aff-4f7e-a259-f00eb14fc245", "value": "EdgeLocker" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Fake name: Microsoft Corporation. Based on HiddenTear", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".locked" ], "payment-method": "Website", "ransomnotes-filenames": [ "MESSAGE.txt" ], "ransomnotes-refs": [ "https://1.bp.blogspot.com/-tDS74fDwB1Q/WGk2D5DcUYI/AAAAAAAAC6s/vahju5JD9B4chwnNDUvDPp4ejZOxnj_awCLcB/s1600/note-wallp.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/red-alert-ransomware.html", "https://twitter.com/JaromirHorejsi/status/815557601312329728" ] }, "related": [ { "dest-uuid": "cd5f5165-7bd3-4430-b0bc-2c8fa518f618", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "f762860a-5e7a-43bf-bef4-06bd27e0b023", "value": "Red Alert" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "1.5", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-T0PhVuoFSyA/WGk5mYkRFAI/AAAAAAAAC64/j14Pt84YUmQMNa_5LSEn6fZ5CoYqz60swCLcB/s1600/note-lock.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/first-ransomware.html" ] }, "uuid": "ed26fcf3-47fb-45cc-b5f9-de18f6491934", "value": "First" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Written on Delphi. The user requests the victim to get in touch with him through ICQ to get the ransom and return the files.", "meta": { "date": "January 2017", "encryption": "Twofish", "payment-method": "Email", "ransomnotes-filenames": [ "Xhelp.jpg" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-XZNMg5P75r4/WI985j-EKHI/AAAAAAAADcw/jGdtXoq2pnwjlAbFAJia4UsXuJrV5AU3gCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/xcrypt-ransomware.html", "https://twitter.com/JakubKroustek/status/825790584971472902" ], "synonyms": [ "XCrypt" ] }, "uuid": "fd5bb71f-80dc-4a6d-ba8e-ed74999700d3", "value": "XCrypt Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "January 2017", "encryption": "Twofish", "extensions": [ ".7zipper" ], "payment-method": "Email", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-BR0DvtIft7g/WI95IF7IdUI/AAAAAAAADck/gzWAMbpFvaYicHFuMzvlM3YGJpgulMQBQCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/7zipper-ransomware.html", "https://1.bp.blogspot.com/-ClM0LCPjQuk/WI-BgHTpdNI/AAAAAAAADc8/JyEQ8-pcJmsXIntuP-MMdE-pohVncxTXQCLcB/s1600/7-zip-logo.png" ] }, "uuid": "d8ec9e54-a4a4-451e-9f29-e7503174c16e", "value": "7Zipper Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 170$ or EUR in Bitcoins.", "meta": { "date": "January 2017", "encryption": "AES", "extensions": [ ".lock", ".locked" ], "payment-method": "Bitcoin", "price": "170€/$", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-SF4RsOANlI0/WJBQd4SJv6I/AAAAAAAADdY/hI-Ncw9FoFMi5jvljUftpzTgdykOfR3vgCLcB/s1600/lock-wallp_2.png.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/zyka-ransomware.html", "https://www.pcrisk.com/removal-guides/10899-zyka-ransomware", "https://download.bleepingcomputer.com/demonslay335/StupidDecrypter.zip", "https://twitter.com/GrujaRS/status/826153382557712385" ] }, "uuid": "7b7c8124-c679-4201-b5a5-5e66e6d52b70", "value": "Zyka Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to strike worldwide. This ransomware does not really encrypt your files. Ransom requested is £50 using credit card.", "meta": { "date": "January 2017", "encryption": "AES-256 (fake)", "payment-method": "Bitcoin", "price": "50£", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-zShnOIf3R_E/WJBfhC4CdSI/AAAAAAAADdo/6l4hwSOmI0Evj4W0Esj1S_uNOy5Yq6X0QCLcB/s1600/note1-2-3.gif" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/sureransom-ransomware.html", "http://www.forbes.com/sites/leemathews/2017/01/27/fake-ransomware-is-tricking-people-into-paying/#777faed0381c" ] }, "uuid": "a9365b55-acd8-4b70-adac-c86d121b80b3", "value": "SureRansom Ransomeware (Fake)" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. This ransomware uses the known online library as a decoy. It poses as Netflix Code generator for Netflix login, but instead encrypts your files. The ransom is 100$ in Bitcoins.", "meta": { "date": "January 2017", "encryption": "AES-256", "extensions": [ ".se" ], "payment-method": "Bitcoin", "price": "0.18 (100$)", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-vODt2aB9Hck/WJCFc3g5eCI/AAAAAAAADe8/OrEVkqUHMU4swRWedoZuBu50AWoKR1FGACLcB/s1600/netflix-note.jpg", "https://4.bp.blogspot.com/-Cw4e1drBKl4/WJCHmgp1vtI/AAAAAAAADfI/QqFxUsuad" ], "refs": [ "https://id-ransomware.blogspot.co.il/2017/01/netflix-ransomware.html", "http://blog.trendmicro.com/trendlabs-security-intelligence/netflix-scam-delivers-ransomware/", "https://www.bleepingcomputer.com/news/security/rogue-netflix-app-spreads-netix-ransomware-that-targets-windows-7-and-10-users/", "http://www.darkreading.com/attacks-breaches/netflix-scam-spreads-ransomware/d/d-id/1328012", "https://4.bp.blogspot.com/-bQQ4DTIClvA/WJCIh6Uq2nI/AAAAAAAADfY/hB5HcjuGgh8rRJKeLHo__IRz3Ezth22-wCEw/s1600/form1.jpg", "https://4.bp.blogspot.com/-ZnWdPDprJOg/WJCPeCtP4HI/AAAAAAAADfw/kR0ifI1naSwTAwSuOPiw8ZCPr0tSIz1CgCLcB/s1600/netflix-akk.png" ] }, "uuid": "1317351f-ec8f-4c76-afab-334e1384d3d3", "value": "Netflix Ransomware" }, { "description": "It’s directed to English and Italian speaking users, therefore is able to infect worldwide. Most attacks are on organizations and servers. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. They pose as a Consumer complaint notification that’s coming from Federal Trade Commission from USA, with an attached file called “complaint.pdf”. Written in Delphi by hacker MicrRP.", "meta": { "date": " December 2016", "encryption": "AES-256", "extensions": [ ".MRCR1", ".PEGS1", ".RARE1", ".RMCM1", ".MERRY" ], "payment-method": "Email", "ransomnotes-filenames": [ "YOUR_FILES_ARE_DEAD.HTA", "MERRY_I_LOVE_YOU_BRUCE.HTA" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-3F3QAZnDxsI/WGpvD4wZ2OI/AAAAAAAAC80/-2L6dIPqsgs8hZHOX0T6AFf5LwPwfZ-rwCLcB/s1600/note.png", "https://4.bp.blogspot.com/-_w8peyLMcww/WHNJ1Gb0qeI/AAAAAAAADBw/EVbR-gKipYoNujo-YF6VavafsUfWDANEQCLcB/s1600/8-1-17.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/mrcr1-ransomware.html", "https://www.bleepingcomputer.com/news/security/-merry-christmas-ransomware-now-steals-user-private-data-via-diamondfox-malware/", "http://www.zdnet.com/article/not-such-a-merry-christmas-the-ransomware-that-also-steals-user-data/", "https://www.bleepingcomputer.com/news/security/merry-christmas-ransomware-and-its-dev-comodosecurity-not-bringing-holiday-cheer/", "https://decrypter.emsisoft.com/mrcr" ], "synonyms": [ "Merry X-Mas", "MRCR" ] }, "uuid": "72cbed4e-b26a-46a1-82be-3d0154fdd2e5", "value": "Merry Christmas" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Seoirse is how in Ireland people say the name George. Ransom is 0.5 Bitcoins.", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".seoire" ], "payment-method": "Bitcoin", "price": "0.5", "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/seoirse-ransomware.html" ] }, "uuid": "bdf807c2-74ec-4802-9907-a89b1d910296", "value": "Seoirse Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Every file is encrypted with a personal AES-key, and then AES-key encrypts with a RSA-1028 key. Hacking by TeleBots (Sandworm). Goes under a fake name: Update center or Microsoft Update center.", "meta": { "date": "November/December 2016", "encryption": "AES-256+RSA", "payment-method": "Bitcoin", "price": "222 (200 000$)", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-8MqANWraAgE/WGT7mj-XirI/AAAAAAAAC3g/H_f1hTxa7Sc_DEtllBe-vYaAfY-YqMelgCLcB/s1600/wallp.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/killdisk-ransomware.html", "https://www.bleepingcomputer.com/news/security/killdisk-ransomware-now-targets-linux-prevents-boot-up-has-faulty-encryption/", "https://www.bleepingcomputer.com/news/security/killdisk-disk-wiping-malware-adds-ransomware-component/", "http://www.zdnet.com/article/247000-killdisk-ransomware-demands-a-fortune-forgets-to-unlock-files/", "http://www.securityweek.com/destructive-killdisk-malware-turns-ransomware", "http://www.welivesecurity.com/2017/01/05/killdisk-now-targeting-linux-demands-250k-ransom-cant-decrypt/", "https://cyberx-labs.com/en/blog/new-killdisk-malware-brings-ransomware-into-industrial-domain/" ] }, "uuid": "8e067af6-d1f7-478a-8a8e-5154d2685bd1", "value": "KillDisk Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Maker is arizonacode and ransom amount is 20-30$. If the victim decides to pay the ransom, he will have to copy HWID and then speak to the hacker on Skype and forward him the payment.", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".deria" ], "payment-method": "Bitcoin", "price": "20 - 30$", "ransomnotes-filenames": [ "unlock-everybody.txt" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-9vg_tRPq8rQ/WGOjf4ULuGI/AAAAAAAACzw/d16uRmEOotsCbRM4hwvzQ6bB8xAVNJ7ogCLcB/s1600/DeriaLock.gif" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/derialock-ransomware.html", "https://www.bleepingcomputer.com/news/security/new-derialock-ransomware-active-on-christmas-includes-an-unlock-all-command/" ] }, "uuid": "c0d7acd4-5d64-4571-9b07-bd4bd0d27ee3", "value": "DeriaLock Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".bript" ], "payment-method": "Email - Bitcoin", "ransomnotes-filenames": [ "More.html" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-hApL-ObdWsk/WGAYUyCzPcI/AAAAAAAACyg/NuL26zNgRGcLnnF2BwgOEn3AYMgVu3gQACLcB/s1600/More-note.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/badencript-ransomware.html", "https://twitter.com/demonslay335/status/813064189719805952" ] }, "uuid": "43bfbb2a-9416-44da-81ef-03d6d3a3923f", "value": "BadEncript Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The name of the creator is puff69.", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".adam" ], "payment-method": "Website", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-9IgXt6L0hLY/WGARdzJgfvI/AAAAAAAACyQ/1bfnX_We65AirDcAFpiG49NPuBMfGH9wwCLcB/s1600/note-adam.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/adamlocker-ransomware.html" ] }, "uuid": "5e7d10b7-18ec-47f7-8f13-6fd03d10a8bc", "value": "AdamLocker Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. This ransomware poses as Windows 10 Critical Update Service. Offers you to update your Windows 10, but instead encrypts your files. For successful attack, the victim must have .NET Framework 4.5.2 installed on him computer.", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".alphabet" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-bFPI3O1BI3s/WGPpvnDvNNI/AAAAAAAAC10/mLUiFOCWnEkjbV91PmUGnc3qsFMv9um8QCLcB/s1600/wallp.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/alphabet-ransomware.html", "https://twitter.com/PolarToffee/status/812331918633172992" ] }, "related": [ { "dest-uuid": "5060756f-8385-465d-a7dd-7bf09a54da92", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "dd356ed3-42b8-4587-ae53-95f933517612", "value": "Alphabet Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread by its creator in forums. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files and documents and more. The ransom is 0.1 bitcoins within 72 hours. Uses Windows Update as a decoy. Creator: Talnaci Alexandru", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".kokolocker" ], "payment-method": "Bitcoin", "price": "0.1", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-NiQ6rSIprB8/WF-uxTMq6hI/AAAAAAAACyA/tA6qO3aJdGc0Dn_I-IOZOM3IwN5rgq9sACLcB/s1600/note-koko.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/kokokrypt-ransomware.html", "http://removevirusadware.com/tips-for-removeing-kokokrypt-ransomware/" ], "synonyms": [ "KokoLocker Ransomware" ] }, "uuid": "d672fe4f-4561-488e-bca6-20385b53d77f", "value": "KoKoKrypt Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 0.5 bitcoins. The name of the creator is staffttt, he also created Fake CryptoLocker", "meta": { "date": "December 2016", "encryption": "AES-256+RSA", "extensions": [ ".l33tAF" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-filenames": [ "YOU_HAVE_BEEN_HACKED.txt" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-yncl7-Jy198/WGDjdgNKXjI/AAAAAAAACzA/bfkDgwWEGKggUG3E1tgPBAWDXwi-p-7AwCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/l33taf-locker-ransomware.html" ] }, "uuid": "791a6720-d589-4cf7-b164-08b35b453ac7", "value": "L33TAF Locker Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam (for example: “you have a criminal case against you”), fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "December 2016", "encryption": "AES-256+RSA", "payment-method": "Bitcoin", "price": "0.6 - 1.6", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-T9Mt0pE7kwY/WF7NKAPfv1I/AAAAAAAACxw/gOjxeSR0x7EurKQTI2p6Ym70ViYuYdsvQCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/pclock4-sysgop-ransomware.html" ], "synonyms": [ "PClock SysGop Ransomware" ] }, "uuid": "b78be3f4-e39b-41cc-adc0-5824f246959b", "value": "PClock4 Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. This ransomware uses VBS-script to send a voice message as the first few lines of the note.", "meta": { "date": "December 2016", "encryption": "AES-256+RSA", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "0.4", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-0-kDVCM-kuI/WGVH-d2trGI/AAAAAAAAC4A/4LlxFpwkhEk89QcJ5ZhO1i-T6dQ_RcVegCEw/s1600/guster-note-2.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/guster-ransomware.html", "https://twitter.com/BleepinComputer/status/812131324979007492" ] }, "uuid": "ffa7ac2f-b216-4fac-80be-e859a0e0251f", "value": "Guster Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The hacker requests the ransom in Play Store cards. https://3.bp.blogspot.com/-ClUef8T55f4/WGKb8U4GeaI/AAAAAAAACzg/UFD0X2sORHYTVRNBSoqd5q7TBrOblQHmgCLcB/s1600/site.png", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".madebyadam" ], "payment-method": "Website (gift card)", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-ZIWywQMf2mY/WGJD-rqLZYI/AAAAAAAACzQ/p5PWlpWyHjcVHKq74DOsE7yS-ornW48_QCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/roga-ransomware.html" ] }, "related": [ { "dest-uuid": "175ebcc0-d74f-49b2-9226-c660ca1fe2e8", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "cd1eb48e-070b-418e-8d83-4644a388f8ae", "value": "Roga" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Creator is staffttt and the ransom is 0.5 botcoins.", "meta": { "date": "December 2016", "encryption": "AES-128+RSA", "extensions": [ ".cryptolocker" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-LDSJ7rws1WI/WGDR-oDSshI/AAAAAAAACyw/_Kn0mnjpm2YN5tS9YldEnca-zOLJpXjcACLcB/s1600/crypto1-2.gif" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/cryptolocker3-ransomware.html" ], "synonyms": [ "Fake CryptoLocker" ] }, "uuid": "4094b021-6654-49d5-9b80-a3666a1c1e44", "value": "CryptoLocker3 Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The ransom is 1.0 bitcoins.", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".crypted" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-TkMikT4PA3o/WFrb4it2u9I/AAAAAAAACww/_zZgu9EHBj8Ibar8i5ekwaowGBD8EoOygCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/proposalcrypt-ransomware.html", "http://www.archersecuritygroup.com/what-is-ransomware/", "https://twitter.com/demonslay335/status/812002960083394560", "https://twitter.com/malwrhunterteam/status/811613888705859586" ] }, "uuid": "4cf270e7-e4df-49d5-979b-c13d8ce117cc", "value": "ProposalCrypt Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The hacker demands 0.2 bitcoins. The ransomware poses as a Window update.", "meta": { "date": "December 2016", "encryption": "AES", "payment-method": "Bitcoin", "price": "0.2 (160$)", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-85wiBKXIqro/WFrFOaNeSsI/AAAAAAAACwA/UyrPc2bKQCcznmtLTFkEfc6lEvhseyRYACLcB/s1600/lock1.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/manifestus-ransomware.html", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-23rd-2016-cryptxxx-koolova-cerber-and-more/", "https://twitter.com/struppigel/status/811587154983981056" ] }, "uuid": "e62ba8f5-e7ce-44ab-ac33-713ace192de3", "value": "Manifestus Ransomware " }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The name of the hacker is humanpuff69 and he requests 0.5 bitcoins. The encryption password is based on the computer name", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".fucked" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-owEtII_eezA/WFmOp0ccjaI/AAAAAAAACvk/gjYcSeflS4AChm5cYO5c3EV4aSmzr14UwCLcB/s1600/enc100.gif" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/enkripsipc-ransomware.html", "https://twitter.com/demonslay335/status/811343914712100872", "https://twitter.com/BleepinComputer/status/811264254481494016", "https://twitter.com/struppigel/status/811587154983981056" ], "synonyms": [ "IDRANSOMv3", "Manifestus" ] }, "related": [ { "dest-uuid": "5b75db42-b8f2-4e52-81d3-f329e49e1af2", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "52caade6-ba7b-474e-b173-63f4332aa808", "value": "EnkripsiPC Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. So far the victims are from Belarus and Germany.", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".braincrypt" ], "payment-method": "Email", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-KrKO1vYs-1w/WFlw6bOfI_I/AAAAAAAACug/42w1VSl2GIoxRuA2SPKJr6xYp3c4OBnJQCLcB/s1600/note_2.png", "https://3.bp.blogspot.com/-8bxTSAADM7M/WFmBEu-eUXI/AAAAAAAACvU/xaQBufV5a-4GWEJhXj2VVLqXnTjQJYNrwCLcB/s1600/note-brain2.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/braincrypt-ransomware.html" ] }, "uuid": "ade6ec5e-e082-43cb-9b82-ff8c0f4d7e56", "value": "BrainCrypt Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Ransom is 0.2 bitcoins.", "meta": { "date": "December 2016", "encryption": "AES", "payment-method": "Bitcoin", "price": "0.2", "ransomnotes-filenames": [ "RESTORE_YOUR_FILES.txt" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-R-lKbH_tLvs/WGPRa-hCtqI/AAAAAAAAC1Y/zgKYZmys_jciaYhtTUsVLen5IHX8_LyiACLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/msn-cryptolocker-ransomware.html", "https://twitter.com/struppigel/status/810766686005719040" ] }, "uuid": "7de27419-9874-4c3f-b75f-429a507ed7c5", "value": "MSN CryptoLocker Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The ransom is in the amount is 0.3 bitcoins. The ransomware is disguises themselves as Adobe Systems, Incorporated. RaaS", "meta": { "date": "December 2016", "encryption": "RSA-2048", "payment-method": "Bitcoin", "price": "0.3", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-4Y7GZEsWh7A/WFfnmQFF7nI/AAAAAAAACsQ/j3rXZmWrDxMM6xhV1s4YVl_WLDe28cpAwCLcB/s1600/001.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/cryptoblock-ransomware.html", "https://twitter.com/drProct0r/status/810500976415281154" ] }, "uuid": "7b0df78e-8f00-468f-a6ef-3e1bda2a344c", "value": "CryptoBlock Ransomware " }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "December 2016", "encryption": "AES-256 (ECB) + RSA-2048", "extensions": [ ".aes256" ], "payment-method": "Email", "ransomnotes-filenames": [ "!!! READ THIS -IMPORTANT !!!.txt" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-GdF-kk1j9-8/WFl6NVm3PAI/AAAAAAAACvE/guFIi_FUpgIQNzX-usJ8CpofX45eXPvkQCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/aes-ni-ransomware.html" ] }, "uuid": "69c9b45f-f226-485f-9033-fcb796c315cf", "value": "AES-NI Ransomware " }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The hacker of this ransomware tends to make lots of spelling errors in his requests. With Italian text that only targets the Test folder on the user's desktop", "meta": { "date": "December 2016", "encryption": "AES-256", "extensions": [ ".encrypted" ], "payment-method": "Game", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-kz7PePfAiLI/WGTpY3us5LI/AAAAAAAAC3A/wu1rkx-BWlMzglJXXmCxeuYzbZKN5FP4gCLcB/s1600/koolova-v2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/koolova-ransomware.html", "https://www.bleepingcomputer.com/news/security/koolova-ransomware-decrypts-for-free-if-you-read-two-articles-about-ransomware/" ] }, "uuid": "ff6b8fc4-cfe0-45c1-9814-3261e39b4c9a", "value": "Koolova Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… The ransom is 1bitcoin.", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".crypt", ".emilysupp" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "HOW_OPEN_FILES.hta" ], "ransomnotes-refs": [ "https://1.bp.blogspot.com/-F8oAU82KnQ4/WFWgxjZz2vI/AAAAAAAACrI/J76wm21b5K4F9sjLF1VcEGoif3cS-Y-bwCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/fake-globe-ransomware.html", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-30th-2016-infected-tvs-and-open-source-ransomware-sucks/", "https://twitter.com/fwosar/status/812421183245287424", "https://decrypter.emsisoft.com/globeimposter", "https://twitter.com/malwrhunterteam/status/809795402421641216", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-8th-2018-crybrazil-cryptconsole-and-magniber/", "https://twitter.com/GrujaRS/status/1004661259906768896" ], "synonyms": [ "Globe Imposter", "GlobeImposter" ] }, "related": [ { "dest-uuid": "73806c57-cef8-4f7b-a78b-7949ef83b2c2", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "e03873ef-9e3d-4d07-85d8-e22a55f60c19", "value": "Fake Globe Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc…", "meta": { "date": "December 2016", "encryption": "RSA", "extensions": [ ".v8" ], "payment-method": "Email", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-Acmbpw6fEaQ/WFUFKU9V9ZI/AAAAAAAACqc/47AceoWZzOwP9qO8uenjNVOVXeFJf7DywCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/v8locker-ransomware.html" ] }, "uuid": "45862a62-4cb3-4101-84db-8e338d17e283", "value": "V8Locker Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It SUPPOSEDLY encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc., however your files are not really encrypted, only the names are changed.", "meta": { "date": "December 2016", "encryption": "RSA", "extensions": [ ".ENC" ], "payment-method": "Website", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-I0fsQu2YXMI/WFLb9LPdkFI/AAAAAAAACoY/xqRhgO1o98oruVDMC6rO4RxCk5MFDSTYgCLcB/s1600/lock.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/cryptorium-ransomware.html" ] }, "uuid": "96bd63e5-99bd-490c-a23a-e0092337f6e6", "value": "Cryptorium (Fake Ransomware)" }, { "description": "It’s directed to Russian speaking users, there fore is able to infect mosty the old USSR countries. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc … The hacker goes by the nickname Antihacker and requests the victim to send him an email for the decryption. He does not request any money only a warning about looking at porn (gay, incest and rape porn to be specific).", "meta": { "date": "December 2016", "encryption": "XOR", "extensions": [ ".antihacker2017" ], "payment-method": "Email", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-k7iDPgj17Zo/WFKEfMvR4wI/AAAAAAAACn4/8irB4Tf1x_MjfTmWaAjuae6mFJbva6GcwCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/antihacker2017-ransomware.html" ] }, "uuid": "efd64e86-611a-4e10-91c7-e741cf0c58d9", "value": "Antihacker2017 Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect users all over the world. It is spread using email spam, fake updates, attachments and so on. It SUPPOSEDLY encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… Your files are not really encrypted and nothing actually happens, however the hacker does ask the victim to pay a sum of 100$, after 5 days the sum goes up to 250$ and thereafter to 500$. After the payment is received, the victim gets the following message informing him that he has been fooled and he simply needed to delete the note. https://4.bp.blogspot.com/-T8iSbbGOz84/WFGZEbuRfCI/AAAAAAAACm0/SO8Srwx2UIM3FPZcZl7W76oSDCsnq2vfgCPcB/s1600/code2.jpg", "meta": { "date": "December 2016", "payment-method": "Dollars", "price": "100 - 250 - 500", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-6I7jtsp5Wi4/WFLqnfUvg5I/AAAAAAAACow/BCOv7etYxxwpIERR1Qs5fmJ2wKBx3sqmACLcB/s1600/screen-locker.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/cia-special-agent-767-ransomware.html", "https://www.bleepingcomputer.com/virus-removal/remove-cia-special-agent-767-screen-locker", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-16th-2016-samas-no-more-ransom-screen-lockers-and-more/", "https://guides.yoosecurity.com/cia-special-agent-767-virus-locks-your-pc-screen-how-to-unlock/" ] }, "uuid": "e479e32e-c884-4ea0-97d3-3c3356135719", "value": "CIA Special Agent 767 Ransomware (FAKE!!!)" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… This hacker request your IP address in return for the decryption.", "meta": { "date": "December 2016", "payment-method": "Email", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-LY1A0aeA_c0/WFEduvkiNQI/AAAAAAAACjk/B2-nFQoExscMVvZqvCaf9R4z_C6-rSdvACLcB/s1600/note2.png.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/loveserver-ransomware.html" ] }, "uuid": "d1698a73-8be8-4c10-8114-8cfa1c399eb1", "value": "LoveServer Ransomware " }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… The hacker requests 2 bitcoins in return for the files.", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".kraken", "[base64].kraken" ], "payment-method": "Bitcoin", "price": "2", "ransomnotes-filenames": [ "_HELP_YOUR_FILES.html" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-E4brsgJRDHA/WFBU7wPaYLI/AAAAAAAACjU/sLEkzMiWp5wuc8hpFbylC7lLVMhftCLGgCLcB/s1600/111m.png", "https://2.bp.blogspot.com/-b5caw8XAvIQ/WFBUuOto40I/AAAAAAAACjQ/_yzwIU17BHw4Ke4E3wM_XBI1XfnAvGSZQCLcB/s1600/005.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/kraken-ransomware.html" ] }, "uuid": "51737c36-11a0-4c25-bd87-a990bd479aaf", "value": "Kraken Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… The ransom is 0.25 bitcoins and the nickname of the hacker is FRC 2016.", "meta": { "date": "December 2016", "encryption": "AES", "payment-method": "Bitcoin", "price": "0.25", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-6iMtvGe3T58/WE8Ftx7zcUI/AAAAAAAACiE/2ISTxSYzgKEgnfQ7FSUWo3BiCeVLHH_uwCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/antix-ransomware.html" ] }, "uuid": "8a7e0615-b9bd-41ab-89f1-62d041350e99", "value": "Antix Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… The ransom is R$950 which is due in 5 days. (R$ is a Brazilian currency) Based off of Hidden-Tear", "meta": { "date": "December 2016", "encryption": "AES-256", "extensions": [ ".sexy" ], "payment-method": "Bitcoin", "price": "950 bresilian real ($)", "ransomnotes-filenames": [ "!!!!!ATENÇÃO!!!!!.html" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-MWEyG49z2Qk/WE78wLqCXPI/AAAAAAAAChw/SIlQSe_o_wMars2egfZ7VqKfWuan6ThwQCLcB/s1600/note1.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/payday-ransomware.html", "https://twitter.com/BleepinComputer/status/808316635094380544" ] }, "uuid": "70324b69-6076-4d00-884e-7f9d5537a65a", "value": "PayDay Ransomware " }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is NOT spread using email spam, fake updates, attachments and so on. It simply places a decrypt file on your computer.", "meta": { "date": "December 2016", "encryption": "AES-256", "extensions": [ ".encrypted" ], "payment-method": "no ransom", "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/slimhem-ransomware.html" ] }, "uuid": "76b14980-e53c-4209-925e-3ab024210734", "value": "Slimhem Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… FILES DON’T REALLY GET DELETED NOR DO THEY GET ENCRYPTED!!!!!!!", "meta": { "date": "December 2016", "encryption": "AES-256", "payment-method": "Bitcoin", "price": "0.3", "ransomnotes": [ "I want to play a game with you. Let me explain the rules. Your personal files are being deleted. Your photos, videos, documents, etc... But, don't worry! It will only happen if you don't comply. However I've already encrypted your personal files, so you cannot access therm. Every hour I select some of them to delete permanently, therefore I won't be able to access them, either. Are you familiar with the concept of exponential growth? Let me help you out. It starts out slowly then increases rapidly. During the first 24 hour you will only lose a few files, the second day a few hundred, the third day a few thousand, and so on. If you turn off your computer or try to close me, when i start the next time you will het 1000 files deleted as punishment. Yes you will want me to start next time, since I am the only one that is capable to decrypt your personal data for you. Now, let's start and enjoy our little game together! Send 0.3 bitcoins to this adress to unlock your Pc with your email adress Your can purchase bitcoins from localbitcoins" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-9MsC3A3tuUA/WFGZM45Pw5I/AAAAAAAACms/NbDFma30D9MpK2Zc0O6NvDizU8vqUWWlwCLcB/s1600/M4N1F3STO.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/m4n1f3sto-ransomware.html" ] }, "uuid": "94a3be6b-3a83-40fb-85b2-555239260235", "value": "M4N1F3STO Ransomware (FAKE!!!!!)" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… CHIP > DALE", "meta": { "date": "December 2016", "encryption": "AES+RSA-512", "extensions": [ ".DALE" ], "payment-method": "Email", "synonyms": [ "DaleLocker Ransomware" ] }, "uuid": "abe6cbe4-9031-46da-9e1c-89d9babe6449", "value": "Dale Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… Based on the idiotic open-source ransomware called CryptoWire", "meta": { "date": "December 2016", "encryption": "AES-256", "extensions": [ ".locked (added before the ending, not to the ending, for example: file.locked.doc" ], "payment-method": "Bitcoin", "price": "1000 $", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-DOjKnuzCMo8/WE1Xd8yksiI/AAAAAAAACfo/d93v2xn857gQDg4o5Rd4oZpP3q-Ipv9xgCLcB/s1600/UltraLocker.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/ultralocker-ransomware.html", "https://twitter.com/struppigel/status/807161652663742465" ] }, "uuid": "3a66610b-5197-4af9-b662-d873afc81b2e", "value": "UltraLocker Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc…", "meta": { "date": "December 2016", "encryption": "AES-256 and RSA-2048", "extensions": [ ".pre_alpha" ], "payment-method": "Email", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-6NIoKnSTwcs/WExcV900C_I/AAAAAAAACfI/_Hba3mOwk3UQ0T5rGercOglMsCTjVtCnQCLcB/s1600/note2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/aeskeygenassist-ransomware.html", "https://id-ransomware.blogspot.co.il/2016/09/dxxd-ransomware.html", "https://www.bleepingcomputer.com/forums/t/634258/aes-key-gen-assistprotonmailcom-help-support/" ] }, "uuid": "d755510f-d775-420c-83a0-b0fe9e483256", "value": "AES_KEY_GEN_ASSIST Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "December 2016", "encryption": "AES-256 and RSA-2048", "extensions": [ ".locky" ], "payment-method": "Bitcoin", "price": "0.5 - 1", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-Lyd1uRKG-94/WFJ3TbNqWfI/AAAAAAAACnc/4LoazYU0S1s1YRz3Xck3LN1vOm5RwIpugCLcB/s1600/note.jpg", "https://4.bp.blogspot.com/-eBeh1lzEYsI/WFJ4l1oJ4fI/AAAAAAAACno/P5inceelNNk-zfkJGhE3XNamOGC8YmBwwCLcB/s1600/str123.gif" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/code-virus-ransomware.html" ] }, "uuid": "a23d7c45-7200-4074-9acf-8789600fa145", "value": "Code Virus Ransomware " }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "December 2016", "encryption": "Blowfish", "extensions": [ "_morf56@meta.ua_" ], "payment-method": "Email", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-Fh2I6542zi4/WEpmphY0i1I/AAAAAAAACe4/FBP3J6UraBMkSMTWx2tm-FRYnmlYLtFWgCLcB/s1600/note2.png.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/flkr-ransomware.html" ] }, "uuid": "1cdc34ce-43b7-4df1-ae8f-ae0acbe5e4ad", "value": "FLKR Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. These hackers claim to be students from Syria. This ransomware poses as the popular torrent movie screener called PopCorn. These criminals give you the chance to retrieve your files “for free” by spreading this virus to others. Like shown in the note bellow: https://www.bleepstatic.com/images/news/ransomware/p/Popcorn-time/refer-a-friend.png", "meta": { "date": "December 2016", "encryption": "AES-256", "extensions": [ ".kok", ".filock" ], "payment-method": "Bitcoin", "price": "0.5 - 1", "ransomnotes-filenames": [ "restore_your_files.html", "restore_your_files.txt" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-WxtRn5yVcNw/WEmgAPgO4AI/AAAAAAAACeo/M7iS6L8pSOEr8EUDkCK_g6h0aMKQQXfGwCLcB/s1600/note2.png", "https://3.bp.blogspot.com/-sLwR-6y2M-I/WEmVIdJuPMI/AAAAAAAACeY/gpQDT-2-d7kkrfTHgiEZCfxViHu7dNE7ACLcB/s1600/med.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/popcorntime-ransomware.html", "https://www.bleepingcomputer.com/news/security/new-scheme-spread-popcorn-time-ransomware-get-chance-of-free-decryption-key/" ] }, "uuid": "c1b3477b-cd7f-4726-8744-a2c44275dffd", "value": "PopCorn Time Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… NO POINT OF PAYING THE RANSOM—THE HACKER DOES NOT GIVE A DECRYPT AFTERWARDS.", "meta": { "date": "December 2016", "encryption": "AES-256", "extensions": [ ".hacked" ], "payment-method": "Bitcoin", "price": "0.33 - 0.5", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-G-xrI4N08hs/WFJjQgB3ojI/AAAAAAAACnM/DEfy_skSg044UmbBfNodiQY4OaLkkQPOwCLcB/s1600/note-hacked.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/hackedlocker-ransomware.html" ] }, "uuid": "c2624d8e-da7b-4d94-b06f-363131ddb6ac", "value": "HackedLocker Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc…", "meta": { "date": "December 2016", "encryption": "AES(CBC)", "extensions": [ "." ], "payment-method": "Bitcoin", "price": "1.33 - 1.34", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-qcJxWivTx1w/WEcEW14om5I/AAAAAAAACa4/xLAlsQGZjeg7Zlg3F2fQAcgQ_6b_cNQLACLcB/s1600/goldeneye-1.jpg", "https://4.bp.blogspot.com/-avE8liOWdPY/WEcEbdTxx6I/AAAAAAAACa8/KOKgXzU1h2EJ0tTOKMdQzZ_JdWWNeFMdwCLcB/s1600/goldeneye-1-2.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/goldeneye-ransomware.html", "https://www.bleepingcomputer.com/news/security/petya-ransomware-returns-with-goldeneye-version-continuing-james-bond-theme/", "https://www.bleepingcomputer.com/forums/t/634778/golden-eye-virus/" ] }, "related": [ { "dest-uuid": "7c5a1e93-7ab2-4b08-ada9-e82c4feaed0a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "ac7affb8-971d-4c05-84f0-172b61d007d7", "value": "GoldenEye Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc…", "meta": { "date": "December 2016", "encryption": "AES", "extensions": [ ".sage" ], "payment-method": "Bitcoin", "price": "0.74 (545 $)", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-GasUzax8cco/WEar0U0tPqI/AAAAAAAACZw/6V_1JFxLMH0UnmLa3-WZa_ML9JbxF0JYACEw/s1600/note-txt2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/sage-ransomware.html", "https://www.bleepingcomputer.com/forums/t/634978/sage-file-sample-extension-sage/", "https://www.bleepingcomputer.com/forums/t/634747/sage-20-ransomware-sage-support-help-topic/" ] }, "uuid": "3e5a475f-7467-49ab-917a-4d1f590ad9b4", "value": "Sage Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc… This hacker requests 4 bitcoins for ransom.", "meta": { "date": "December 2016", "encryption": "AES and RSA-1024", "extensions": [ ".VO_" ], "payment-method": "Bitcoin", "price": "4(1040 $)", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-Lhq40sgYUpI/WEWpGkkWOKI/AAAAAAAACZQ/iOp9g9Ya0Fk9vZrNKwTEMVcEOzKFIwqgACLcB/s1600/english-2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/12/sq-vo-ransomware.html" ], "synonyms": [ "VO_ Ransomware" ] }, "uuid": "5024f328-2595-4dbd-9007-218147e55d5f", "value": "SQ_ Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc…", "meta": { "date": "December 2016", "encryption": "AES and RSA", "extensions": [ ".MATRIX", ".[Files4463@tuta.io]", ".[RestorFile@tutanota.com]", "[KOK8@protonmail.com].-.KOK8", ".FOX", ".EMAN50", ".GMAN", ".NOBAD", ".ITLOCK" ], "payment-method": "Email", "ransomnotes": [ "WHAT HAPPENED WITH YOUR FILES?\nYour documents, databases, backups, network folders and other important files are encrypted with RSA-2048 and AES-128 ciphers.\nMore information about the RSA and AES can be found here:\nhttp://en.wikipedia.org/wiki/RSA_(cryptosystem)\nhttp://en.wikipedia.org/wiki/Advanced_Encryption_Standard\nIt mеаns thаt yоu will nоt bе аblе tо аccеss thеm аnуmоrе until thеу аrе dесrуptеd with yоur pеrsоnаl dесrуptiоn kеy! Withоut уоur pеrsоnаl kеy аnd sреciаl sоftwаrе dаtа rеcоvеrу is impоssiblе! If yоu will fоllоw оur instruсtiоns, wе guаrаntее thаt yоu cаn dесryрt аll yоur filеs quiсkly аnd sаfеly!\nIf yоu wаnt tо rеstоrе yоur filеs, plеаsе writе us tо thе е-mаils:\nFiles4463@tuta.io\nFiles4463@protonmail.ch\nFiles4463@gmail.com\nIn subjеct linе оf your mеssаgе writе yоur pеrsоnаl ID:\n4292D68970C047D9\nWе rесоmmеnd yоu tо sеnd yоur mеssаgе ОN ЕАСH оf ОUR 3 ЕМАILS, duе tо thе fасt thаt thе mеssаgе mау nоt rеаch thеir intеndеd rеcipiеnt fоr а vаriеtу оf rеаsоns!\nPlеаsе, writе us in Еnglish оr usе prоfеssiоnаl trаnslаtоr!\nIf yоu wаnt tо rеstоrе yоur filеs, yоu hаvе tо pаy fоr dесrуptiоn in Bitсоins. Thе pricе dереnds оn hоw fаst уоu writе tо us.\nYour message will be as confirmation you are ready to pay for decryption key. After the payment you will get the decryption tool with instructions that will decrypt all your files including network folders.\nTо cоnfirm thаt wе cаn dесryрt yоur filеs yоu cаn sеnd us up tо 3 filеs fоr frее dесrурtiоn. Plеаsе nоte thаt filеs fоr frее dесrурtiоn must NОT cоntаin аnу vаluаblе infоrmаtiоn аnd thеir tоtаl sizе must bе lеss thаn 5Mb.\nYоu hаvе tо rеspоnd аs sооn аs pоssiblе tо еnsurе thе rеstоrаtiоn оf yоur filеs, bеcаusе wе wоnt kееp yоur dеcrуptiоn kеys аt оur sеrvеr mоre thаn оne wееk in intеrеst оf оur sеcuritу.\nNоtе thаt аll thе аttеmpts оf dесryptiоn by yоursеlf оr using third pаrty tооls will rеsult оnly in irrеvосаble lоss оf yоur dаtа.\n\nIf yоu did nоt rеcеivе thе аnswеr frоm thе аfоrеcitеd еmаils fоr mоrе then 6 hours, рlеаsе сhеck SРАМ fоldеr!\nIf yоu did nоt rеcеivе thе аnswеr frоm thе аfоrеcitеd еmаils fоr mоrе then 12 hours, рlеаsе trу tо sеnd уоur mеssаgе with аnоthеr еmаil sеrviсе!\nIf yоu did nоt rеcеivе thе аnswеr frоm thе аfоrеcitеd еmаils fоr mоrе then 24 hours (еvеn if уоu hаvе prеviоuslу rесеivеd аnswеr frоm us), рlеаsе trу tо sеnd уоur mеssаgе with аnоthеr еmаil sеrviсе tо еасh оf оur 3 еmаils!\nАnd dоn't fоrgеt tо chеck SPАМ fоldеr!", "HOW TO RECOVER YOUR FILES INSTRUCTION\nATENTION!!!\nWe are realy sorry to inform you that ALL YOUR FILES WERE ENCRYPTED \nby our automatic software. It became possible because of bad server security.\nATENTION!!!\nPlease don't worry, we can help you to RESTORE your server to original\nstate and decrypt all your files quickly and safely!\n\nINFORMATION!!!\nFiles are not broken!!!\nFiles were encrypted with AES-128+RSA-2048 crypto algorithms.\nThere is no way to decrypt your files without unique decryption key and special software. Your unique decryption key is securely stored on our server. For our safety, all information about your server and your decryption key will be automaticaly DELETED AFTER 7 DAYS! You will irrevocably lose all your data!\n* Please note that all the attempts to recover your files by yourself or using third party tools will result only in irrevocable loss of your data!\n* Please note that you can recover files only with your unique decryption key, which stored on our side. If you will use the help of third parties, you will only add a middleman.\n\nHOW TO RECOVER FILES???\nPlease write us to the e-mail (write on English or use professional translator):\nPabFox@protonmail.com \nFoxHelp@cock.li\nFoxHelp@tutanota.com\nYou have to send your message on each of our 3 emails due to the fact that the message may not reach their intended recipient for a variety of reasons!\n\nIn subject line write your personal ID:\n[id]\nWe recommed you to attach 3 encrypted files to your message. We will demonstrate that we can recover your files. \n* Please note that files must not contain any valuable information and their total size must be less than 5Mb. \n\nOUR ADVICE!!!\nPlease be sure that we will find common languge. We will restore all the data and give you recommedations how to configure the protection of your server.\n\nWe will definitely reach an agreement ;) !!!" ], "ransomnotes-filenames": [ "[5 numbers]-MATRIX-README.RTF", "!ReadMe_To_Decrypt_Files!.rtf", "#Decrypt_Files_ReadMe#.rtf", "#KOK8_README#.rtf", "#FOX_README#.rtf", "!README_GMAN!.rtf", "#README_EMAN50#.rtf", "#NOBAD_README#.rtf", "!ITLOCK_README!.rtf" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-RGHgroHt5cU/WEUWnFBn2hI/AAAAAAAACYA/zwSf7rmfWdo4ESQ8kjwj6mJrfzL2V22mgCLcB/s1600/note-eng.png", "https://www.bleepstatic.com/images/news/ransomware/m/matrix/4-7-2018/1/ransom-note.jpg", "https://www.bleepstatic.com/images/news/ransomware/m/matrix/4-7-2018/1/background.jpg", "https://www.bleepstatic.com/images/news/ransomware/m/matrix/4-7-2018/2/wallpaper.jpg", "https://pbs.twimg.com/media/DZ4VCRpWsAYtckw.jpg", "https://pbs.twimg.com/media/DZ4V8uXWsAI0r1v.jpg", "https://pbs.twimg.com/media/Do_pn7bX0AYh1F-.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-2nd-2016-screenlockers-kangaroo-the-sfmta-and-more/", "https://id-ransomware.blogspot.co.il/2016/12/matrix-ransomware.html", "https://twitter.com/rommeljoven17/status/804251901529231360", "https://www.bleepingcomputer.com/news/security/new-matrix-ransomware-variants-installed-via-hacked-remote-desktop-services/", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/", "https://twitter.com/demonslay335/status/1034212374805278720", "https://www.bleepingcomputer.com/news/security/new-fox-ransomware-matrix-variant-tries-its-best-to-close-all-file-handles/", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-12th-2018-notpetya-gandcrab-and-more/", "https://twitter.com/demonslay335/status/1049314118409306112", "https://twitter.com/demonslay335/status/1050118985210048512", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-14th-2018-kraken-dharma-and-matrix/", "https://twitter.com/demonslay335/status/1039907030570598400" ], "synonyms": [ "Malta Ransomware", "Matrix Ransomware" ] }, "uuid": "42ee85b9-45f8-47a3-9bab-b695ac271544", "value": "Matrix" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".locked" ], "payment-method": "Email", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-anaLWyg_iJI/WFaxDs8KI3I/AAAAAAAACro/yGXh3AV-ZpAKmD4fpQbBkAyYXXnkqgR3ACLcB/s1600/note666_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/satan666-ransomware.html" ] }, "uuid": "03d92e7b-95ae-4c5b-8b58-daa2fd98f7a1", "value": "Satan666 Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on HiddenTear", "meta": { "date": "November 2016", "encryption": "AES-256", "extensions": [ ".R.i.P" ], "payment-method": "Bitcoin", "price": "0.2", "ransomnotes-filenames": [ "Important!.txt" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-D-j_9_LZen0/WEPq4G5w5FI/AAAAAAAACXs/GTnckI3CGYQxuDMPXBzpGXDtarPK8yJ5wCLcB/s1600/note_2.PNG" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/rip-ransomware.html", "https://twitter.com/BleepinComputer/status/804810315456200704" ], "synonyms": [ "RIP", "Phoenix" ] }, "uuid": "5705df4a-42b0-4579-ad9f-8bfa42bae471", "value": "RIP (Phoenix) Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on RemindMe", "meta": { "date": "November 2016", "encryption": "AES-256", "extensions": [ ".novalid" ], "payment-method": "Bitcoin - Link WebSite", "ransomnotes-filenames": [ "RESTORE_CORUPTED_FILES.HTML" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-BK_31ORE0ZY/WD284cEVoLI/AAAAAAAACWA/bU0n3MBMD8Mbgzv9bD6VLJb51Q_kr5AJgCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/novalid-ransomware.html", "https://www.bleepingcomputer.com/forums/t/634754/locked-in-ransomware-help-support-restore-corupted-fileshtml/", "https://twitter.com/struppigel/status/807169774098796544" ], "synonyms": [ "Locked-In Ransomware", "NoValid Ransomware" ] }, "uuid": "777f0b78-e778-435f-b4d5-e40f0b7f54c3", "value": "Locked-In Ransomware or NoValid Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES", "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/chartwig-ransomware.html" ] }, "uuid": "37fff5f8-8e66-43d3-a075-3619b6f2163d", "value": "Chartwig Ransomware" }, { "description": "It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The files don’t actually get encrypted, their names get changed using this formula: [www-hash-part-]+[number]+[.crypter]", "meta": { "date": "November 2016", "encryption": "Rename > Ren + Locker", "extensions": [ ".crypter" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-281TI8xvMLo/WDw2Nl72OsI/AAAAAAAACTk/nT_rL0z-Exo93FzoOXnyaFgQ7wPe0r7IgCLcB/s1600/Crypter1.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/renlocker-ransomware.html" ] }, "uuid": "957850f7-081a-4191-9e5e-cf9ff27584ac", "value": "RenLocker Ransomware (FAKE)" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES", "payment-method": "Email", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-2dC_gQTed4o/WDxRSh_R-MI/AAAAAAAACT4/yWxzCcMqN_8GLjd8dOPf6Mw16mkbfALawCLcB/s1600/lblMain.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/thanksgiving-ransomware.html", "https://id-ransomware.blogspot.co.il/2016/07/stampado-ransomware-1.html", "https://twitter.com/BleepinComputer/status/801486420368093184" ] }, "uuid": "459ea908-e39e-4274-8866-362281e24911", "value": "Thanksgiving Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "RSA", "extensions": [ ".hannah" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-refs": [ "https://1.bp.blogspot.com/--45C2Cr8sXc/WDiWLTvW-ZI/AAAAAAAACSA/JnJNRr8Kti0YqSnfhPQBF2rsFf-au1g9ACLcB/s1600/Cockblocke.gif" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/cockblocker-ransomware.html", "https://twitter.com/jiriatvirlab/status/801910919739674624" ] }, "uuid": "3a40c5ae-b117-45cd-b674-a7750e3f3082", "value": "CockBlocker Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on the idiotic open-source ransomware called CryptoWire", "meta": { "date": "November 2016", "encryption": "AES-256", "extensions": [ ".encrypted" ], "payment-method": "Bitcoin", "price": "0.68096697 (500$)", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-nXv88GxxOvQ/WE1gqeD3ViI/AAAAAAAACf4/wcVwQ9Pi_JEP2iWNHoBGmeXKJFsfwmwtwCLcB/s1600/Lomix.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/lomix-ransomware.html", "https://twitter.com/siri_urz/status/801815087082274816" ] }, "uuid": "e721b7c5-df07-4e26-b375-fc09a4911451", "value": "Lomix Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. https://3.bp.blogspot.com/--jubfYRaRmw/WDaOyZXkAaI/AAAAAAAACQE/E63a4FnaOfACZ07s1xUiv_haxy8cp5YCACLcB/s1600/ozoza2.png", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".locked", ".Locked" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "HOW TO DECRYPT YOU FILES.txt" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-r-vBnl-wLwo/WDg7fHph9BI/AAAAAAAACRc/VuMxWa1nUPIGHCzhCf2AyL_uc7Z9iB6MACLcB/s1600/note_2.PNG" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/ozozalocker-ransomware.html", "https://decrypter.emsisoft.com/ozozalocker", "https://twitter.com/malwrhunterteam/status/801503401867673603" ] }, "uuid": "d20b0d12-1a56-4339-b02b-eb3803dc3e6e", "value": "OzozaLocker Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".mo0n" ], "payment-method": "WebSite link", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-8-8X7Nd1MYs/WDSZN6NIT1I/AAAAAAAACNg/ltc7ppfZZL0vWn8BV3Mk9BVrdmJbcEnpgCLcB/s1600/222.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/crypute-ransomware-m0on.html", "https://www.bleepingcomputer.com/virus-removal/threat/ransomware/" ], "synonyms": [ "m0on Ransomware" ] }, "uuid": "5539c8e7-2058-4757-b9e3-71ff7d41db31", "value": "Crypute Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES-256 + RSA", "extensions": [ ".maktub" ], "payment-method": "Bitcoin", "price": "0,5 - 1,5", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-_i9AjhlvjB8/WDVuLKBnmlI/AAAAAAAACOA/xISXMTBLMbEH4PBS35DQ416woPpkuiVvQCLcB/s1600/note-2.PNG", "https://2.bp.blogspot.com/-4HNc9S8SY4I/WBMkpdKyDsI/AAAAAAAAB0I/udESgro7YB4pF98Dv2KrrecyymFGsvV2QCLcB/s1600/note.JPG" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/nmoreira-ransomware.html", "https://id-ransomware.blogspot.co.il/2016/10/airacrop-ransomware.html" ], "synonyms": [ "Fake Maktub Ransomware" ] }, "uuid": "9490641f-6a51-419c-b3dc-c6fa2bab4ab3", "value": "NMoreira Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. The ransom amount is 349.99$ and the hacker seems to be from India. He disguises himself as Microsoft Support.", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".vindows" ], "payment-method": "Call Number", "price": "349.99$", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-61DcGSFljUk/WDM2UpFZ02I/AAAAAAAACMw/smvauQCvG3IPHOtEjPP4ocGKmBhVRBv-wCLcB/s1600/lock-note.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/vindowslocker-ransomware.html", "https://malwarebytes.app.box.com/s/gdu18hr17mwqszj3hjw5m3sw84k8hlph", "https://rol.im/VindowsUnlocker.zip", "https://twitter.com/JakubKroustek/status/800729944112427008", "https://www.bleepingcomputer.com/news/security/vindowslocker-ransomware-mimics-tech-support-scam-not-the-other-way-around/" ] }, "uuid": "b58e1265-2855-4c8a-ac34-bb1504086084", "value": "VindowsLocker Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Here is the original ransomware under this name: http://id-ransomware.blogspot.co.il/2016/09/donald-trump-ransomware.html", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".ENCRYPTED" ], "payment-method": "no ransom", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-RwJ6R-uvYg0/V-qfeRPz7GI/AAAAAAAABi8/7x4MxRP7Jp8edbTJqz4iuEye0q1u5k3pQCLcB/s1600/donald-trump-ransomware.jpg", "https://www.bleepingcomputer.com/news/security/the-donald-trump-ransomware-tries-to-build-walls-around-your-files/" ], "refs": [ "http://id-ransomware.blogspot.co.il/2016/09/donald-trump-ransomware.html", "https://www.bleepingcomputer.com/news/security/the-donald-trump-ransomware-tries-to-build-walls-around-your-files/" ] }, "uuid": "96c10791-258f-4b2b-a2cc-b5abddbdb285", "value": "Donald Trump 2 Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Looks for C:\\Temp\\voldemort.horcrux", "meta": { "date": "November 2016", "encryption": "RSA", "payment-method": "CreditCard", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-qJHhbtoL1Y4/V-lOClxieEI/AAAAAAAABis/IbnVAY8hnmEfU8_iU1CgQ3FWeX4YZOkBACLcB/s1600/Nagini.jpg" ], "refs": [ "http://id-ransomware.blogspot.co.il/2016/09/nagini-voldemort-ransomware.html", "https://www.bleepingcomputer.com/news/security/the-nagini-ransomware-sics-voldemort-on-your-files/" ], "synonyms": [ "Voldemort Ransomware" ] }, "uuid": "46a35af7-9d05-4de4-a955-41ccf3d3b83b", "value": "Nagini Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".l0cked", ".L0cker" ], "payment-method": "Bitcoin", "price": "100$", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-0N1ZUh4WcxQ/WDCfENY1eyI/AAAAAAAACKE/_RVIxRCwedMrD0Tj9o6-ew8u3pL0Y5w8QCLcB/s1600/lock-note2.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/shelllocker-ransomware.html", "https://twitter.com/JakubKroustek/status/799388289337671680" ] }, "uuid": "a8ea7a67-c019-4c6c-8061-8614c47f153e", "value": "ShellLocker Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES + RSA-512", "extensions": [ ".CHIP", ".DALE" ], "payment-method": "Tor WebSite", "ransomnotes-filenames": [ "CHIP_FILES.txt" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-OvB9TMJoimE/WC9QXRPFNwI/AAAAAAAACJU/iYcCC9tKvGIu4jH2bd6xLvmO7KMVVCLdgCLcB/s1600/note_2.PNG" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/chip-ransomware.html", "http://malware-traffic-analysis.net/2016/11/17/index.html", "https://www.bleepingcomputer.com/news/security/rig-e-exploit-kit-now-distributing-new-chip-ransomware/" ], "synonyms": [ "ChipLocker Ransomware" ] }, "uuid": "7487fd37-d4ba-4c85-b6f8-8d4d7d5b74d7", "value": "Chip Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. CrySiS > Dharma Note: ATTENTION! At the moment, your system is not protected. We can fix it and restore files. To restore the system write to this address: bitcoin143@india.com. CrySiS variant", "meta": { "date": "November 2016", "encryption": "AES + RSA-512", "extensions": [ ".dharma", ".wallet", ".zzzzz", ".cmb", ".id-BCBEF350.[paymentbtc@firemail.cc].cmb", ".bip", ".id-BCBEF350.[Beamsell@qq.com].bip", ".boost", ".[Darknes@420blaze.it].waifu", ".brrr", ".adobe", ".tron", ".AUDIT", ".cccmn", ".fire", ".myjob", ".[cyberwars@qq.com].war", ".risk", ".RISK", ".bkpx", ".[newsantaclaus@aol.com].santa" ], "payment-method": "Bitcoin - Email", "ransomnotes": [ "all your data has been locked us\nYou want to return?\nwrite email paymentbtc@firemail.cc", "All your files have been encrypted!\nAll your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail paymentbtc@firemail.cc\nWrite this ID in the title of your message ACBFF130\nIn case of no answer in 24 hours write us to theese e-mails:paymentbtc@firemail.cc\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.\nFree decryption as guarantee\nBefore paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)\nHow to obtain Bitcoins\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\nhttps://localbitcoins.com/buy_bitcoins\nAlso you can find other places to buy Bitcoins and beginners guide here:\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\nAttention!\nDo not rename encrypted files.\nDo not try to decrypt your data using third party software, it may cause permanent data loss.\nDecryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.", "All your files have been encrypted!\nAll your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail Beamsell@qq.com\nWrite this ID in the title of your message BCBEF350\nIn case of no answer in 24 hours write us to theese e-mails:Beamsell@qq.com\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. \nFree decryption as guarantee\nBefore paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) \nHow to obtain Bitcoins\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. \nhttps://localbitcoins.com/buy_bitcoins \nAlso you can find other places to buy Bitcoins and beginners guide here: \nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/ \nAttention!\nDo not rename encrypted files. \nDo not try to decrypt your data using third party software, it may cause permanent data loss.\nDecryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.", "all your data has been locked us\nYou want to return?\nwrite email Beamsell@qq.com" ], "ransomnotes-filenames": [ "README.txt", "README.jpg", "Info.hta", "FILES ENCRYPTED.txt", "INFO.hta" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/d/dharma/cmb/hta-ransom-note.jpg", "https://pbs.twimg.com/media/Dmof_FiXsAAAvTN.jpg", "https://pbs.twimg.com/media/Dmof_FyXsAEJmgQ.jpg", "https://pbs.twimg.com/media/DrWqLWzXgAc4SlG.jpg", "https://pbs.twimg.com/media/DuEBIMBW0AANnGW.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/dharma-ransomware.html", "https://www.bleepingcomputer.com/news/security/kaspersky-releases-decryptor-for-the-dharma-ransomware/", "https://www.bleepingcomputer.com/news/security/new-cmb-dharma-ransomware-variant-released/", "https://www.bleepingcomputer.com/news/security/new-bip-dharma-ransomware-variant-released/", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-12th-2018-notpetya-gandcrab-and-more/", "https://twitter.com/demonslay335/status/1049313390097813504", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-14th-2018-kraken-dharma-and-matrix/", "https://twitter.com/JakubKroustek/status/1038680437508501504", "https://twitter.com/demonslay335/status/1059521042383814657", "https://twitter.com/demonslay335/status/1059940414147489792", "https://twitter.com/JakubKroustek/status/1060825783197933568", "https://twitter.com/JakubKroustek/status/1064061275863425025", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-23rd-2018-stop-dharma-and-more/", "https://www.youtube.com/watch?v=qjoYtwLx2TI", "https://twitter.com/GrujaRS/status/1072139616910757888" ] }, "uuid": "2b365b2c-4a9a-4b66-804d-3b2d2814fe7b", "value": "Dharma Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".angelamerkel" ], "payment-method": "Bitcoin", "price": "1200€", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-QaJ-Z27tL7s/WDCvwYY2UVI/AAAAAAAACKg/swpf1eKf1Y8oYIK5U8gbfi1H9AQ3Q3r8QCLcB/s1600/angela-merkel.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/angela-merkel-ransomware.html", "https://twitter.com/malwrhunterteam/status/798268218364358656" ] }, "uuid": "a9bb4ae1-b4da-49bb-aeeb-3596cb883860", "value": "Angela Merkel Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES-256 + RSA-2048", "extensions": [ "._luck" ], "payment-method": "Bitcoin", "price": "0.7 - 2.1", "ransomnotes": [ "%AppData%\\@WARNING_FILES_ARE_ENCRYPTED.[victim_id].txt." ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-skwh_-RY50s/WDK2XLhtt3I/AAAAAAAACL0/CaZ0A_fl2Zk-YZYU9g4QCQZkODpicbXpQCLcB/s1600/note_2.PNG", "https://4.bp.blogspot.com/-tCYSY5fpE5Q/WDLLZssImkI/AAAAAAAACMg/7TmWPW3k4jQuGIYZN_dCxcSGcY_c4po9wCLcB/s1600/note3_2.PNG" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/cryptoluck-ransomware.html", "http://www.bleepingcomputer.com/news/security/cryptoluck-ransomware-being-malvertised-via-rig-e-exploit-kits/", "https://twitter.com/malwareforme/status/798258032115322880" ], "synonyms": [ "YafunnLocker" ] }, "uuid": "615b682d-4746-464d-8091-8869d0e6ea2c", "value": "CryptoLuck Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES-256 + RSA + SHA-256", "extensions": [ "_crypt", ".id-_locked", ".id-_locked_by_krec", ".id-_locked_by_perfect", ".id-_x3m", ".id-_r9oj", ".id-_garryweber@protonmail.ch", ".id-_steaveiwalker@india.com_", ".id-_julia.crown@india.com_", ".id-_tom.cruz@india.com_", ".id-_CarlosBoltehero@india.com_", ".id-_maria.lopez1@india.com_" ], "payment-method": "Bitcoin", "price": "0.2 - 2", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-2fAMkigwn4E/WCs1vKiB9UI/AAAAAAAACIs/_kgk8U9wfisV0MTYInIbArwL8zgLyBDIgCLcB/s1600/note-eng.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/crypton-ransomware.html", "https://decrypter.emsisoft.com/crypton", "https://www.bleepingcomputer.com/news/security/crypton-ransomware-is-here-and-its-not-so-bad-/", "https://twitter.com/JakubKroustek/status/829353444632825856" ], "synonyms": [ "Nemesis", "X3M" ] }, "uuid": "117693d2-1551-486e-93e5-981945eecabd", "value": "Crypton Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. pretends to be a Windows optimization program called Windows-TuneUp", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".karma" ], "links": [ "http://3nvzqyo6l4wkrzumzu5aod7zbosq4ipgf7ifgj3hsvbcr5vcasordvqd.onion" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-filenames": [ "# DECRYPT MY FILES #.html", "# DECRYPT MY FILES #.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/k/karma-ransomware/ransom-note.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/karma-ransomware.html", "https://www.bleepingcomputer.com/news/security/researcher-finds-the-karma-ransomware-being-distributed-via-pay-per-install-network/", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-18th-2016-crysis-cryptoluck-chip-and-more/" ] }, "uuid": "51596eaa-6df7-4aa3-8df4-cec3aeffb1b5", "value": "Karma Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-CTLT300bjNk/WCg9mrJArSI/AAAAAAAACGk/weWSqTMVS9AXdxJh_SA06SOH4kh2VGW1gCLcB/s1600/note_2.PNG.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/wickedlocker-ht-ransomware.html" ] }, "uuid": "878c06be-95d7-4a0d-9dba-178ffc1d3e5e", "value": "WickedLocker HT Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. CryptoLocker Copycat", "meta": { "date": "November 2016", "encryption": "AES or XOR", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "0.55 - 0.65", "ransomnotes-filenames": [ "Your files are locked !.txt", "Your files are locked !!.txt", "Your files are locked !!!.txt", "Your files are locked !!!!.txt", "%AppData%\\WinCL\\winclwp.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/old-cryptolocker-copycat-named-pclock-resurfaces-with-new-attacks/", "https://id-ransomware.blogspot.co.il/2016/11/suppteam-ransomware-sysras.html", "http://researchcenter.paloaltonetworks.com/2015/09/updated-pclock-ransomware-still-comes-up-short/", "https://decrypter.emsisoft.com/" ], "synonyms": [ "PClock SuppTeam Ransomware", "WinPlock", "CryptoLocker clone" ] }, "uuid": "6c38f175-b32a-40ef-8cad-33c2c8840d51", "value": "PClock3 Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "XOR and RSA", "extensions": [ ".kolobocheg@aol.com_" ], "payment-method": "Email", "ransomnotes-refs": [ "https://www.ransomware.wiki/tag/kolobo/" ], "refs": [ "https://www.ransomware.wiki/tag/kolobo/", "https://id-ransomware.blogspot.co.il/2016/11/kolobo-ransomware.html", "https://forum.drweb.com/index.php?showtopic=315142" ], "synonyms": [ "Kolobocheg Ransomware" ] }, "uuid": "f32f0bec-961b-4c01-9cc1-9cf409efd598", "value": "Kolobo Ransomware" }, { "description": "This is most likely to affect German speaking users, since the note is written in German. Mostly affects users in German speaking countries. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES-256", "extensions": [ ".cry_" ], "payment-method": "PaySafeCard", "price": "100€", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-r2kaNLjBcEk/WCNCqrpHPZI/AAAAAAAACEE/eFSWuu4mUZoDV5AnduGR4KxHlFM--uIzACLcB/s1600/lock-screen.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/paysafegen-german-ransomware.html", "https://twitter.com/JakubKroustek/status/796083768155078656" ], "synonyms": [ "Paysafecard Generator 2016", "PaySafeCard", "PaySafeGen" ] }, "uuid": "379d5258-6f11-4c41-a685-c2ff555c0cb9", "value": "PaySafeGen (German) Ransomware" }, { "description": "This is most likely to affect Russian speaking users, since the note is written in Russian. Therefore, residents of Russian speaking country are affected. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. The ransomware’s authors would request around $75 from their victims to provide them with a decryptor (payments are accepted via Russian payment services Qiwi or Yandex.Money ). Right from the start, however, researchers suggested that TeleCrypt was written by cybercriminals without advanced skills. Telecrypt will generate a random string to encrypt with that is between 10-20 length and only contain the letters vo,pr,bm,xu,zt,dq.", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".Xcri" ], "payment-method": "Qhvi-wallet / Yandex-wallet", "price": "5000 rubles", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-UFksnOoE4Ss/WCRUNbQuqyI/AAAAAAAACFI/Gs3Gkby335UmiddlYWJDkw8O-BBLt-BlQCLcB/s1600/telegram_rans.gif" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/telecrypt-ransomware.html", "http://www.securityweek.com/telecrypt-ransomwares-encryption-cracked", "https://malwarebytes.app.box.com/s/kkxwgzbpwe7oh59xqfwcz97uk0q05kp3", "https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/", "https://securelist.com/blog/research/76558/the-first-cryptor-to-exploit-telegram/" ] }, "uuid": "2f362760-925b-4948-aae5-dd0d2fc21002", "value": "Telecrypt Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".cerber" ], "payment-method": "Bitcoin", "price": "0.4", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-ftA6aPEXwPM/WCDY3IiSq6I/AAAAAAAACCU/lnH25navXDkNccw5eQL9fkztRAeIqDYdQCLcB/s1600/note111.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/cerbertear-ransomware.html", "https://www.tripwire.com/state-of-security/security-data-protection/cyber-security/november-2016-month-ransomware/", "https://twitter.com/struppigel/status/795630452128227333" ] }, "uuid": "28808e63-e71f-4aaa-b203-9310745f87b6", "value": "CerberTear Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Hidden Tear >> APT Ransomware + HYPERLINK \"https://id-ransomware.blogspot.ru/2016/05/remindme-ransomware-2.html\" \t \"_blank\" RemindMe > FuckSociety", "meta": { "date": "November 2016", "encryption": "RSA-4096", "extensions": [ ".dll" ], "payment-method": "Bitcoin", "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/fucksociety-ransomware.html" ] }, "uuid": "81c476c3-3190-440d-be4a-ea875e9415aa", "value": "FuckSociety Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Batch file; Passcode: AES1014DW256 or RSA1014DJW2048", "meta": { "date": "November 2016", "encryption": "AES-256", "extensions": [ ".dng", ".serpent" ], "payment-method": "Bitcoin", "price": "0.33", "ransomnotes-filenames": [ "HOW_TO_DECRYPT_YOUR_FILES_[random_3_chars].html", "HOW_TO_DECRYPT_YOUR_FILES_[random_3_chars].txt" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/paydos-ransomware-serpent.html", "https://www.bleepingcomputer.com/news/security/ransomware-goes-retro-with-paydos-and-serpent-written-as-batch-files/", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-4th-2016-cerber-paydos-alcatraz-locker-and-more/", "https://www.proofpoint.com/us/threat-insight/post/new-serpent-ransomware-targets-danish-speakers" ], "synonyms": [ "Serpent Ransomware" ] }, "uuid": "4818a48a-dfc2-4f35-a76d-e4fb462d6c94", "value": "PayDOS Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".dng" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/zscreenlocker-ransomware.html", "https://www.tripwire.com/state-of-security/security-data-protection/cyber-security/november-2016-month-ransomware/", "https://twitter.com/struppigel/status/794077145349967872" ] }, "uuid": "47834caa-2226-4a3a-a228-210a64c281b9", "value": "zScreenLocker Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".rnsmwr" ], "payment-method": "Bitcoin", "price": "0.03", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/11-4-16/CwZubUHW8AAE4qi[1].jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/gremit-ransomware.html", "https://twitter.com/struppigel/status/794444032286060544", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-4th-2016-cerber-paydos-alcatraz-locker-and-more/" ] }, "uuid": "47512afc-ecf2-4766-8487-8f3bc8dddbf3", "value": "Gremit Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".hollycrypt" ], "payment-method": "Bitcoin Email", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-PdtXGwSTn24/WBxIoomzF4I/AAAAAAAAB-U/lxTwKWc7T9MJhUtcRMh1mn9m_Ftjox9XwCLcB/s1600/note_2.PNG" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/hollycrypt-ransomware.html" ] }, "uuid": "b77298c1-3f84-4ffb-a81b-36eab5c10881", "value": "Hollycrypt Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".BTC" ], "payment-method": "Email", "ransomnotes-refs": [ "https://4.bp.blogspot.com/--7M0dtKhOio/WBxJx1PflYI/AAAAAAAAB-g/DSdMjLDLnVwwaMBW4H_98SzSJupLYm9WgCLcB/s1600/note_2.PNG" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/btclocker-ransomware.html" ], "synonyms": [ "BTC Ransomware" ] }, "uuid": "3f461284-85a1-441c-b07d-8b547be43ca2", "value": "BTCLocker Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. From the developer behind the Apocalypse Ransomware, Fabiansomware, and Esmeralda", "meta": { "date": "November 2016", "encryption": "AES", "extensions": [ ".crypted_file" ], "payment-method": "Bitcoin", "price": "2", "ransomnotes-filenames": [ "filename.Instructions_Data_Recovery.txt" ], "ransomnotes-refs": [ "https://1.bp.blogspot.com/-1jyI1HoqJag/WBzj9SLvipI/AAAAAAAAB_U/_sp8TglWEPQphG8neqrztfUUIjcBbVhDwCLcB/s1600/kangaroo-lock_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/kangaroo-ransomware.html", "https://www.bleepingcomputer.com/news/security/the-kangaroo-ransomware-not-only-encrypts-your-data-but-tries-to-lock-you-out-of-windows/" ] }, "uuid": "5ab1449f-7e7d-47e7-924a-8662bc2df805", "value": "Kangaroo Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES-256", "extensions": [ ".dCrypt" ], "payment-method": "Email", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-2rS0Yq27wp0/WBtKfupZ2sI/AAAAAAAAB8I/0MR-9Xx0n-0zV_NBSScDCiYTp1KH-edtACLcB/s1600/Lockscreen_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/dummyencrypter-ransomware.html" ] }, "uuid": "6bf055c6-acb2-4459-92b0-70d61616ab62", "value": "DummyEncrypter Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES-256", "extensions": [ ".dCrypt" ], "payment-method": "Email", "ransomnotes": [ "YOUR FILES ARE ENCRYPTED THAT THEIR DECRYPT SEND EMAIL US AT encryptss77@gmail.com IN MESSAGE INDICATE IP ADDRESS OF COMPUTER WHERE YOU SAW THIS MESSAGE YOU CAN FIND IT ON 2IP.RU WE WILL REPLY TO YOU WITHIN 24 HOURS" ], "refs": [ "http://virusinfo.info/showthread.php?t=201710", "https://id-ransomware.blogspot.co.il/2016/11/encryptss77-ransomware.html" ], "synonyms": [ "SFX Monster Ransomware" ] }, "uuid": "317cab8a-31a1-4a82-876a-94edc7afffba", "value": "Encryptss77 Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES-256", "extensions": [ ".ace" ], "payment-method": "Website (onion)", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-zb0TP0wza7I/WBpShN0tCMI/AAAAAAAAB64/oTkSFwKFVx8hY1rEs5FQU6F7oaBW-LqHwCLcB/s1600/note_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/winrarer-ransomware.html" ] }, "uuid": "7ee22340-ed89-4e22-b085-257bde4c0fc5", "value": "WinRarer Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES-256", "extensions": [ ".blackblock" ], "payment-method": "Bitcoin", "price": "0.5 - 1", "ransomnotes": [ "YOUR FILES HAVE BEEN ENCRYPTED! Your personal ID ***** Your file have been encrypted with a powerful strain of a virus called ransomware. Your files are encrypted using the same methods banks and the military use. There is currently no possible way to decrypt files with the private key. Lucky for you, we can help. We are willing to sell you a decryptor UNIQUELY made for your computer (meaning someone else's decryptor will not work for you). Once you pay a small fee, we will instantly send you the software/info necessary to decrypt all your files, quickly and easily." ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/russian-globe-ransomware.html" ] }, "uuid": "30771cde-2543-4c13-b722-ff940f235b0f", "value": "Russian Globe Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "November 2016", "encryption": "AES-256", "extensions": [ ".zn2016" ], "payment-method": "Bitcoin", "price": "10 (7300 $)", "ransomnotes-refs": [ "https://1.bp.blogspot.com/-0AGEY4vAlA0/WBi_oChzFNI/AAAAAAAAB4w/8PrPRfFU30YFWCwHzqnsx4bYISVNFyesQCLcB/s1600/note.PNG" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/11/zerocrypt-ransomware.html" ] }, "uuid": "e999ca18-61cb-4419-a2fa-ab8af6ebe8dc", "value": "ZeroCrypt Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "RSA", "extensions": [ ".c400", ".c300", "!@!@!@_contact mail___boroznsalyuda@gmail.com___!@!@.psd", "!@#$_____ISKANDER@TUTAMAIL.COM_____$#@!.RAR", "!@#$%^&-()_+.1C" ], "payment-method": "Bitcoin", "price": "7 (2000 - 5000 $)", "ransomnotes": [ "Good day Your files were encrypted/locked As evidence can decrypt file 1 to 3 1-30MB The price of the transcripts of all the files on the server: 7 Bitcoin Recommend to solve the problem quickly and not to delay Also give advice on how to protect Your server against threats from the network (Files sql mdf backup decryption strictly after payment)!", "Для связи с нами используйте почту\ninkognitoman@tutamail.com\ninkognitoman@firemail.cc" ], "ransomnotes-filenames": [ "INFO.txt" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/rotorcrypt-ransomware.html", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-12th-2018-notpetya-gandcrab-and-more/", "https://twitter.com/demonslay335/status/1050117756094476289" ], "synonyms": [ "RotorCrypt", "RotoCrypt", "Tar Ransomware" ] }, "uuid": "63991ed9-98dc-4f24-a0a6-ff58e489c263", "value": "RotorCrypt(RotoCrypt, Tar) Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.", "meta": { "date": "October 2016", "encryption": "AES-256 + RSA-2048", "extensions": [ "ISHTAR-. (prefix)" ], "payment-method": "Email - rubles", "price": "15 000", "ransomnotes": [ "FOR FILE DISCRIPTION, PLEASE CONTACT YOU@edtonmail@protonmail.com Or BM-NBYR3ctSgr67iciT43rRNmHdHPAYBBK7 USING BITMESSAGE DESKTOP OR https://bitmsg.me/ BASIC TECHNICAL DETAILS: > Standard encryption order: AES 256 + RSA 2048. > A unique AES key is created for each file. > Decryption is impossible without the ISHTAR.DATA file (see% APPDATA% directory). ----- TO DECRYPT YOUR FILES PLEASE WRITE TO youneedmail@protonmail.com OR TO BM-NBYR3ctSgr67iciT43rRNmHdHPAYBBK7 USING BITMESSAGE DESKTOP OR https://bitmsg.me/ BASIC TECHNICAL DETAILS: > Standart encryption routine: AES 256 + RSA 2048. > Every AES key is unique per file. > Decryption is impossible without ISHTAR.DATA file (see% APPDATA% path)." ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/ishtar-ransomware.html" ] }, "uuid": "30cad868-b2f1-4551-8f76-d17695c67d52", "value": "Ishtar Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "extensions": [ ".hcked" ], "payment-method": "rupies", "price": "3500 - 5000 - 10 000", "ransomnotes": [ "IMPORTANT!!!! All of your computer files have been encrypted. DO NOT CHANGE ANY FILES! We can restore all the files. How to restore files: - \n1) Follow this link: - http://goo.gl/forms/VftoBRppkJ \n2) Fill out the form above. \n3) For 24 hours on your email + mobile SMS will come instructions for solving the problem. Thank you! DarkWing020" ], "ransomnotes-filenames": [ "CreatesReadThisFileImportant.txt" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-gqEyoqXbZnE/WBXoF5bPZZI/AAAAAAAAB2U/YGpgIdjXyQQeDnwc9PlJs37YWtWTnH_wgCLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/masterbuster-ransomware.html", "https://twitter.com/struppigel/status/791943837874651136" ] }, "uuid": "07f859cd-9c36-4dae-a6fc-fa4e4aa36176", "value": "MasterBuster Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "extensions": [ ".coin" ], "payment-method": "Bitcoin", "price": "3", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-oaElZvUqbfo/WBUOGdD8unI/AAAAAAAAB1w/Ya1_qq0gfa09AhRddUITQNRxKloXgD_BwCLcB/s1600/wallp.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/jackpot-ransomware.html", "https://twitter.com/struppigel/status/791639214152617985", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-28-2016-locky-angry-duck-and-more/" ], "synonyms": [ "Jack.Pot Ransomware" ] }, "uuid": "04f1772a-053e-4f6e-a9af-3f83ab312633", "value": "JackPot Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Georgian ransomware", "meta": { "date": "October 2016", "extensions": [ ".Encryption:" ], "payment-method": "Bitcoin", "price": "100 $", "ransomnotes": [ "All your files are encrypted, but do not worry, they have not been removed. (for now) You have 24 hours to pay $100. Money move to the specified Bitcoin -account. Otherwise, all files will be destroyed. Do not turn off the computer and/or do not attempt to disable me. When disobedience will be deleted 100 files." ], "ransomnotes-refs": [ "https://1.bp.blogspot.com/-cukkC4KAhZE/WBY1jJbcQoI/AAAAAAAAB3I/p8p-iNQRnQwnP6c6H77h_SHMQNAlkJ1CgCLcB/s1600/onyx.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/onyx-ransomware.html", "https://twitter.com/struppigel/status/791557636164558848", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-28-2016-locky-angry-duck-and-more/" ] }, "uuid": "927a4150-9380-4310-9f68-cb06d8debcf2", "value": "ONYX Ransomeware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES", "extensions": [ ".inf643" ], "payment-method": "Bitcoin", "price": "1000 $", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-JuBZKpEHV0Q/WBYNHFlW7pI/AAAAAAAAB20/z0DPYA_8l6U8tB6pbgo8ZwyIJRcrIVy2ACLcB/s1600/Note1.JPG" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/ifn643-ransomware.html", "https://twitter.com/struppigel/status/791576159960072192", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-28-2016-locky-angry-duck-and-more/" ] }, "uuid": "ddeab8b3-5df2-414e-9c6b-06b309e1fcf4", "value": "IFN643 Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES", "extensions": [ ".Alcatraz" ], "payment-method": "Email", "ransomnotes-filenames": [ "ransomed.hTmL" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-b0-Uvnz703Q/WBcMGkZqtwI/AAAAAAAAB3Y/a6clIjdp_tI2T-OE_ykyjvB2qNY3gqWdQCLcB/s1600/Screenshot_1.jpg", "https://2.bp.blogspot.com/-y5a6QnjAiv0/WBcMKV0zDDI/AAAAAAAAB3c/ytOQHJgmy30H_jEWPcfht7RRsh4NhcrvACLcB/s1600/Screenshot_2.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/alcatraz-locker-ransomware.html", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-4th-2016-cerber-paydos-alcatraz-locker-and-more/", "https://twitter.com/PolarToffee/status/792796055020642304" ] }, "uuid": "2ad63264-8f52-4ab4-ad26-ca8c3bcc066e", "value": "Alcatraz Locker Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES", "extensions": [ ".encrypted" ], "payment-method": "Email", "ransomnotes": [ "Windows has encountered a critical problem and needs your immediate action to recover your data. The system access is locked and all the data have been encrypted to avoid the information be published or misused. You will not be able to access to your files and ignoring this message may cause the total loss of the data. We are sorry for the inconvenience. You need to contact the email below to restore the data of your system. Email: esmeraldaencryption@mail.ru You will have to order the Unlock-Password and the Esmeralda Decryption Software. All the instructions will be sent to you by email." ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-vaWu8OjSiXE/WBzkLBdB8DI/AAAAAAAAB_Y/k8vvtYEIdTkFJhruRJ6qDNAujAn4Ph-xACLcB/s1600/esmeralda-lock_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/esmeralda-ransomware.html", "https://www.bleepingcomputer.com/forums/t/630835/esmeralda-ransomware/" ] }, "uuid": "ff5a04bb-d412-4cb3-9780-8d3488b7c268", "value": "Esmeralda Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES", "extensions": [ ".encrypted" ], "payment-method": "Bitcoin", "price": "0.053773", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-_jxt6kCRnwM/WBNf7mi92nI/AAAAAAAAB0g/homx8Ly379oUKAOIhZU6MxCiWX1gA_TkACLcB/s1600/wallp.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/encryptile-ransomware.html" ] }, "uuid": "56e49b84-a250-4aaf-9f65-412616709652", "value": "EncrypTile Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Sample of how the hacker tricks the user using the survey method. https://1.bp.blogspot.com/-72ECd1vsUdE/WBMSzPQEgzI/AAAAAAAABzA/i8V-Kg8Gstcn_7-YZK__PDC2VgafWcfDgCLcB/s1600/survey-screen.png The hacker definatly has a sense of humor: https://1.bp.blogspot.com/-2AlvtcvdyUY/WBMVptG_V5I/AAAAAAAABzc/1KvAMeDmY2w9BN9vkqZO8LWkBu7T9mvDACLcB/s1600/ThxForYurTyme.JPG", "meta": { "date": "October 2016", "encryption": "AES", "extensions": [ ".encrypted" ], "payment-method": "Game", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-GAPCc3ITdQY/WBMTmJ4NaRI/AAAAAAAABzM/XPbPZvZ8vbUrOWxtwPmfHFJiNT_2gfaOgCLcB/s1600/fileice-source.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/fileice-ransomware-survey.html", "https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/" ] }, "uuid": "ca5d0e52-d0e4-4aa9-872a-0669433c0dcc", "value": "Fileice Ransomware Survey Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES-256", "extensions": [ ".encrypted" ], "payment-method": "Bitcoin", "price": "0.29499335", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-vIMgkn8WVJM/WBJAxkbya7I/AAAAAAAABys/tCpaTOxfGDw8A611gudDh46mhZT70dURwCLcB/s1600/lock-screen.jpg", "https://1.bp.blogspot.com/-b0QiEQec0Pg/WBMf2HG6hjI/AAAAAAAABz8/BtN2-INZ2KQ4W2_iPqvDZTtlA0Aq_4gVACLcB/s1600/Screenshot_2.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/cryptowire-ransomware.html", "https://twitter.com/struppigel/status/791554654664552448", "https://www.bleepingcomputer.com/news/security/-proof-of-concept-cryptowire-ransomware-spawns-lomix-and-ultralocker-families/" ] }, "uuid": "4e6e45c2-8e13-49ad-8b27-e5aeb767294a", "value": "CryptoWire Ransomeware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Based on Locky", "meta": { "date": "October 2016", "encryption": "AES-128+RSA", "extensions": [ ".locky", "[a-zA-Z0-9+_-]{1,}.[a-z0-9]{3,4}.locky" ], "payment-method": "Email", "ransomnotes": [ "!!! IMPORTANT INFORMATION !!!! All files are encrypted using RSA-3072 and AES128 encryption. You can learn more about RSA and AES ciphers here: Https://hu.wikipedia.org/wiki/RSA-eljárás Https://hu.wikipedia.org/wiki/Advanced_Encryption_Standard To return files, you need to get a secret key and decryption program. To get the key, please follow these steps: \n1. Send an identification code to the email address locky@mail2tor.com! If you want, send a 1 MB file for decryption. In order to prove that we can recover data. (Please, email must contain only the identification code, as well as the attachment) \n3. Please note, check the mail, we will send you an email within 24 hours! You will receive a decrypted file and decryption program in the attachment. Follow the instructions in the email.!!! Your identification code !!!" ], "ransomnotes-filenames": [ "_Adatok_visszaallitasahoz_utasitasok.txt", "_locky_recover_instructions.txt" ], "ransomnotes-refs": [ "https://1.bp.blogspot.com/-lLZZBScC27U/WBmkDQzl9FI/AAAAAAAAB5Y/gozOy17Yv0EWNCQVSOXn-PkTccYZuMmPQCLcB/s1600/note-bmp_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/hucky-ransomware-hungarian-locky.html", "https://blog.avast.com/hucky-ransomware-a-hungarian-locky-wannabe", "https://twitter.com/struppigel/status/846241982347427840" ], "synonyms": [ "Hungarian Locky Ransomware" ] }, "uuid": "74f91a93-4f1e-4603-a6f5-aaa40d2dd311", "value": "Hucky Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES", "extensions": [ ".wnx" ], "payment-method": "Bitcoin", "price": "2 - 4", "ransomnotes": [ "Your files are encrypted! Your files have been safely encrypted on this PC: photos, documents, databases, etc. Encryption was produced using a unique public key generated for this computer. To decrypt files you need to obtain the private key. The only way to get the private key is to pay 4 BTC. You saved it on qualified system administrator who could make your network safe and secure. In order to decrypt the files send your bitcoins to the following address: 13gYXFxpzm7hAd4esdnJGt9JvYqyD1Y6by After you complete your payment, send an email to 6214ssxpvo@sigaint.org with YOUR ID as subject (ID is in the end of the file) and you'll receive private key, needed software and step by step guide in 1 business day. Offer is valid for 5 business days (expiration date is in the end of the file). AFTER TIME IS UP, PRICE DOUBLES. No discounts, no other payment methods. How to buy bitcoins? \n1. Create a Bitcoin Wallet (we recommend Blockchain.info) \n2. Buy necessary amount of Bitcoins Do not forget about the transaction commission in the Bitcoin network (= 0.0005). Here are our recommendations: LocalBitcoins.com – the fastest and easiest way to buy and sell Bitcoins; CoinCafe.com – the simplest and fastest way to buy, sell and use Bitcoins; BTCDirect.eu – the best for Europe; CEX.IO – Visa / MasterCard; CoinMama.com – Visa / MasterCard; HowToBuyBitcoins.info – discover quickly how to buy and sell bitcoins in your local currency. More questions? Send an email to 6214ssxpvo@sigaint.org ID: *** EXP DATE: Sept. 12 2016 Winnix Cryptor Team" ], "ransomnotes-filenames": [ "YOUR FILES ARE ENCRYPTED!.txt" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/winnix-cryptor-ransomware.html", "https://twitter.com/PolarToffee/status/811940037638111232" ] }, "uuid": "e30e663d-d8c8-44f2-8da7-03b1a9c52376", "value": "Winnix Cryptor Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Demands 10 BTC", "meta": { "date": "October 2016", "encryption": "AES-512", "extensions": [ ".adk" ], "payment-method": "Bitcoin", "price": "10 (7300 $)", "ransomnotes": [ "ANGRY DUCK! All your important files have been encrypted using very string cryptography (AES-512 With RSA-64 FIPS grade encryption). To recover your files, send 10 BTC to my private wallet DON'T MESS WITH THE DUCKS!!!" ], "ransomnotes-refs": [ "https://3.bp.blogspot.com/-k3s85Fx9N_E/WBIfuUNTMmI/AAAAAAAAByM/rQ10tKuXTlEJfLTOoBwJPo7rhhaiK2OoQCLcB/s1600/screen-lock.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/angryduck-ransomware.html", "https://twitter.com/demonslay335/status/790334746488365057" ] }, "uuid": "2813a5c7-530b-492f-8d77-fe7b1ed96a65", "value": "AngryDuck Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES-512", "extensions": [ ".lock93" ], "payment-method": "Email", "price": "1000 rubles", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-WuD2qaaNIb0/WA4_g_FnIfI/AAAAAAAABx4/pn6VNqMXMzI_ryvKUruY3ctYtzomT1I4gCLcB/s1600/note3.jpg", "https://1.bp.blogspot.com/-S6M83oFxSdM/WA4_ak9WATI/AAAAAAAABx0/3FL3q21FdxMQvAgrr2FORQIaNtq2-P2jACLcB/s1600/note2.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/lock93-ransomware.html", "https://twitter.com/malwrhunterteam/status/789882488365678592" ] }, "uuid": "2912426d-2a26-4091-a87f-032a6d3d28c1", "value": "Lock93 Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES-512", "payment-method": "Bitcoin", "price": "0.25 - 0.5", "ransomnotes-filenames": [ "!!!!!readme!!!!!.htm" ], "ransomnotes-refs": [ "https://2.bp.blogspot.com/-5gZpxeEWqZg/WBeNnEP9GzI/AAAAAAAAB4g/ELCCp88whLMI6CzpGTjlxbmXBMFIKhwtwCLcB/s1600/onion-site.JPG" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/asn1-encoder-ransomware.html", "https://malwarebreakdown.com/2017/03/02/rig-ek-at-92-53-105-43-drops-asn1-ransomware/" ] }, "uuid": "dd99cc50-91f7-4375-906a-7d09c76ee9f7", "value": "ASN1 Encoder Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. The hacker tries to get the user to play a game and when the user clicks the button, there is no game, just 20 pictures in a .gif below: https://3.bp.blogspot.com/-1zgO3-bBazs/WAkPYqXuayI/AAAAAAAABxI/DO3vycRW-TozneSfRTdeKyXGNEtJSMehgCLcB/s1600/all-images.gif", "meta": { "date": "October 2016", "encryption": "AES", "extensions": [ ".hacked" ], "payment-method": "Email Bitcoin", "ransomnotes": [ "All right my dear brother!!! Enough free playing. Your files have been encrypted. Pay so much this much money so I can send you the password for your files. I can be paid this much too cause I am very kind. So move on I didn't raise the price." ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/click-me-ransomware.html", "https://www.youtube.com/watch?v=Xe30kV4ip8w" ] }, "uuid": "97bdadda-e874-46e6-8672-11dbfe3958c4", "value": "Click Me Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES-256 + RSA-2048", "extensions": [ ".hacked" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-4HNc9S8SY4I/WBMkpdKyDsI/AAAAAAAAB0I/udESgro7YB4pF98Dv2KrrecyymFGsvV2QCLcB/s1600/note.JPG" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/airacrop-ransomware.html" ] }, "uuid": "e7a5c384-a93c-4ed4-8411-ca1e52396256", "value": "AiraCrop Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Base64 encoding, ROT13, and top-bottom swapping", "meta": { "date": "October 2016", "encryption": "AES-256 + RSA-2048", "extensions": [ "#LOCK#" ], "payment-method": "Email", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-sdlDK4OIuPA/WAehWZYHaMI/AAAAAAAABvc/TcAcLG2lw10aOFY3FbP1A5EuLjL6LR62ACLcB/s1600/note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/japanlocker-ransomware.html", "https://www.cyber.nj.gov/threat-profiles/ransomware-variants/japanlocker", "https://github.com/fortiguard-lion/schRansomwareDecryptor/blob/master/schRansomwarev1_decryptor.php", "https://blog.fortinet.com/2016/10/19/japanlocker-an-excavation-to-its-indonesian-roots" ], "synonyms": [ "SHC Ransomware", "SHCLocker", "SyNcryption" ] }, "uuid": "d579e5b6-c6fd-43d9-9213-7591cd324f94", "value": "JapanLocker Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. EDA2", "meta": { "date": "October 2016", "encryption": "AES(256)", "extensions": [ ".coded" ], "payment-method": "Bitcoin", "price": "1 - 2.5 - 3", "ransomnotes-filenames": [ "Decryption Instructions.txt" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-0YMsPH5WuTk/WAepI4BnqZI/AAAAAAAABv0/yXt4tdrmmAIf-N9KUmehY6mK1kTV-eFFQCLcB/s1600/note-wal2.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/anubis-ransomware.html", "http://nyxbone.com/malware/Anubis.html" ] }, "uuid": "a6215279-37d8-47f7-9b1b-efae4178c738", "value": "Anubis Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES-256", "payment-method": "Bitcoin", "price": "2", "ransomnotes": [ "Attention! ! ! All of your copies of your system have been permanently deleted and the data on all partitions and workstations have been encrypted! Stay calm. You can recover all your data by making a payment of 2 BTC (1200 USD) in Bitcoin currency to receive a decryption key. To purchase Bitcions you can use www.coinbase.com After buying BTC send the equivalent of 2 BTC (1200 USD) to our BTC adress : 16jX5RbF2pEcLYHPukazWhDCkxXTs7ZCxB After payment contact us to receive your decryption key. In mail title write your unique ID: {custom id visually resembling a MAC address} Our e-mail: crypt302@gmx.com" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/xtplocker-ransomware.html" ] }, "uuid": "eef4bf49-5b1d-463a-aef9-538c5dc2f71f", "value": "XTPLocker 5.0 Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. Also encrypts executables", "meta": { "date": "October 2016", "encryption": "AES-128", "extensions": [ ".exotic", "random.exotic" ], "payment-method": "Bitcoin", "price": "50 $", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-WJYR7LkWHWY/WAaCYScljOI/AAAAAAAABuo/j18AGhzv7WUPb2r4HWkYm4TPgYw9S5PUwCLcB/s1600/note1-1.jpg", "https://4.bp.blogspot.com/-2QxJ3KCRimI/WAaCcWcE2uI/AAAAAAAABus/9SGRY5iQT-ITfG_JrY7mn6-PUpQrSKg7gCLcB/s1600/note1-2.jpg", "https://3.bp.blogspot.com/-SMXOoWiGkxw/WAaGOMdecrI/AAAAAAAABu8/S-YjlWlPKbItSN_fe8030tMDHWzouHsIgCLcB/s1600/note2.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/eviltwins-exotic-ransomware-targets-executable-files/", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-14-2016-exotic-lockydump-comrade-and-more/", "https://www.cyber.nj.gov/threat-profiles/ransomware-variants/exotic-ransomware", "https://id-ransomware.blogspot.co.il/2016/10/exotic-ransomware.html" ] }, "uuid": "eb22cb8d-763d-4cac-af35-46dc4f85317b", "value": "Exotic Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. NO POINT TO PAY THE RANSOM, THE FILES ARE COMPLETELY DESTROYED", "meta": { "date": "October 2016", "encryption": "AES-128", "extensions": [ ".dll" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-VTUhk_Py2FA/WAVCO1Yn69I/AAAAAAAABuI/N71wo2ViOE0UjrIdbeulBRTJukHtA2TdACLcB/s1600/ransom-note.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/apt-ransomware-2.html" ] }, "uuid": "6ec0f43c-6b73-4f5e-bee7-a231572eb994", "value": "APT Ransomware v.2" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES-256", "extensions": [ ".enc" ], "payment-method": "Bitcoin", "price": "0.0523", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-NfRePJbfjbY/WAe5LHFsWaI/AAAAAAAABwE/1Pk116TDqAYEDYvnu2vzim1l-H5seW9mQCLcB/s1600/note.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/ws-go-ransonware.html", "https://www.cyber.nj.gov/threat-profiles/ransomware-variants/apt-ransomware-v2" ], "synonyms": [ "WS Go Ransonware", "Trojan.Encoder.6491" ] }, "related": [ { "dest-uuid": "f855609e-b7ab-41e8-aafa-62016f8f4e1a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "a57a8bc3-8c33-43e8-b237-25edcd5f532a", "value": "Windows_Security Ransonware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES", "extensions": [ ".NCRYPT", ".ncrypt" ], "payment-method": "Bitcoin", "price": "0.2", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-k7T79DnBk8w/WBc67QXyjWI/AAAAAAAAB3w/QbA-E9lYdSMOg3PcG9Vz8fTc_OhmACObACLcB/s1600/note-html.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/ncrypt-ransomware.html" ] }, "uuid": "d590865e-f3ae-4381-9d82-3f540f9818cb", "value": "NCrypt Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. In devVenisRansom@protonmail.com", "meta": { "date": "October 2016", "encryption": "AES-2048", "extensions": [ ".venis" ], "payment-method": "Email", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-IFEOWjw-aaQ/WAXTu9oEN4I/AAAAAAAABuY/APqBiaHn3pAX8404Noyuj7tnFJDf2m_XACLcB/s1600/note1.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/venis-ransomware.html", "https://twitter.com/Antelox/status/785849412635521024", "http://pastebin.com/HuK99Xmj" ] }, "uuid": "b9cfe6f3-5970-4283-baf4-252e0491b91c", "value": "Venis Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES-128", "extensions": [ ".1txt" ], "payment-method": "Bitcoin", "price": "200 $", "ransomnotes": [ "We encrypt important files on your computer: documents, databases, photos, videos and keys. Files encryption algorithm AES 128 (https://ru.wikipedia.org/wiki/Advanced_Encryption_Standard) with a private key that only we know. Encrypted files have .1txt extension. It decrypts files without the private key IMPOSSIBLE. \nIf you want to get the files back: \n1) Install the Tor Browser http://www.torproject.org/ \n2) Locate the desktop key to access E_N_I_G_M_A.RSA site (password is encrypted in the key of your files) \n3) Go to the website http://kf2uimw5omtgveu6.onion/ into a torus-browser and log in using E_N_I_G_M_A.RSA \n4) Follow the instructions on the website and download the decoder \nC:\\Documents and Settings\\Администратор\\Рабочийстол\\E_N_I_G_M_A.RSA - The path to the key file on the desktop C:\\DOCUME~1\\9335~1\\LOCALS~1\\Temp\\E_N_I_G_M_A.RSA - The path to the key file in TMP directory" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/enigma-2-ransomware.html" ] }, "uuid": "507506a3-3745-47fd-8d31-ef122317c0c2", "value": "Enigma 2 Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc.. sample is set to encrypt only in 2017...", "meta": { "date": "October 2016", "encryption": "AES-256", "payment-method": "Bitcoin", "price": "500$", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-XZiiaCYM9Bk/WAUsUkrCJEI/AAAAAAAABtk/z-sMHflz3Q8_aWc-K9PD0N5TGkSGwwQnACLcB/s1600/note-html.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/deadly-ransomware.html", "https://twitter.com/malwrhunterteam/status/785533373007728640" ], "synonyms": [ "Deadly for a Good Purpose Ransomware" ] }, "uuid": "a25e39b0-b601-403c-bba8-2f595e221269", "value": "Deadly Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES-256", "extensions": [ ".comrade" ], "payment-method": "Bitcoin", "price": "~2", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-MmzOC__9qPA/V__t2kNX-SI/AAAAAAAABrc/t8ypPa1jCIUbPfvR7UGbdGzdvKrbAv_DgCLcB/s1600/wallpaper.jpg", "https://4.bp.blogspot.com/-hRoC-UFr-7o/V__tAEFuZWI/AAAAAAAABrQ/xDawlulx8Bg4uEtX4bU2ezPMY-x6iFiuQCLcB/s1600/note-1ch.JPG", "https://4.bp.blogspot.com/-PdYtm6sRHAI/WAEngHQBg_I/AAAAAAAABsA/nh8m7__b0wgviTEBahyNYK4HFhF1v7rOQCLcB/s1600/icon-stalin-2.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/comrade-circle-ransomware.html" ] }, "uuid": "db23145a-e15b-4cf7-9d2c-ffa9928750d5", "value": "Comrade Circle Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES-256 or Blowfish", "extensions": [ ".raid10", ".[random].raid10", ".blt", ".globe", ".[random].blt", ".encrypted", ".[random].globe", ".[random].encrypted", ".mia.kokers@aol.com", ".[mia.kokers@aol.com]", ".lovewindows", ".openforyou@india.com", ".." ], "payment-method": "Bitcoin", "price": "0.8 - 1", "ransomnotes-refs": [ "https://3.bp.blogspot.com/-MYI30xhrcZU/V_qcDyASJsI/AAAAAAAABpU/Pej5jDk_baYBByLx1cXwFL8LBiT8Vj3xgCLcB/s1600/note22.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/globe2-ransomware.html", "https://success.trendmicro.com/portal_kb_articledetail?solutionid=1114221" ], "synonyms": [ "Purge Ransomware" ] }, "related": [ { "dest-uuid": "fe16edbe-3050-4276-bac3-c7ff5fd4174a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "5541471c-8d15-4aec-9996-e24b59c3e3d6", "value": "Globe2 Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES-256", "extensions": [ ".k0stya" ], "payment-method": "PaySafe", "price": "300 CZK - 2000 CZK after 12 hours", "ransomnotes-refs": [ "https://2.bp.blogspot.com/-E_MI2fT33J0/V_k_9Gjkj4I/AAAAAAAABpA/-30UT5HhPAAR9YtVkFwgrYqLIdWPprZ9gCLcB/s1600/lock-screen.jpg", "https://2.bp.blogspot.com/-4YmIkWfYfRA/V_lAALhfSvI/AAAAAAAABpE/Dj35aroKXSwbLXrSPqGCzbvhsTNHdsbAgCLcB/s1600/kostya.jpg" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/kostya-ransomware.html", "http://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-14-2016-exotic-lockydump-comrade-and-more/" ] }, "uuid": "7d6f02d2-a626-40f6-81c3-14e3a9a2aea5", "value": "Kostya Ransomware" }, { "description": "This is most likely to affect English speaking users, since the note is written in English. English is understood worldwide, thus anyone can be harmed. The hacker spread the virus using email spam, fake updates, and harmful attachments. All your files are compromised including music, MS Office, Open Office, pictures, videos, shared online files etc..", "meta": { "date": "October 2016", "encryption": "AES-256 CBC", "extensions": [ ".comrade" ], "payment-method": "Bitcoin", "price": "1.5", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-nskzYgbg7Ac/V_jpJ3GApqI/AAAAAAAABos/EbG_-BLDPqA9bRVOWdzHjPnDWFiHYlsJwCLcB/s1600/ransom-note.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/10/fs0ciety-locker-ransomware.html" ] }, "uuid": "ed3a4f8a-49de-40c3-9acb-da1b78f89c4f", "value": "Fs0ciety Locker Ransomware" }, { "description": "It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. After the files are decrypted, the shadow files are deleted using the following command: vssadmin.exe Delete Shadows /All /Quiet", "meta": { "date": "September 2016", "encryption": "AES", "extensions": [ ".ecrypt" ], "payment-method": "Tor WebSite", "ransomnotes-refs": [ "https://4.bp.blogspot.com/-E9WbSxLgaYs/WGn8gC6EfvI/AAAAAAAAC8A/bzd7uP9fcxU6Fyq1n6-9ZbUUGWlls9lrwCLcB/s1600/note-txt_2.png" ], "refs": [ "https://id-ransomware.blogspot.co.il/2016/09/erebus-ransomware.html" ] }, "uuid": "6a77c96b-1814-427f-83ca-fe7e0e40b1c0", "value": "Erebus Ransomware" }, { "description": "According to numerous open-source reports, a widespread ransomware campaign is affecting various organizations with reports of tens of thousands of infections in as many as 74 countries, including the United States, United Kingdom, Spain, Russia, Taiwan, France, and Japan. The software can run in as many as 27 different languages. The latest version of this ransomware variant, known as WannaCry, WCry, or Wanna Decryptor, was discovered the morning of May 12, 2017, by an independent security researcher and has spread rapidly over several hours, with initial reports beginning around 4:00 AM EDT, May 12, 2017. Open-source reporting indicates a requested ransom of .1781 bitcoins, roughly $300 U.S.", "meta": { "date": "May 2017", "payment-method": "Bitcoin", "price": "0.1781 (300$ - $600)", "refs": [ "https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168" ], "synonyms": [ "WannaCrypt", "WannaCry", "WanaCrypt0r", "WCrypt", "WCRY" ] }, "related": [ { "dest-uuid": "ad67ff31-2a02-43f9-8b12-7df7e4fcccd6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "d62ab8d5-4ba1-4c45-8a63-13fdb099b33c", "value": "WannaCry" }, { "description": "Ransomware", "meta": { "encryption": "AES(256)", "extensions": [ ".enc" ], "payment-method": "Email", "ransomnotes-filenames": [ "YOUR_FILES_ARE_LOCKED.txt" ], "refs": [ "http://www.nyxbone.com/malware/CryptoHasYou.html" ] }, "uuid": "a0ce5d94-a22a-40db-a09f-a796d0bb4006", "value": ".CryptoHasYou." }, { "description": "Ransomware", "meta": { "encryption": "XOR", "extensions": [ ".777", "._[timestamp]_$[email]$.777", "e.g. ._14-05-2016-11-59-36_$ninja.gaiver@aol.com$.777" ], "payment-method": "Bitcoin", "price": "0.1 (37$)", "ransomnotes-filenames": [ "read_this_file.txt" ], "refs": [ "https://decrypter.emsisoft.com/777" ], "synonyms": [ "Sevleg" ] }, "uuid": "cd9e9eaa-0895-4d55-964a-b53eacdfd36a", "value": "777" }, { "description": "Ransomware", "meta": { "extensions": [ ".R4A", ".R5A" ], "payment-method": "Bitcoin", "price": "13 (4980$)", "ransomnotes-filenames": [ "FILES_BACK.txt" ], "refs": [ "https://github.com/hasherezade/malware_analysis/tree/master/7ev3n", "https://www.youtube.com/watch?v=RDNbH5HDO1E&feature=youtu.be", "http://www.nyxbone.com/malware/7ev3n-HONE$T.html" ], "synonyms": [ "7ev3n-HONE$T" ] }, "related": [ { "dest-uuid": "ac2608e9-7851-409f-b842-e265b877a53c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "664701d6-7948-4e80-a333-1d1938103ba1", "value": "7ev3n" }, { "description": "Ransomware Based on HiddenTear", "meta": { "encryption": "AES-256", "extensions": [ ".8lock8" ], "ransomnotes-filenames": [ "READ_IT.txt" ], "refs": [ "http://www.bleepingcomputer.com/forums/t/614025/8lock8-help-support-topic-8lock8-read-ittxt/" ] }, "uuid": "b70b6537-cf00-4bd1-a4e9-ae5ff2eb7504", "value": "8lock8" }, { "description": "Ransomware related to TeamXRat", "meta": { "extensions": [ "._AiraCropEncrypted" ], "payment-method": "WebSite (onion) - Email", "ransomnotes-filenames": [ "How to decrypt your files.txt" ], "refs": [ "https://twitter.com/PolarToffee/status/796079699478900736" ] }, "uuid": "77919c1f-4ef8-41cd-a635-2d3118ade1f3", "value": "AiraCrop" }, { "description": "Ransomware", "meta": { "extensions": [ ".unavailable", ".disappeared" ], "payment-method": "Email", "ransomnotes-filenames": [ "Read_Me.Txt" ], "refs": [ "https://decrypter.emsisoft.com/al-namrood" ] }, "uuid": "0040dca4-bf2e-43cb-89ae-ab1b50f1183d", "value": "Al-Namrood" }, { "description": "Ransomware Made by creators of Cerber", "meta": { "extensions": [ ".bin" ], "payment-method": "Bitcoin", "price": "1 (650$)", "ransomnotes-filenames": [ "README HOW TO DECRYPT YOUR FILES.HTML" ], "refs": [ "http://www.bleepingcomputer.com/news/security/new-alfa-or-alpha-ransomware-from-the-same-devs-as-cerber/", "https://news.softpedia.com/news/cerber-devs-create-new-ransomware-called-alfa-506165.shtml" ] }, "uuid": "888abc95-9e01-4cbc-a6e5-058eb9314f51", "value": "ALFA Ransomware" }, { "description": "Ransomware", "meta": { "encryption": "AES-128", "extensions": [ "random", "random(x5)" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "Unlock_files_randomx5.html" ], "refs": [ "https://cta-service-cms2.hubspot.com/ctas/v2/public/cs/c/?cta_guid=d4173312-989b-4721-ad00-8308fff353b3&placement_guid=22f2fe97-c748-4d6a-9e1e-ba3fb1060abe&portal_id=326665&redirect_url=APefjpGnqFjmP_xzeUZ1Y55ovglY1y1ch7CgMDLit5GTHcW9N0ztpnIE-ZReqqv8MDj687_4Joou7Cd2rSx8-De8uhFQAD_Len9QpT7Xvu8neW5drkdtTPV7hAaou0osAi2O61dizFXibewmpO60UUCd5OazCGz1V6yT_3UFMgL0x9S1VeOvoL_ucuER8g2H3f1EfbtYBw5QFWeUmrjk-9dGzOGspyn303k9XagBtF3SSX4YWSyuEs03Vq7Fxb04KkyKc4GJx-igK98Qta8iMafUam8ikg8XKPkob0FK6Pe-wRZ0QVWIIkM&hsutk=34612af1cd87864cf7162095872571d1&utm_referrer=https%3A%2F%2Finfo.phishlabs.com%2Fblog%2Falma-ransomware-analysis-of-a-new-ransomware-threat-and-a-decrypter&canon=https%3A%2F%2Finfo.phishlabs.com%2Fblog%2Falma-ransomware-analysis-of-a-new-ransomware-threat-and-a-decrypter&__hstc=61627571.34612af1cd87864cf7162095872571d1.1472135921345.1472140656779.1472593507113.3&__hssc=61627571.1.1472593507113&__hsfp=1114323283", "https://info.phishlabs.com/blog/alma-ransomware-analysis-of-a-new-ransomware-threat-and-a-decrypter", "http://www.bleepingcomputer.com/news/security/new-alma-locker-ransomware-being-distributed-via-the-rig-exploit-kit/" ], "synonyms": [ "Alma Locker" ] }, "uuid": "76a08868-345f-4566-a403-5f5e575dfee5", "value": "Alma Ransomware" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".encrypt" ], "payment-method": "Itunes Gift Cards", "price": "400$", "ransomnotes-filenames": [ "Read Me (How Decrypt) !!!!.txt" ], "refs": [ "http://download.bleepingcomputer.com/demonslay335/AlphaDecrypter.zip", "https://www.bleepingcomputer.com/news/security/decrypted-alpha-ransomware-accepts-itunes-gift-cards-as-payment/", "https://twitter.com/malwarebread/status/804714048499621888" ], "synonyms": [ "AlphaLocker" ] }, "related": [ { "dest-uuid": "c1b9e8c5-9283-4dbe-af10-45956a446fb7", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "a27fff00-995a-4598-ba00-05921bf20e80", "value": "Alpha Ransomware" }, { "description": "Ransomware Websites only amba@riseup.net", "meta": { "extensions": [ ".amba" ], "payment-method": "Bitcoin", "price": "Depending on the victim’s situation", "ransomnotes-filenames": [ "ПРОЧТИ_МЕНЯ.txt", "READ_ME.txt" ], "refs": [ "https://twitter.com/benkow_/status/747813034006020096", "https://www.enigmasoftware.com/ambaransomware-removal/" ] }, "uuid": "8dd289d8-71bc-42b0-aafd-540dafa93343", "value": "AMBA" }, { "description": "Ransomware", "meta": { "extensions": [ ".AngleWare" ], "payment-method": "Bitcoin", "price": "3", "ransomnotes-filenames": [ "READ_ME.txt" ], "refs": [ "https://twitter.com/BleepinComputer/status/844531418474708993" ] }, "uuid": "e06526ac-0083-44ab-8787-dd7278746bb6", "value": "AngleWare" }, { "description": "Ransomware Based on HiddenTear", "meta": { "payment-method": "Write a FaceBook message", "refs": [ "https://twitter.com/struppigel/status/842047409446387714" ], "synonyms": [ "ngocanh" ] }, "uuid": "5b94100d-83bb-4e30-be7a-6015c00356e0", "value": "Anony" }, { "description": "Ransomware decryptionservice@mail.ru recoveryhelp@bk.ru ransomware.attack@list.ru esmeraldaencryption@mail.ru dr.compress@bk.ru", "meta": { "extensions": [ ".encrypted", ".SecureCrypted", ".FuckYourData", ".unavailable", ".bleepYourFiles", ".Where_my_files.txt", "[filename].ID-*8characters+countrycode[cryptservice@inbox.ru].[random7characters]", "*filename*.ID-[A-F0-9]{8}+countrycode[cryptcorp@inbox.ru].[a-z0-9]{13}" ], "payment-method": "Email - WebSite (onion)", "ransomnotes-filenames": [ "*.How_To_Decrypt.txt", "*.Contact_Here_To_Recover_Your_Files.txt", "*.Where_my_files.txt", "*.Read_Me.Txt", "*md5*.txt" ], "refs": [ "https://decrypter.emsisoft.com/apocalypse", "http://blog.emsisoft.com/2016/06/29/apocalypse-ransomware-which-targets-companies-through-insecure-rdp/" ], "synonyms": [ "Fabiansomeware" ] }, "related": [ { "dest-uuid": "d5d3f9de-21b5-482e-b716-5f2f13182990", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e87d9df4-b464-4458-ae1f-31cea40d5f96", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "e38b8876-5780-4574-9adf-304e9d659bdb", "value": "Apocalypse" }, { "description": "Ransomware Apocalypse ransomware version which uses VMprotect", "meta": { "extensions": [ ".encrypted", ".locked" ], "payment-method": "Email - WebSite (onion)", "ransomnotes-filenames": [ "*.How_To_Get_Back.txt" ], "refs": [ "http://decrypter.emsisoft.com/download/apocalypsevm" ] }, "uuid": "5bc9c3a5-a35f-43aa-a999-fc7cd0685994", "value": "ApocalypseVM" }, { "description": "Ransomware", "meta": { "extensions": [ ".locky" ], "payment-method": "Bitcoin", "price": "0.5 - 1", "ransomnotes-filenames": [ "info.txt", "info.html" ], "refs": [ "https://decrypter.emsisoft.com/autolocky" ] }, "uuid": "803fa9e2-8803-409a-b455-3a886c23fae4", "value": "AutoLocky" }, { "description": "Ransomware", "meta": { "extensions": [ ".enc" ], "refs": [ "https://twitter.com/struppigel/status/828902907668000770" ] }, "uuid": "dced0fe8-224e-47ef-92ed-5ab6c0536daa", "value": "Aw3s0m3Sc0t7" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "price": "2 (888,4$)", "ransomnotes-filenames": [ "Help Decrypt.html" ], "refs": [ "https://decrypter.emsisoft.com/badblock", "http://www.nyxbone.com/malware/BadBlock.html", "http://www.nyxbone.com/images/articulos/malware/badblock/5.png" ] }, "uuid": "f1a30552-21c1-46be-8b5f-64bd62b03d35", "value": "BadBlock" }, { "description": "Ransomware Based on my-Little-Ransomware", "meta": { "extensions": [ ".adr" ], "refs": [ "https://twitter.com/JakubKroustek/status/760482299007922176", "https://0xc1r3ng.wordpress.com/2016/06/24/bakso-crypt-simple-ransomware/" ] }, "uuid": "b21997a1-212f-4bbe-a6b7-3c703cbf113e", "value": "BaksoCrypt" }, { "description": "Ransomware Files might be partially encrypted", "meta": { "encryption": "AES-256", "extensions": [ ".id-1235240425_help@decryptservice.info", ".id-[ID]_[EMAIL_ADDRESS]" ], "payment-method": "Email - Telegram", "ransomnotes-filenames": [ "HOW TO DECRYPT.txt" ], "refs": [ "https://reaqta.com/2016/03/bandarchor-ransomware-still-active/", "https://www.bleepingcomputer.com/news/security/new-bandarchor-ransomware-variant-spreads-via-malvertising-on-adult-sites/" ], "synonyms": [ "Rakhni" ] }, "related": [ { "dest-uuid": "c85a41a8-a0a1-4963-894f-84bb980e6e86", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "af50d07e-3fc5-4014-9ac5-f5466cf042bc", "value": "Bandarchor" }, { "description": "Ransomware Possible affiliations with RockLoader, Locky and Dridex", "meta": { "extensions": [ ".bart.zip", ".bart", ".perl" ], "payment-method": "Bitcoin", "price": "3", "ransomnotes-filenames": [ "recover.txt", "recover.bmp" ], "refs": [ "http://now.avg.com/barts-shenanigans-are-no-match-for-avg/", "http://phishme.com/rockloader-downloading-new-ransomware-bart/", "https://www.proofpoint.com/us/threat-insight/post/New-Bart-Ransomware-from-Threat-Actors-Spreading-Dridex-and-Locky" ], "synonyms": [ "BaCrypt" ] }, "related": [ { "dest-uuid": "1dfd3ba6-7f82-407f-958d-c4a2ac055123", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "3cf2c880-e0b5-4311-9c4e-6293f2a566e7", "value": "Bart" }, { "description": "Ransomware Has a GUI. CryptoGraphic Locker family. Newer CoinVault variant.", "meta": { "extensions": [ ".clf" ], "payment-method": "Bitcoin", "price": "1", "refs": [ "https://noransom.kaspersky.com/", "https://id-ransomware.blogspot.com/2016/05/bitcryptor-ransomware-aes-256-1-btc.html" ] }, "uuid": "b5e9a802-cd17-4cd6-b83d-f36cce009808", "value": "BitCryptor" }, { "description": "Ransomware", "meta": { "encryption": "Base64 + String Replacement", "extensions": [ ".bitstak" ], "payment-method": "Bitcoin", "price": "0.07867 (40€)", "refs": [ "https://download.bleepingcomputer.com/demonslay335/BitStakDecrypter.zip", "https://id-ransomware.blogspot.com/2016/07/ransomware-007867.html" ] }, "uuid": "33e398fa-2586-415e-9b18-6ea2ea36ff74", "value": "BitStak" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".Silent" ], "payment-method": "Bitcoin", "price": "0.07 (30$)", "ransomnotes-filenames": [ "Hacked_Read_me_to_decrypt_files.html", "YourID.txt" ], "refs": [ "http://nyxbone.com/malware/BlackShades.html", "https://id-ransomware.blogspot.com/2016/06/silentshade-ransomware-blackshades.html" ], "synonyms": [ "SilentShade", "BlackShades" ] }, "uuid": "bf065217-e13a-4f6d-a5b2-ba0750b5c312", "value": "BlackShades Crypter" }, { "description": "Ransomware Based on HiddenTear", "meta": { "encryption": "AES-256", "extensions": [ ".blocatto" ], "payment-method": "Bitcoin", "price": "5 - 10", "refs": [ "http://www.bleepingcomputer.com/forums/t/614456/bloccato-ransomware-bloccato-help-support-leggi-questo-filetxt/" ] }, "uuid": "a3e1cfec-aacd-4d84-aa7d-99ed6c17f26d", "value": "Blocatto" }, { "description": "Ransomware EXE was replaced to neutralize threat", "meta": { "synonyms": [ "Salami" ] }, "related": [ { "dest-uuid": "b95aa3fb-9f32-450e-8058-67d94f196913", "payment-method": "Bitcoin", "price": "1-2 / 7 after 1 week", "refs": [ "https://id-ransomware.blogspot.com/2016/05/booyah-ransomware-1-2-btc.html" ], "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "eee75995-321f-477f-8b57-eee4eedf4ba3", "value": "Booyah" }, { "description": "Ransomware Based on EDA2", "meta": { "encryption": "AES-256", "extensions": [ ".lock" ], "payment-method": "Reais", "price": "2000 (543$)", "ransomnotes-filenames": [ "MENSAGEM.txt" ], "refs": [ "http://www.nyxbone.com/malware/brazilianRansom.html", "http://www.nyxbone.com/images/articulos/malware/brazilianRansom/0.png" ] }, "uuid": "f9cf4f0d-3efc-4d6d-baf2-7dcb96db1279", "value": "Brazilian" }, { "description": "Ransomware", "meta": { "extensions": [ ".id-%ID%_garryweber@protonmail.ch" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "HOW_OPEN_FILES.html" ], "refs": [ "https://twitter.com/JakubKroustek/status/821831437884211201" ] }, "uuid": "d2bc5ec4-1dd1-408a-a6f6-621986657dff", "value": "Brazilian Globe" }, { "description": "Ransomware", "meta": { "encryption": "AES", "payment-method": "Phone Number", "price": "1000 Rubles (15$)", "refs": [ "https://www.proofpoint.com/us/threat-insight/post/ransomware-explosion-continues-cryptflle2-brlock-mm-locker-discovered" ] }, "uuid": "889d2296-40d2-49f6-be49-cbdfbcde2246", "value": "BrLock" }, { "description": "Ransomware no local encryption, browser only", "uuid": "9769be50-8e0b-4f52-b7f6-98aeac0aaac4", "value": "Browlock" }, { "description": "Ransomware", "meta": { "extensions": [ ".btcware" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-filenames": [ "#_HOW_TO_FIX_!.hta" ], "refs": [ "https://twitter.com/malwrhunterteam/status/845199679340011520" ] }, "uuid": "8d60dec9-d43f-4d52-904f-40fb67e57ef7", "value": "BTCWare Related to / new version of CryptXXX" }, { "description": "Ransomware no file name change, no extension", "meta": { "encryption": "GOST", "payment-method": "Bitcoin", "price": "5", "refs": [ "http://researchcenter.paloaltonetworks.com/2016/05/unit42-bucbi-ransomware-is-back-with-a-ukrainian-makeover/", "https://id-ransomware.blogspot.com/2016/05/bucbi-ransomware.html" ] }, "uuid": "3510ce65-80e6-4f80-8cde-bb5ad8a271c6", "value": "Bucbi" }, { "description": "Ransomware Does not delete Shadow Copies", "meta": { "extensions": [ "(.*).encoded.([A-Z0-9]{9})" ], "ransomnotes-filenames": [ "BUYUNLOCKCODE.txt" ], "refs": [ "https://id-ransomware.blogspot.com/2016/05/buyunlockcode-ransomware-rsa-1024.html" ] }, "uuid": "289624c4-1d50-4178-9371-aebd95f423f9", "value": "BuyUnlockCode" }, { "description": "Ransomware", "meta": { "extensions": [ ".cry" ], "payment-method": "Bitcoin", "price": "Variable / 0.3 - 1.2 / Double after 4 days and 4 hours", "ransomnotes-filenames": [ "!Recovery_[random_chars].html", "!Recovery_[random_chars].txt" ], "refs": [ "http://www.bleepingcomputer.com/forums/t/625820/central-security-treatment-organization-ransomware-help-topic-cry-extension/", "https://id-ransomware.blogspot.com/2016/09/cry-ransomware.html" ] }, "related": [ { "dest-uuid": "629f6986-2c1f-4d0a-b805-e4ef3e2ce634", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "980ea9fa-d29d-4a44-bb87-0c050f8ddeaf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "8ff729d9-aee5-4b85-a59d-3f57e105be40", "value": "Central Security Treatment Organization" }, { "description": "Ransomware", "meta": { "encryption": "AES", "extensions": [ ".cerber", ".cerber2", ".cerber3" ], "payment-method": "Bitcoin", "price": "1.24 / 2.48 after 7 days", "ransomnotes-filenames": [ "# DECRYPT MY FILES #.html", "# DECRYPT MY FILES #.txt", "# DECRYPT MY FILES #.vbs", "# README.hta", "_{RAND}_README.jpg", "_{RAND}_README.hta", "_HELP_DECRYPT_[A-Z0-9]{4-8}_.jpg", "_HELP_DECRYPT_[A-Z0-9]{4-8}_.hta", "_HELP_HELP_HELP_%random%.jpg", "_HELP_HELP_HELP_%random%.hta", "_HOW_TO_DECRYPT_[A-Z0-9]{4-8}_.hta", "_HOW_TO_DECRYPT_[A-Z0-9]{4-8}_.jpg" ], "refs": [ "https://blog.malwarebytes.org/threat-analysis/2016/03/cerber-ransomware-new-but-mature/", "https://community.rsa.com/community/products/netwitness/blog/2016/11/04/the-evolution-of-cerber-v410", "https://www.bleepingcomputer.com/news/security/cerber-renames-itself-as-crbr-encryptor-to-be-a-pita/" ], "synonyms": [ "CRBR ENCRYPTOR" ] }, "related": [ { "dest-uuid": "79a7203a-6ea5-4c39-abd4-faa20cf8821a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "190edf95-9cd9-4e4a-a228-b716d52a751b", "value": "Cerber" }, { "description": "Ransomware", "meta": { "encryption": "AES", "extensions": [ ".crypt", "4 random characters, e.g., .PzZs, .MKJL" ], "payment-method": "Bitcoin", "price": "0.939", "ransomnotes-filenames": [ "YOUR_FILES_ARE_ENCRYPTED.HTML", "YOUR_FILES_ARE_ENCRYPTED.TXT", ".gif" ], "refs": [ "http://www.bleepingcomputer.com/news/security/chimera-ransomware-decryption-keys-released-by-petya-devs/", "https://blog.malwarebytes.org/threat-analysis/2015/12/inside-chimera-ransomware-the-first-doxingware-in-wild/" ], "synonyms": [ "Quimera Crypter", "Pashka" ] }, "uuid": "27b036f0-afa3-4984-95b3-47fa344b1aa7", "value": "Chimera" }, { "description": "Ransomware Does not encrypt anything", "meta": { "payment-method": "Paypal", "price": "20$", "refs": [ "https://twitter.com/JakubKroustek/status/794956809866018816" ] }, "uuid": "af3b3bbb-b54d-49d0-8e58-e9c56762a96b", "value": "Clock" }, { "description": "Ransomware CryptoGraphic Locker family. Has a GUI. Do not confuse with CrypVault!", "meta": { "extensions": [ ".clf" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "wallpaper.jpg" ], "refs": [ "https://noransom.kaspersky.com/", "https://id-ransomware.blogspot.com/2016/05/bitcryptor-ransomware-aes-256-1-btc.html" ] }, "uuid": "15941fb1-08f0-4276-a61f-e2a306d6c6b5", "value": "CoinVault" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".coverton", ".enigma", ".czvxce" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "!!!-WARNING-!!!.html", "!!!-WARNING-!!!.txt" ], "refs": [ "http://www.bleepingcomputer.com/news/security/paying-the-coverton-ransomware-may-not-get-your-data-back/", "https://id-ransomware.blogspot.com/2016/04/coverton-ransomware.html" ] }, "uuid": "36450e8c-ff66-4ecf-9c0f-fbfb27a72d63", "value": "Coverton" }, { "description": "Ransomware", "meta": { "extensions": [ ".{CRYPTENDBLACKDC}" ], "refs": [ "https://support.kaspersky.com/viruses/disinfection/8547" ] }, "uuid": "2c11d679-1fb1-4bd7-9516-9c6f402f3c25", "value": "Cryaki" }, { "description": "Ransomware", "meta": { "refs": [ "https://support.kaspersky.com/viruses/disinfection/8547" ] }, "uuid": "93dcd241-f2d6-40f3-aee3-351420046a77", "value": "Crybola" }, { "description": "Ransomware", "meta": { "encryption": "Moves bytes", "extensions": [ ".criptiko", ".criptoko", ".criptokod", ".cripttt", ".aga" ], "payment-method": "Email", "price": "100$", "ransomnotes-refs": [ "http://virusinfo.info/showthread.php?t=185396" ], "refs": [ "SHTODELATVAM.txt", "Instructionaga.txt", "https://id-ransomware.blogspot.com/2016/06/cryfile-ransomware-100.html" ] }, "uuid": "0d46e21d-8f1c-4355-8205-185fb7e041a7", "value": "CryFile" }, { "description": "Ransomware Identifies victim locations w/Google Maps API", "meta": { "extensions": [ ".cry" ], "payment-method": "Bitcoin", "price": "Variable / 0.3 - 1.2 / Double after 4 days and 4 hours", "ransomnotes-filenames": [ "!Recovery_[random_chars].html", "!Recovery_[random_chars].txt" ], "refs": [ "http://www.bleepingcomputer.com/news/security/the-crylocker-ransomware-communicates-using-udp-and-stores-data-on-imgur-com/", "https://id-ransomware.blogspot.com/2016/09/cry-ransomware.html" ], "synonyms": [ "Cry", "CSTO", "Central Security Treatment Organization" ] }, "related": [ { "dest-uuid": "8ff729d9-aee5-4b85-a59d-3f57e105be40", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "980ea9fa-d29d-4a44-bb87-0c050f8ddeaf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "629f6986-2c1f-4d0a-b805-e4ef3e2ce634", "value": "CryLocker" }, { "description": "Ransomware CryptXXX clone/spinoff", "meta": { "encryption": "AES-256", "payment-method": "Bitcoin", "price": "Variable / 0.3 - 1.2 / Double after 4 days and 4 hours", "ransomnotes-filenames": [ "README.TXT", "README.HTML", "README.BMP" ], "refs": [ "http://blog.trendmicro.com/trendlabs-security-intelligence/crypmic-ransomware-wants-to-follow-cryptxxx/", "https://id-ransomware.blogspot.com/2016/07/crypmic-ransomware-aes-256.html" ] }, "uuid": "82cb7a40-0a78-4414-9afd-028d6b3082ea", "value": "CrypMIC" }, { "description": "Ransomware", "meta": { "extensions": [ ".ENCRYPTED" ], "payment-method": "Bitcoin", "price": "0.1 (45$)", "ransomnotes-filenames": [ "READ_THIS_TO_DECRYPT.html" ], "refs": [ "https://github.com/pekeinfo/DecryptCrypren", "http://www.nyxbone.com/malware/Crypren.html", "http://www.nyxbone.com/images/articulos/malware/crypren/0.png" ] }, "uuid": "a9f05b4e-6b03-4211-a2bd-6b4432eb3388", "value": "Crypren" }, { "description": "Ransomware", "meta": { "encryption": "AES", "extensions": [ ".crypt38" ], "payment-method": "Rubles", "price": "1000 (15$)", "refs": [ "https://download.bleepingcomputer.com/demonslay335/Crypt38Keygen.zip", "https://blog.fortinet.com/2016/06/17/buggy-russian-ransomware-inadvertently-allows-free-decryption", "https://id-ransomware.blogspot.com/2016/06/regist-crypt38-ransomware-aes-1000-15.html" ] }, "uuid": "12a96f43-8a8c-410e-aaa3-ba6735276555", "value": "Crypt38" }, { "description": "Ransomware Does not actually encrypt the files, but simply renames them", "meta": { "payment-method": "Bitcoin", "price": "1", "refs": [ "https://twitter.com/jiriatvirlab/status/802554159564062722" ] }, "uuid": "37edc8d7-c939-4a33-9ed5-dafbbc1e5b1e", "value": "Crypter" }, { "description": "Ransomware", "meta": { "encryption": "RSA", "extensions": [ ".scl", "id[_ID]email_xerx@usa.com.scl" ], "payment-method": "Bitcoin", "price": "0.5 - 1.5", "refs": [ "https://www.proofpoint.com/us/threat-insight/post/ransomware-explosion-continues-cryptflle2-brlock-mm-locker-discovered", "https://id-ransomware.blogspot.com/2016/06/cryptfile2-ransomware-rsa-email.html" ], "synonyms": [ "Lesli" ] }, "uuid": "5b0dd136-6428-48c8-b2a6-8e926a82dfac", "value": "CryptFIle2" }, { "description": "Ransomware", "meta": { "extensions": [ ".crinf" ], "payment-method": "Bitcoin", "price": "0.5 - 1.5", "refs": [ "https://decrypter.emsisoft.com/", "https://id-ransomware.blogspot.com/2016/06/cryptfile2-ransomware-rsa-email.html" ], "synonyms": [ "DecryptorMax" ] }, "uuid": "2b0d60c3-6560-49ac-baf0-5f642e8a77de", "value": "CryptInfinite" }, { "description": "Ransomware sekretzbel0ngt0us.KEY - do not confuse with CryptorBit.", "meta": { "encryption": "AES + RSA", "payment-method": "Bitcoin", "price": "1 - 2", "ransomnotes-filenames": [ "OKSOWATHAPPENDTOYOURFILES.TXT" ], "refs": [ "http://www.pandasecurity.com/mediacenter/panda-security/cryptobit/", "http://news.softpedia.com/news/new-cryptobit-ransomware-could-be-decryptable-503239.shtml", "https://id-ransomware.blogspot.com/2016/04/cryptobit-ransomware.html" ] }, "related": [ { "dest-uuid": "681f212a-af1b-4e40-a718-81b0dc46dc52", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "1903ed75-05f7-4019-b0b7-7a8f23f22194", "value": "CryptoBit" }, { "description": "Ransomware no extension change", "meta": { "encryption": "RSA", "payment-method": "Bitcoin", "price": "0.9 (500$) - 1.9 (1000$) after 4 days", "ransomnotes-filenames": [ "HOW_DECRYPT.TXT", "HOW_DECRYPT.HTML", "HOW_DECRYPT.URL" ], "refs": [ "https://decrypter.emsisoft.com/", "https://id-ransomware.blogspot.com/2016/04/cryptodefense-ransomware.html" ] }, "uuid": "ad9eeff2-91b4-440a-ae74-ab84d3e2075e", "value": "CryptoDefense" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "price": "0.2", "refs": [ "http://blog.talosintel.com/2016/07/ranscam.html", "https://nakedsecurity.sophos.com/2016/07/13/ransomware-that-demands-money-and-gives-you-back-nothing/", "https://id-ransomware.blogspot.com/search?q=CryptoFinancial" ], "synonyms": [ "Ranscam" ] }, "related": [ { "dest-uuid": "50c92b0b-cae3-41e7-b7d8-dffc2c88ac4b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "383d7ebb-9b08-4874-b5d7-dc02b499c38f", "value": "CryptoFinancial" }, { "description": "Ransomware Mimics Torrentlocker. Encrypts only 50% of each file up to 5 MB", "meta": { "encryption": "AES-256 + RSA-1024", "extensions": [ ".frtrss" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "READ IF YOU WANT YOUR FILES BACK.html" ], "refs": [ "https://id-ransomware.blogspot.com/2016/05/cryptofortress-ransomware-aes-256-1.html" ] }, "related": [ { "dest-uuid": "b817ce63-f1c3-49de-bd8b-fd56c3f956c9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ae4aa1ef-4da0-4952-9583-9d47f84edad9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "7f6cd579-b021-4896-80da-fcc07c35c8b2", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "26c8b446-305c-4057-83bc-85b09630281e", "value": "CryptoFortress" }, { "description": "Ransomware Has a GUI. Subvariants: CoinVault BitCryptor", "meta": { "extensions": [ ".clf" ], "ransomnotes-filenames": [ "wallpaper.jpg" ] }, "uuid": "58534bc4-eb96-44f4-bdad-2cc5cfea8c6f", "value": "CryptoGraphic Locker" }, { "description": "Ransomware RAR's victim's files has a GUI", "meta": { "encryption": "AES-256 (RAR implementation)", "payment-method": "Bitcoin", "price": "0.33", "refs": [ "http://www.bleepingcomputer.com/news/security/cryptohost-decrypted-locks-files-in-a-password-protected-rar-file/", "https://id-ransomware.blogspot.com/2016/04/cryptohost-ransomware.html" ], "synonyms": [ "Manamecrypt", "Telograph", "ROI Locker" ] }, "related": [ { "dest-uuid": "54cd671e-b7e4-4dd3-9bfa-dc0ba5105944", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "dba2cf74-16a9-4ed8-8536-6542fda95999", "value": "CryptoHost" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".crjoker" ], "payment-method": "Bitcoin", "price": "100€", "ransomnotes-filenames": [ "README!!!.txt", "GetYouFiles.txt", "crjoker.html" ], "refs": [ "https://id-ransomware.blogspot.com/2017/07/cryptojoker-2017-ransomware.html" ] }, "related": [ { "dest-uuid": "10f92054-b028-11e8-a51f-2f82236ac72d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "2fb307a2-8752-4521-8973-75b68703030d", "value": "CryptoJoker" }, { "description": "Ransomware no longer relevant", "meta": { "extensions": [ ".encrypted", ".ENC" ], "refs": [ "https://www.fireeye.com/blog/executive-perspective/2014/08/your-locker-of-information-for-cryptolocker-decryption.html", "https://reaqta.com/2016/04/uncovering-ransomware-distribution-operation-part-2/" ] }, "related": [ { "dest-uuid": "c5a783da-9ff3-4427-84c5-428480b21cc7", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "b35b1ca2-f99c-4495-97a5-b8f30225cb90", "value": "CryptoLocker" }, { "description": "Ransomware", "meta": { "payment-method": "Email", "refs": [ "https://twitter.com/malwrhunterteam/status/839747940122001408" ] }, "uuid": "8d5e3b1f-e333-4eed-8dec-d74f19d6bcbb", "value": "CryptoLocker 1.0.0" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "price": "250€", "refs": [ "https://twitter.com/malwrhunterteam/status/782890104947867649" ] }, "uuid": "e1412d2a-2a94-4c83-aed0-9e09523514a4", "value": "CryptoLocker 5.1" }, { "description": "Ransomware", "meta": { "extensions": [ ".code", ".scl", ".rmd", ".lesli", ".rdmk", ".CRYPTOSHIELD", ".CRYPTOSHIEL", ".id_(ID_MACHINE)_email_xoomx@dr.com_.code", ".id_*_email_zeta@dr.com", ".id_(ID_MACHINE)_email_anx@dr.com_.scl", ".email[supl0@post.com]id[\\[[a-z0-9]{16}\\]].lesli", "*filename*.email[*email*]_id[*id*].rdmk", ".EMPTY", ".0000", ".XZZX", ".TEST", ".WORK", ".SYSTEM", ".MOLE66", ".BACKUP", "[16 uppercase hex].SYS" ], "payment-method": "Bitcoin", "price": "5", "ransomnotes": [ "HELP_YOUR_FILES.html (CryptXXX)", "HELP_YOUR_FILES.txt (CryptoWall 3.0, 4.0)", "Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\nempty01@techmail.info\n\nempty02@yahooweb.co\n\nempty003@protonmail.com\n\nWe will help You as soon as possible!\n\nDECRYPT-ID-[id] number", "Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\ny0000@tuta.io\n\ny0000@protonmail.com\n\ny0000z@yandex.com\n\ny0000s@yandex.com\n\nPlease send email to all email addresses! We will help You as soon as possible!\n\nDECRYPT-ID-[id]", "Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\nxzzx@tuta.io\n\nxzzx1@protonmail.com\n\nxzzx10@yandex.com\n\nxzzx101@yandex.com\n\nPlease send email to all email addresses! We will help You as soon as possible!\n\nDECRYPT-ID-[id] number", "Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\ntest757@tuta.io\n\ntest757@protonmail.com\n\ntest757xz@yandex.com\n\ntest757xy@yandex.com\n\ntest757@consultant.com\n\nPlease send email to all email addresses! We will help You as soon as possible!\n\nIMPORTANT: DO NOT USE ANY PUBLIC SOFTWARE! IT MAY DAMAGE YOUR DATA FOREVER!\n\nDECRYPT-ID-[id] number", "Attention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\nworknow@keemail.me\n\nworknow@protonmail.com\n\nworknow8@yandex.com\n\nworknow9@yandex.com\n\nworknow@techie.com\n\nPlease send email to all email addresses! We will help You as soon as possible!\n\nIMPORTANT: DO NOT USE ANY PUBLIC SOFTWARE! IT MAY DAMAGE YOUR DATA FOREVER!\n\nDECRYPT-ID-[id] number", "Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\nsystemwall@keemail.me\n\nsystemwall@protonmail.com\n\nsystemwall@yandex.com\n\nsystemwall1@yandex.com\n\nemily.w@dr.com\n\nPlease send email to all email addresses! We will help You as soon as possible!\n\nIMPORTANT: DO NOT USE ANY PUBLIC SOFTWARE! IT MAY DAMAGE YOUR DATA FOREVER!\n\nDECRYPT-ID-%s number", "!!!All your files are encrypted!!!\nWhat to decipher write on mail alpha2018a@aol.com\nDo not move or delete files!!!!\n---- Your ID: 5338f74a-3c20-4ac0-9deb-f3a91818cea7 ----\n!!! You have 3 days otherwise you will lose all your data.!!!", "Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\nbackuppc@tuta.io\n\nbackuppc@protonmail.com\n\nbackuppc1@protonmail.com\n\nb4ckuppc1@yandex.com\n\nb4ckuppc2@yandex.com\n\nbackuppc1@dr.com\n\nPlease send email to all email addresses! We will help You as soon as possible!\n\nIMPORTANT: DO NOT USE ANY PUBLIC SOFTWARE! IT MAY DAMAGE YOUR DATA FOREVER!\n\n\nDECRYPT-ID-[id] number", "Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\nleab@tuta.io\n\nitprocessor@protonmail.com\n\npcambulance1@protonmail.com\n\nleablossom@yandex.com\n\nblossomlea@yandex.com\n\nleablossom@dr.com\n\nPlease send email to all email addresses! We will help You as soon as possible!\n\nIMPORTANT: DO NOT USE ANY PUBLIC SOFTWARE! IT MAY DAMAGE YOUR DATA FOREVER!\n\n\nDECRYPT-ID-[redacted lowercase GUID] number" ], "ransomnotes-filenames": [ "INSTRUCTION RESTORE FILE.TXT", "# HELP_DECRYPT_YOUR_FILES #.TXT", "_HELP_INSTRUCTION.TXT", "C:\\ProgramData\\[random].exe" ], "ransomnotes-refs": [ "https://pbs.twimg.com/media/DuFQ4FdWoAMy7Hg.jpg" ], "refs": [ "http://www.nyxbone.com/malware/CryptoMix.html", "https://www.cert.pl/en/news/single/technical-analysis-of-cryptomixcryptfile2-ransomware/", "https://twitter.com/JakubKroustek/status/804009831518572544", "https://www.bleepingcomputer.com/news/security/new-empty-cryptomix-ransomware-variant-released/", "https://www.bleepingcomputer.com/news/security/0000-cryptomix-ransomware-variant-released/", "https://www.bleepingcomputer.com/news/security/xzzx-cryptomix-ransomware-variant-released/", "https://www.bleepingcomputer.com/news/security/test-cryptomix-ransomware-variant-released/", "https://www.bleepingcomputer.com/news/security/work-cryptomix-ransomware-variant-released/", "https://www.bleepingcomputer.com/news/security/system-cryptomix-ransomware-variant-released/", "https://www.bleepingcomputer.com/news/security/mole66-cryptomix-ransomware-variant-released/", "https://www.bleepingcomputer.com/news/security/new-backup-cryptomix-ransomware-variant-actively-infecting-users/", "https://twitter.com/demonslay335/status/1072227523755470848", "https://www.coveware.com/blog/cryptomix-ransomware-exploits-cancer-crowdfunding", "https://www.bleepingcomputer.com/news/security/cryptomix-ransomware-exploits-sick-children-to-coerce-payments/" ], "synonyms": [ "Zeta" ] }, "related": [ { "dest-uuid": "55d5742e-20f5-4c9a-887a-4dbd5b37d921", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "value": "CryptoMix" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "price": "Some Bitcoins", "refs": [ "https://twitter.com/malwrhunterteam/status/817672617658347521" ] }, "related": [ { "dest-uuid": "2f65f056-6cba-4a5b-9aaf-daf31eb76fc2", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "de53f392-8794-43d1-a38b-c0b90c20a3fb", "value": "CryptoRansomeware" }, { "description": "Ransomware", "meta": { "encryption": "AES", "extensions": [ ".crptrgr" ], "payment-method": "Bitcoin", "price": "0.5 (360$)", "ransomnotes-filenames": [ "!Where_are_my_files!.html" ], "refs": [ "http://www.bleepingcomputer.com/news/security/new-ransomware-called-cryptoroger-that-appends-crptrgr-to-encrypted-files/", "https://id-ransomware.blogspot.com/2016/06/cryptoroger-aes-256-0.html" ] }, "uuid": "b6fe71ba-b0f4-4cc4-b84c-d3d80a37eada", "value": "CryptoRoger" }, { "description": "Ransomware", "meta": { "extensions": [ ".doomed" ], "ransomnotes-filenames": [ "LEER_INMEDIATAMENTE.txt" ], "refs": [ "https://twitter.com/struppigel/status/821992610164277248" ] }, "uuid": "b11563ce-cced-4c8b-a3a1-0c4ff76aa0ef", "value": "CryptoShadow" }, { "description": "Ransomware", "meta": { "encryption": "AES", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "200$", "ransomnotes-filenames": [ "ATTENTION.url" ], "refs": [ "http://www.bleepingcomputer.com/forums/t/617601/cryptoshocker-ransomware-help-and-support-topic-locked-attentionurl/", "https://id-ransomware.blogspot.com/2016/06/cryptoshocker-ransomware-aes-200.html" ] }, "uuid": "545b4b25-763a-4a5c-8dda-12142c00422c", "value": "CryptoShocker" }, { "description": "Ransomware", "meta": { "extensions": [ ".CryptoTorLocker2015!" ], "payment-method": "Bitcoin", "price": "0.5 (100$)", "ransomnotes-filenames": [ "HOW TO DECRYPT FILES.txt", "%Temp%\\.bmp" ], "refs": [ "http://www.bleepingcomputer.com/forums/t/565020/new-cryptotorlocker2015-ransomware-discovered-and-easily-decrypted/", "https://id-ransomware.blogspot.com/2016/04/cryptotorlocker-ransomware.html" ] }, "uuid": "06ec3640-4b93-4e79-a8ec-e24b3d349dd5", "value": "CryptoTorLocker2015" }, { "description": "Ransomware", "meta": { "encryption": "AES", "refs": [ "http://news.softpedia.com/news/new-open-source-linux-ransomware-shows-infosec-community-divide-508669.shtml" ] }, "uuid": "13fdf55f-46f7-4635-96b8-b4806c78a80c", "value": "CryptoTrooper" }, { "description": "Ransomware, Infection by Phishing", "meta": { "encryption": "RSA", "payment-method": "Bitcoin", "price": "1.09 (500$)", "ransomnotes-filenames": [ "DECRYPT_INSTRUCTION.HTM", "DECRYPT_INSTRUCTION.TXT", "DECRYPT_INSTRUCTION.URL", "INSTALL_TOR.URL" ] }, "uuid": "5559fbc1-52c6-469c-be97-8f8344765577", "value": "CryptoWall 1" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "price": "1.09 (500$)", "ransomnotes-filenames": [ "HELP_DECRYPT.TXT", "HELP_DECRYPT.PNG", "HELP_DECRYPT.URL", "HELP_DECRYPT.HTML" ] }, "uuid": "f2780d22-4410-4a2f-a1c3-f43807ed1f19", "value": "CryptoWall 2" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "price": "1.09 (500$)", "ransomnotes-filenames": [ "HELP_DECRYPT.TXT", "HELP_DECRYPT.PNG", "HELP_DECRYPT.URL", "HELP_DECRYPT.HTML" ], "refs": [ "https://blogs.technet.microsoft.com/mmpc/2015/01/13/crowti-update-cryptowall-3-0/", "https://www.virustotal.com/en/file/45317968759d3e37282ceb75149f627d648534c5b4685f6da3966d8f6fca662d/analysis/" ] }, "uuid": "9d35fe47-5f8c-494c-a74f-23a7ac7f44be", "value": "CryptoWall 3" }, { "description": "Ransomware", "meta": { "extensions": [ "., e.g. ,27p9k967z.x1nep" ], "payment-method": "Bitcoin", "price": "1.09 (500$)", "ransomnotes-filenames": [ "HELP_YOUR_FILES.HTML", "HELP_YOUR_FILES.PNG" ] }, "uuid": "f7c04ce6-dd30-4a94-acd4-9a3125bcb12e", "value": "CryptoWall 4" }, { "description": "Ransomware Comes with Bedep", "meta": { "extensions": [ ".crypt" ], "payment-method": "Bitcoin", "price": "1.2 (500$) - 2.4", "ransomnotes-filenames": [ "de_crypt_readme.bmp", "de_crypt_readme.txt", "de_crypt_readme.html", "[victim_id].html", "[victim_id].bmp", "!Recovery_[victim_id].bmp", "!Recovery_[victim_id].html", "!Recovery_[victim_id].txt" ], "refs": [ "https://support.kaspersky.com/viruses/disinfection/8547", "http://www.bleepingcomputer.com/virus-removal/cryptxxx-ransomware-help-information", "https://id-ransomware.blogspot.com/2016/04/cryptxxx-ransomware.html" ], "synonyms": [ "CryptProjectXXX" ] }, "related": [ { "dest-uuid": "e272d0b5-cdfc-422a-bb78-9214475daec5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "255aac37-e4d2-4eeb-b8de-143f9c2321bd", "value": "CryptXXX" }, { "description": "Ransomware Locks screen. Ransom note names are an ID. Comes with Bedep.", "meta": { "extensions": [ ".crypt" ], "payment-method": "Bitcoin", "price": "1.2 (500$) - 2.4", "ransomnotes-filenames": [ ".txt", ".html", ".bmp" ], "refs": [ "https://support.kaspersky.com/viruses/disinfection/8547", "https://www.proofpoint.com/us/threat-insight/post/cryptxxx2-ransomware-authors-strike-back-against-free-decryption-tool", "http://blogs.cisco.com/security/cryptxxx-technical-deep-dive", "https://id-ransomware.blogspot.com/2016/04/cryptxxx-ransomware.html" ], "synonyms": [ "CryptProjectXXX" ] }, "related": [ { "dest-uuid": "255aac37-e4d2-4eeb-b8de-143f9c2321bd", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "e272d0b5-cdfc-422a-bb78-9214475daec5", "value": "CryptXXX 2.0" }, { "description": "Ransomware Comes with Bedep", "meta": { "extensions": [ ".crypt", ".cryp1", ".crypz", ".cryptz", "random" ], "payment-method": "Bitcoin", "price": "1.2 (500$) - 2.4", "refs": [ "https://support.kaspersky.com/viruses/disinfection/8547", "http://www.bleepingcomputer.com/news/security/cryptxxx-updated-to-version-3-0-decryptors-no-longer-work/", "http://blogs.cisco.com/security/cryptxxx-technical-deep-dive", "https://id-ransomware.blogspot.com/2016/04/cryptxxx-ransomware.html" ], "synonyms": [ "UltraDeCrypter", "UltraCrypter" ] }, "uuid": "60a50fe5-53ea-43f0-8a17-e7134f5fc371", "value": "CryptXXX 3.0" }, { "description": "Ransomware StilerX credential stealing", "meta": { "extensions": [ ".cryp1" ], "payment-method": "Bitcoin", "price": "1.2 (500$) - 2.4", "refs": [ "https://support.kaspersky.com/viruses/disinfection/8547", "https://www.proofpoint.com/us/threat-insight/post/cryptxxx-ransomware-learns-samba-other-new-tricks-with-version3100", "https://id-ransomware.blogspot.com/2016/04/cryptxxx-ransomware.html" ] }, "uuid": "3f5a76ea-6b83-443e-b26f-b2b2d02d90e0", "value": "CryptXXX 3.1" }, { "description": "Ransomware", "meta": { "encryption": "AES", "extensions": [ ".cry" ], "payment-method": "Email", "ransomnotes-filenames": [ "README_FOR_DECRYPT.txt" ], "refs": [ "http://www.bleepingcomputer.com/news/security/ctb-faker-ransomware-does-a-poor-job-imitating-ctb-locker/", "https://id-ransomware.blogspot.com/2016/09/crypy-ransomware.html" ] }, "uuid": "0b0f5f33-1871-461d-8e7e-b5e0ebc82311", "value": "CryPy" }, { "description": "Ransomware", "meta": { "encryption": "RSA-2048", "extensions": [ ".ctbl", ".([a-z]{6,7})" ], "payment-method": "Bitcoin", "price": "0.08686 (50$)", "ransomnotes-filenames": [ "AllFilesAreLocked .bmp", "DecryptAllFiles .txt", ".html" ], "refs": [ "https://id-ransomware.blogspot.com/2016/07/ctb-faker-ransomware-008.html" ], "synonyms": [ "Citroni" ] }, "uuid": "6212bf8f-07db-490a-8cef-ac42042076c1", "value": "CTB-Faker" }, { "description": "Ransomware websites only", "meta": { "payment-method": "Bitcoin", "price": "0.4 - 0.8", "refs": [ "https://thisissecurity.net/2016/02/26/a-lockpicking-exercise/", "https://github.com/eyecatchup/Critroni-php", "https://id-ransomware.blogspot.com/2016/06/ctb-locker-for-websites-04.html" ] }, "uuid": "555b2c6f-0848-4ac1-9443-e4c20814459a", "value": "CTB-Locker WEB" }, { "description": "Ransomware Based on my-Little-Ransomware", "meta": { "encryption": "AES-128", "extensions": [ ".已加密", ".encrypted" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes": [ "Your files encrypted by our friends !!! txt" ], "ransomnotes-filenames": [ "你的檔案被我們加密啦!!!.txt" ], "refs": [ "https://github.com/aaaddress1/my-Little-Ransomware/tree/master/decryptoTool", "https://github.com/aaaddress1/my-Little-Ransomware" ], "synonyms": [ "my-Little-Ransomware" ] }, "uuid": "1a369bbf-6f03-454c-b507-15abe2a8bbb4", "value": "CuteRansomware" }, { "description": "Ransomware Based on HiddenTear", "meta": { "payment-method": "Bitcoin", "price": "1", "refs": [ "https://twitter.com/struppigel/status/778871886616862720", "https://twitter.com/struppigel/status/806758133720698881", "https://id-ransomware.blogspot.com/2016/09/cyber-splitter-vbs-ransomware.html" ], "synonyms": [ "CyberSplitter" ] }, "related": [ { "dest-uuid": "8bde6075-8c5b-4ff1-be9a-4e2b1d3419aa", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "587589df-ee42-43f4-9480-c65d6e1d7e0f", "value": "Cyber SpLiTTer Vbs" }, { "description": "Ransomware", "meta": { "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "1.5", "ransomnotes-filenames": [ "READ_IT.txt" ], "refs": [ "https://twitter.com/JaromirHorejsi/status/815555258478981121" ] }, "uuid": "0f074c07-613d-43cb-bd5f-37c747d39fe2", "value": "Death Bitches" }, { "description": "Ransomware", "meta": { "extensions": [ ".html" ], "refs": [ "http://www.malwareremovalguides.info/decrypt-files-with-decrypt_mblblock-exe-decrypt-protect/" ] }, "uuid": "c80c78ae-fc05-44cf-8b47-4d50c103ca70", "value": "DeCrypt Protect" }, { "description": "Ransomware Based on EDA2", "meta": { "encryption": "AES-256", "extensions": [ ".ded" ], "payment-method": "Bitcoin", "price": "2", "refs": [ "http://www.bleepingcomputer.com/forums/t/617395/dedcryptor-ded-help-support-topic/", "http://www.nyxbone.com/malware/DEDCryptor.html", "https://id-ransomware.blogspot.com/2016/06/dedcryptor-ransomware-aes-256rsa-2.html" ] }, "uuid": "496b6c3c-771a-46cd-8e41-ce7c4168ae20", "value": "DEDCryptor" }, { "description": "Ransomware only encrypts .jpg files", "meta": { "extensions": [ ".encrypted" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-filenames": [ "HELP_YOUR_FILES.txt" ], "refs": [ "https://twitter.com/struppigel/status/798573300779745281", "https://id-ransomware.blogspot.com/2017/10/cryptodemo-ransomware.html" ], "synonyms": [ "CryptoDemo" ] }, "uuid": "b314d86f-92bb-4be3-b32a-19d6f8eb55d4", "value": "Demo" }, { "description": "Ransomware - Based on Detox: Calipso, We are all Pokemons, Nullbyte", "meta": { "encryption": "AES", "payment-method": "Bitcoin", "price": "2 - 3", "refs": [ "http://www.bleepingcomputer.com/news/security/new-detoxcrypto-ransomware-pretends-to-be-pokemongo-or-uploads-a-picture-of-your-screen/", "https://id-ransomware.blogspot.com/2016/08/detoxcrypto-ransomware.html" ] }, "uuid": "be094d75-eba8-4ff3-91f1-f8cde687e5ed", "value": "DetoxCrypto" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "price": "0.05", "ransomnotes": [ "Digisom Readme0.txt (0 to 9)" ], "refs": [ "https://twitter.com/PolarToffee/status/829727052316160000" ] }, "uuid": "c5b2a0bc-352f-481f-8c35-d378754793c0", "value": "Digisom" }, { "description": "Ransomware", "meta": { "payment-method": "No ransom", "refs": [ "https://twitter.com/demonslay335/status/752586334527709184", "https://id-ransomware.blogspot.com/2016/07/revoyem-dirtydecrypt-ransomware-doc.html" ] }, "uuid": "5ad8a530-3ab9-48b1-9a75-e1e97b3f77ec", "value": "DirtyDecrypt" }, { "description": "Ransomware no extension change Encrypted files have prefix: Version 1: ABCXYZ11 - Version 2: !DMALOCK - Version 3: !DMALOCK3.0 - Version 4: !DMALOCK4.0", "meta": { "encryption": "AES-256 in ECB mode, Version 2-4 also RSA", "payment-method": "Bitcoin", "price": "1 - 2 - 4", "ransomnotes-filenames": [ "cryptinfo.txt", "decrypting.txt", "start.txt" ], "refs": [ "https://decrypter.emsisoft.com/", "https://github.com/hasherezade/dma_unlocker", "https://drive.google.com/drive/folders/0Bzb5kQFOXkiSMm94QzdyM3hCdDg", "https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-a-new-ransomware-but-no-reason-to-panic/" ] }, "uuid": "407ebc7c-5b05-488f-862f-b2bf6c562372", "value": "DMALocker" }, { "description": "Ransomware", "meta": { "encryption": "AES-256 + XPTLOCK5.0", "payment-method": "Bitcoin", "price": "1 - 2 (440$)", "refs": [ "https://drive.google.com/drive/folders/0Bzb5kQFOXkiSMm94QzdyM3hCdDg", "https://blog.malwarebytes.org/threat-analysis/2016/02/dma-locker-strikes-back/" ] }, "uuid": "ba39be57-c138-48d5-b46b-d996ff899ffa", "value": "DMALocker 3.0" }, { "description": "Ransomware Code to decrypt: 83KYG9NW-3K39V-2T3HJ-93F3Q-GT", "meta": { "extensions": [ ".fucked" ], "payment-method": "Bitcoin", "price": "0.5 (864$)", "refs": [ "https://twitter.com/BleepinComputer/status/822500056511213568" ] }, "uuid": "45cae006-5d14-4c95-bb5b-dcf5555d7c78", "value": "DNRansomware" }, { "description": "Ransomware Based on Hidden Tear", "meta": { "encryption": "AES-256", "extensions": [ ".domino" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "README_TO_RECURE_YOUR_FILES.txt" ], "refs": [ "http://www.nyxbone.com/malware/Domino.html", "http://www.bleepingcomputer.com/news/security/the-curious-case-of-the-domino-ransomware-a-windows-crack-and-a-cow/", "https://id-ransomware.blogspot.com/2016/08/domino-ransomware.html" ] }, "uuid": "7cb20800-2033-49a4-bdf8-a7da5a24f7f1", "value": "Domino" }, { "description": "Ransomware", "meta": { "encryption": "AES-128", "extensions": [ ".id-7ES642406.cry", ".Do_not_change_the_filename" ], "payment-method": "Email", "price": "250$", "ransomnotes-filenames": [ "HOW TO DECODE FILES!!!.txt", "КАК РАСШИФРОВАТЬ ФАЙЛЫ!!!.txt" ], "refs": [ "https://www.bleepingcomputer.com/forums/t/643330/donotchange-ransomware-id-7es642406cry-do-not-change-the-file-namecryp/", "https://id-ransomware.blogspot.com/2017/03/donotchange-ransomware.html" ] }, "uuid": "2e6f4fa6-5fdf-4d69-b764-063d88ba1dd0", "value": "DoNotChange" }, { "description": "Ransomware", "meta": { "extensions": [ ".dCrypt" ], "refs": [ "https://twitter.com/struppigel/status/794108322932785158" ] }, "uuid": "55446b3a-fdc7-4c75-918a-2d9fb5cdf3ff", "value": "DummyLocker" }, { "description": "Ransomware", "meta": { "extensions": [ ".dxxd" ], "payment-method": "Email", "ransomnotes-filenames": [ "ReadMe.TxT" ], "refs": [ "https://www.bleepingcomputer.com/forums/t/627831/dxxd-ransomware-dxxd-help-support-readmetxt/", "https://www.bleepingcomputer.com/news/security/the-dxxd-ransomware-displays-legal-notice-before-users-login/", "https://id-ransomware.blogspot.com/2016/09/dxxd-ransomware.html" ] }, "uuid": "57108b9e-5af8-4797-9924-e424cb5e9903", "value": "DXXD" }, { "description": "Ransomware Open sourced C#", "meta": { "encryption": "AES-256", "extensions": [ ".locked" ], "payment-method": "Download Decrypter", "refs": [ "http://www.utkusen.com/blog/dealing-with-script-kiddies-cryptear-b-incident.html", "https://id-ransomware.blogspot.com/2016/06/hiddentear-2.html" ], "synonyms": [ "Cryptear", "EDA2", "Hidden Tear" ] }, "related": [ { "dest-uuid": "24fe5fef-6325-4c21-9c35-a0ecd185e254", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b96be762-56a0-4407-be04-fcba76c1ff29", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "254f4f67-d850-4dc5-8ddb-2e955ddea287", "value": "HiddenTear" }, { "description": "Ransomware Based on Hidden Tear", "meta": { "extensions": [ ".isis", ".locked" ], "payment-method": "Download Decryter", "ransomnotes-filenames": [ "README.txt" ], "refs": [ "http://www.filedropper.com/decrypter_1", "https://twitter.com/JakubKroustek/status/747031171347910656", "https://id-ransomware.blogspot.com/2016/06/hiddentear-2.html" ], "synonyms": [ "EduCrypter" ] }, "uuid": "826a341a-c329-4e1e-bc9f-5d44c8317557", "value": "EduCrypt" }, { "description": "Ransomware", "meta": { "extensions": [ ".crypted" ], "payment-method": "Bitcoin", "price": "0.25 (320$)", "refs": [ "https://twitter.com/BroadAnalysis/status/845688819533930497", "https://twitter.com/malwrhunterteam/status/845652520202616832" ] }, "uuid": "0a24ea0d-3f8a-428a-8b77-ef5281c1ee05", "value": "EiTest" }, { "description": "Ransomware Has a GUI", "meta": { "extensions": [ ".ha3" ], "payment-method": "Email", "price": "450$ - 1000$", "ransomnotes-filenames": [ "qwer.html", "qwer2.html", "locked.bmp" ], "refs": [ "https://id-ransomware.blogspot.com/2016/07/el-polocker-ransomware-aes-450-aud.html" ], "synonyms": [ "Los Pollos Hermanos" ] }, "uuid": "63d9cb32-a1b9-46c3-818a-df16d8b9e46a", "value": "El-Polocker" }, { "description": "Ransomware Coded in GO", "meta": { "ransomnotes-filenames": [ "Instructions.html" ], "refs": [ "http://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-14-2016-exotic-lockydump-comrade-and-more/", "http://vms.drweb.ru/virus/?_is=1&i=8747343" ], "synonyms": [ "Trojan.Encoder.6491" ] }, "related": [ { "dest-uuid": "a57a8bc3-8c33-43e8-b237-25edcd5f532a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "f855609e-b7ab-41e8-aafa-62016f8f4e1a", "value": "Encoder.xxxx" }, { "description": "Ransomware", "meta": { "extensions": [ ".enc" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "How to recover.enc" ], "refs": [ "https://id-ransomware.blogspot.com/2016/11/encryptojjs-ransomware.html" ] }, "uuid": "3e5deef2-bace-40bc-beb1-5d9009233667", "value": "encryptoJJS" }, { "description": "Ransomware", "meta": { "encryption": "AES-128", "extensions": [ ".enigma", ".1txt" ], "payment-method": "WebSite (onion)", "ransomnotes-filenames": [ "enigma.hta", "enigma_encr.txt", "enigma_info.txt" ], "refs": [ "http://www.bleepingcomputer.com/news/security/the-enigma-ransomware-targets-russian-speaking-users/", "https://id-ransomware.blogspot.com/2016/05/enigma-ransomware-aes-128-0.html" ] }, "uuid": "1b24d240-df72-4388-946b-efa07a9447bb", "value": "Enigma" }, { "description": "Ransomware Based on RemindMe", "meta": { "payment-method": "Bitcoin - Email", "refs": [ "https://twitter.com/malwrhunterteam/status/839022018230112256" ] }, "uuid": "198891fb-26a4-455a-9719-4130bedba103", "value": "Enjey" }, { "description": "Ransomware Target Linux O.S.", "meta": { "payment-method": "Bitcoin", "price": "2", "refs": [ "http://www.bleepingcomputer.com/news/security/new-fairware-ransomware-targeting-linux-computers/" ] }, "uuid": "6771b42f-1d95-4b2e-bbb5-9ab703bbaa9d", "value": "Fairware" }, { "description": "Ransomware Based on Hidden Tear", "meta": { "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "1.50520802", "ransomnotes-filenames": [ "READ ME FOR DECRYPT.txt" ], "refs": [ "https://blog.fortinet.com/post/fakben-team-ransomware-uses-open-source-hidden-tear-code", "https://id-ransomware.blogspot.com/2016/07/fakben-team-ransomware-aes-256-1505.html" ] }, "uuid": "c308346a-2746-4900-8149-464a09086b55", "value": "Fakben" }, { "description": "Ransomware", "meta": { "extensions": [ ".cryptolocker" ], "payment-method": "Bitcoin", "price": "0.5", "refs": [ "https://twitter.com/PolarToffee/status/812312402779836416" ] }, "uuid": "abddc01f-7d76-47d4-985d-ea6d16acccb1", "value": "FakeCryptoLocker" }, { "description": "Ransomware Based on EDA2", "meta": { "encryption": "AES-128", "extensions": [ ".fantom", ".comrade" ], "payment-method": "Email", "ransomnotes": [ "RESTORE-FILES![id]" ], "ransomnotes-filenames": [ "DECRYPT_YOUR_FILES.HTML" ], "refs": [ "http://www.bleepingcomputer.com/news/security/fantom-ransomware-encrypts-your-files-while-pretending-to-be-windows-update/" ], "synonyms": [ "Comrad Circle" ] }, "uuid": "35be87a5-b498-4693-8b8d-8b17864ac088", "value": "Fantom" }, { "description": "Ransomware", "meta": { "extensions": [ ".FenixIloveyou!!" ], "payment-method": "Email", "ransomnotes-filenames": [ "Help to decrypt.txt" ], "refs": [ "https://decrypter.emsisoft.com/fenixlocker", "https://twitter.com/fwosar/status/777197255057084416", "https://id-ransomware.blogspot.com/2016/09/fenixlocker-ransomware.html" ] }, "uuid": "f9f54046-ed5d-4353-8b81-d92b51f596b4", "value": "FenixLocker" }, { "description": "Ransomware RaaS", "meta": { "payment-method": "Bitcoin", "price": "1", "refs": [ "https://twitter.com/rommeljoven17/status/846973265650335744", "https://id-ransomware.blogspot.com/2017/03/filefrozr-ransomware.html" ], "synonyms": [ "FileFrozr" ] }, "uuid": "2a50f476-7355-4d58-b0ce-4235b2546c90", "value": "FILE FROZR" }, { "description": "Ransomware", "meta": { "extensions": [ ".ENCR" ], "payment-method": "Bitcoin", "price": "0.09 (100$ with discount price) - 150$", "refs": [ "https://twitter.com/jiriatvirlab/status/836616468775251968" ] }, "uuid": "b92bc550-7edb-4f8f-96fc-cf47d437df32", "value": "FileLocker" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".firecrypt" ], "payment-method": "Bitcoin", "price": "500$", "ransomnotes-filenames": [ "[random_chars]-READ_ME.html" ], "refs": [ "https://www.bleepingcomputer.com/news/security/firecrypt-ransomware-comes-with-a-ddos-component/", "https://id-ransomware.blogspot.com/2017/01/bleedgreen-ransomware.html" ] }, "related": [ { "dest-uuid": "c4346ed0-1d74-4476-a78c-299bce0409bd", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "721ba430-fd28-454c-8512-24339ef2235f", "value": "FireCrypt" }, { "description": "Ransomware Based on EDA2 / HiddenTear", "meta": { "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "0.5", "refs": [ "https://twitter.com/malwrhunterteam/status/773771485643149312", "https://id-ransomware.blogspot.com/2016/09/flyper-ransomware.html" ] }, "uuid": "1a110f7e-8820-4a9a-86c0-db4056f0b911", "value": "Flyper" }, { "description": "Ransomware contact email safefiles32@mail.ru also as prefix in encrypted file contents", "meta": { "payment-method": "Email", "ransomnotes-filenames": [ "help-file-decrypt.enc", "/pronk.txt" ] }, "uuid": "3d75cb84-2f14-408d-95bd-f1316bf854e6", "value": "Fonco" }, { "description": "Ransomware", "meta": { "refs": [ "https://twitter.com/struppigel/status/842302481774321664" ] }, "uuid": "2db3aafb-b219-4b52-8dfe-ce41416ebeab", "value": "FortuneCookie" }, { "description": "Ransomware Unlock code is: adam or adamdude9", "meta": { "extensions": [ ".madebyadam" ], "payment-method": "Playstore Card (Gift)", "price": "25£ or 30$", "refs": [ "https://twitter.com/BleepinComputer/status/812135608374226944", "https://id-ransomware.blogspot.com/2016/12/roga-ransomware.html" ], "synonyms": [ "Roga" ] }, "related": [ { "dest-uuid": "cd1eb48e-070b-418e-8d83-4644a388f8ae", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "175ebcc0-d74f-49b2-9226-c660ca1fe2e8", "value": "Free-Freedom" }, { "description": "Ransomware Based on EDA2 and RemindMe", "meta": { "extensions": [ ".fs0ciety", ".dll" ], "links": [ "http://flock4cvoeqm4c62gyohvmncx6ck2e7ugvyqgyxqtrumklhd5ptwzpqd.onion/" ], "payment-method": "No Ransom - No Descrypter", "ransomnotes-filenames": [ "fs0ciety.html", "DECRYPT_YOUR_FILES.HTML" ], "refs": [ "https://www.bleepingcomputer.com/forums/t/628199/fs0ciety-locker-ransomware-help-support-fs0cietyhtml/", "http://www.bleepingcomputer.com/news/security/new-fsociety-ransomware-pays-homage-to-mr-robot/", "https://twitter.com/siri_urz/status/795969998707720193", "https://id-ransomware.blogspot.com/2016/08/fsociety-ransomware.html", "https://www.ransomlook.io/group/fsociety" ] }, "uuid": "d1e7c0d9-3c96-41b7-a4a2-7eaef64d7b0f", "value": "FSociety" }, { "description": "Ransomware", "meta": { "refs": [ "https://support.kaspersky.com/viruses/disinfection/8547" ] }, "uuid": "291997b1-72b6-43ea-9365-b4d55eddca71", "value": "Fury" }, { "description": "Ransomware Based on Hidden Tear", "meta": { "encryption": "AES-256", "extensions": [ ".Z81928819" ], "payment-method": "Bitcoin", "price": "2", "refs": [ "https://download.bleepingcomputer.com/demonslay335/GhostCryptDecrypter.zip", "http://www.bleepingcomputer.com/forums/t/614197/ghostcrypt-z81928819-help-support-topic-read-this-filetxt/", "https://id-ransomware.blogspot.com/2016/05/ghostcrypt-ransomware-aes-256-2-bitcoins.html" ] }, "uuid": "3b681f76-b0e4-4ba7-a113-5dd87d6ee53b", "value": "GhostCrypt" }, { "description": "Ransomware", "meta": { "payment-method": "Email", "refs": [ "https://twitter.com/ni_fi_70/status/796353782699425792" ] }, "uuid": "c6419971-47f8-4c80-a685-77292ff30fa7", "value": "Gingerbread" }, { "description": "Ransomware", "meta": { "encryption": "Blowfish", "extensions": [ ".purge" ], "payment-method": "Bitcoin", "price": "250$", "ransomnotes-filenames": [ "How to restore files.hta" ], "refs": [ "https://success.trendmicro.com/portal_kb_articledetail?solutionid=1114221", "http://www.bleepingcomputer.com/news/security/the-globe-ransomware-wants-to-purge-your-files/", "https://id-ransomware.blogspot.com/2017/07/purge-kind-ransomware.html" ], "synonyms": [ "Purge" ] }, "uuid": "b247b6e5-f51b-4bb5-8f5a-1628843abe99", "value": "Globe v1" }, { "description": "Ransomware Only encrypts DE or NL country. Variants, from old to latest: Zyklon Locker, WildFire locker, Hades Locker", "meta": { "encryption": "AES-256", "extensions": [ ".locked", ".locked, e.g., bill.!ID!8MMnF!ID!.locked" ], "payment-method": "Bitcoin", "price": "0.5(190 - 250 $)", "ransomnotes-filenames": [ "UNLOCK_FILES_INSTRUCTIONS.html", "UNLOCK_FILES_INSTRUCTIONS.txt" ], "refs": [ "http://www.bleepingcomputer.com/forums/t/611342/gnl-locker-support-and-help-topic-locked-and-unlock-files-instructionshtml/", "http://id-ransomware.blogspot.ru/2016/05/gnl-locker-ransomware-gnl-locker-ip.html" ] }, "related": [ { "dest-uuid": "78ef77ac-a570-4fb9-af80-d04c09dff9ab", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "721e9af0-8a60-4b9e-9137-c23e86d75722", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "390abe30-8b9e-439e-a6d3-2ee978f05fba", "value": "GNL Locker" }, { "description": "Ransomware", "meta": { "extensions": [ ".crypt", "!___[EMAILADDRESS]_.crypt" ], "payment-method": "Email", "refs": [ "https://decrypter.emsisoft.com/", "http://id-ransomware.blogspot.com/2016/05/gomasom-ransonware.html" ] }, "uuid": "70b85861-f419-4ad5-9aa6-254db292e043", "value": "Gomasom" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "price": "500 $", "ransomnotes-filenames": [ "Your files have been crypted.html" ], "refs": [ "http://blog.trendmicro.com/trendlabs-security-intelligence/angler-shift-ek-landscape-new-crytpo-ransomware-activity/" ] }, "uuid": "3229a370-7a09-4b93-ad89-9555a847b1dd", "value": "Goopic" }, { "description": "Ransomware OS X ransomware (PoC)", "meta": { "date": "mars 2021" }, "uuid": "ec461b8a-5390-4304-9d2a-a20c7ed6a9db", "value": "Gopher" }, { "description": "Ransomware Jigsaw Ransomware variant", "meta": { "extensions": [ ".versiegelt", ".encrypted", ".payrmts", ".locked", ".Locked" ], "payment-method": "Bitcoin", "price": "0.33 - 0.5", "refs": [ "https://twitter.com/demonslay335/status/806878803507101696", "http://id-ransomware.blogspot.com/2016/12/hackedlocker-ransomware.html" ] }, "uuid": "7f2df0cd-5962-4687-90a2-a49eab2b12bc", "value": "Hacked" }, { "description": "Ransomware", "meta": { "encryption": "3DES, AES-128, AES-192, AES-256, DES, RC2, RC4", "payment-method": "MoneyPak", "price": "0.5", "refs": [ "https://twitter.com/malwrhunterteam/status/847114064224497666", "http://id-ransomware.blogspot.com/2017/03/happydayzz-blackjocker-ransomware.html" ] }, "uuid": "e71c76f3-8274-4ec5-ac11-ac8b8286d069", "value": "HappyDayzz" }, { "description": "Ransomware", "meta": { "extensions": [ ".html" ], "payment-method": "MoneyPak", "price": "100 $", "refs": [ "https://decrypter.emsisoft.com/" ] }, "uuid": "5cadd11c-002a-4062-bafd-aadb7d740f59", "value": "Harasom" }, { "description": "Ransomware Uses https://diskcryptor.net for full disk encryption", "meta": { "encryption": "Custom (net shares), XTS-AES (disk)", "payment-method": "Email", "refs": [ "https://www.linkedin.com/pulse/mamba-new-full-disk-encryption-ransomware-family-member-marinho", "blog.trendmicro.com/trendlabs-security-intelligence/bksod-by-ransomware-hddcryptor-uses-commercial-tools-to-encrypt-network-shares-and-lock-hdds/", "http://id-ransomware.blogspot.com/2016/09/hddcryptor-ransomware-mbr.html" ], "synonyms": [ "Mamba" ] }, "related": [ { "dest-uuid": "df320366-7970-4af0-b1f4-9f9492dede53", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "95be4cd8-1d98-484f-a328-a5917a05e3c8", "value": "HDDCryptor" }, { "description": "Ransomware File marker: \"Heimdall---\"", "meta": { "encryption": "AES-128-CBC", "payment-method": "Bitcoin", "refs": [ "https://www.bleepingcomputer.com/news/security/heimdall-open-source-php-ransomware-targets-web-servers/", "https://id-ransomware.blogspot.com/2016/11/heimdall-ransomware.html" ] }, "uuid": "c6d6ddf0-2afa-4cca-8982-ba2a7c0441ae", "value": "Heimdall" }, { "description": "Ransomware", "meta": { "extensions": [ ".XXX" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-filenames": [ "help_dcfile.txt" ], "refs": [ "http://id-ransomware.blogspot.com/2016/09/helpdcfile-ransomware.html" ] }, "uuid": "2fdc6daa-6b6b-41b9-9a25-1030101478c3", "value": "Help_dcfile" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".herbst" ], "payment-method": "Bitcoin", "price": "0.1", "refs": [ "https://blog.fortinet.com/2016/06/03/cooking-up-autumn-herbst-ransomware", "https://id-ransomware.blogspot.com/2016/06/herbst-autumn-ransomware-aes-256-01.html" ] }, "related": [ { "dest-uuid": "ca8482d9-657b-49fe-8345-6ed962a9735a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "6489895b-0213-4564-9cfc-777df58d84c9", "value": "Herbst" }, { "description": "Ransomware Based on HiddenTear", "meta": { "encryption": "AES-256", "extensions": [ ".cry" ], "payment-method": "Bitcoin", "price": "0.77756467", "refs": [ "http://www.nyxbone.com/malware/hibuddy.html", "http://id-ransomware.blogspot.ru/2016/05/hi-buddy-ransomware-aes-256-0.html" ] }, "uuid": "a0d6563d-1e98-4e49-9151-39fbeb09ef76", "value": "Hi Buddy!" }, { "description": "Ransomware Deletes files", "meta": { "extensions": [ "removes extensions" ], "payment-method": "Vodafone card", "price": "25 €", "refs": [ "http://www.bleepingcomputer.com/news/security/development-version-of-the-hitler-ransomware-discovered/", "https://twitter.com/jiriatvirlab/status/825310545800740864", "http://id-ransomware.blogspot.com/2016/08/hitler-ransomware.html" ] }, "uuid": "8807752b-bd26-45a7-ba34-c8ddd8e5781d", "value": "Hitler" }, { "description": "Ransomware", "meta": { "encryption": "AES", "extensions": [ "(encrypted)" ], "payment-method": "Link (onion)", "refs": [ "http://www.bleepingcomputer.com/news/security/new-python-ransomware-called-holycrypt-discovered/", "https://id-ransomware.blogspot.com/2016/07/holycrypt-ransomware.html" ] }, "related": [ { "dest-uuid": "d3337bec-fd4e-11e8-a3ad-e799cc59c59c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "c71819a4-f6ce-4265-b0cd-24a98d84321c", "value": "HolyCrypt" }, { "description": "Ransomware Includes a feature to disable the victim's windows firewall Modified in-dev HiddenTear", "meta": { "payment-method": "Bitcoin", "price": "vary", "refs": [ "https://twitter.com/BleepinComputer/status/803288396814839808" ] }, "uuid": "728aecfc-9b99-478f-a0a3-8c0fb6896353", "value": "HTCryptor" }, { "description": "Ransomware CrypBoss Family", "meta": { "extensions": [ "hydracrypt_ID_[\\w]{8}" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "README_DECRYPT_HYRDA_ID_[ID number].txt" ], "refs": [ "https://decrypter.emsisoft.com/", "http://www.malware-traffic-analysis.net/2016/02/03/index2.html", "https://id-ransomware.blogspot.com/2016/06/hydracrypt-ransomware-aes-256-cbc-rsa.html" ] }, "uuid": "335c3ab6-8f2c-458c-92a3-2f3a09a6064c", "value": "HydraCrypt" }, { "description": "Ransomware", "meta": { "extensions": [ ".crime" ], "payment-method": "Website onion", "refs": [ "https://twitter.com/BleepinComputer/status/817085367144873985" ] }, "uuid": "68e90fa4-ea66-4159-b454-5f48fdae3d89", "value": "iLock" }, { "description": "Ransomware", "meta": { "extensions": [ ".crime" ], "payment-method": "Bitcoin", "price": "300 $" }, "uuid": "cb374ee8-76c0-4db8-9026-a57a51d9a0a1", "value": "iLockLight" }, { "description": "Ransomware CryptoTorLocker2015 variant", "meta": { "extensions": [ "<6 random characters>" ], "payment-method": "Bitcoin", "price": "100 $", "ransomnotes-filenames": [ "%Temp%\\.bmp" ], "refs": [ "http://download.bleepingcomputer.com/Nathan/StopPirates_Decrypter.exe" ] }, "uuid": "a66fbb1e-ba59-48c1-aac8-8678b4a98dc1", "value": "International Police Association" }, { "description": "Ransomware", "meta": { "extensions": [ ".Locked" ], "payment-method": "Bitcoin", "price": "0.15", "refs": [ "https://twitter.com/demonslay335/status/796134264744083460", "http://id-ransomware.blogspot.com/2016/11/iransom-ransomware.html" ] }, "uuid": "4514ecd4-850d-446f-82cb-0668d2c94ffa", "value": "iRansom" }, { "description": "Ransomware Prepends filenames", "meta": { "extensions": [ "!ENC" ], "payment-method": "Bitcoin", "price": "50 $", "ransomnotes-filenames": [ "Important_Read_Me.html" ], "refs": [ "https://twitter.com/JakubKroustek/status/757873976047697920" ] }, "uuid": "25a086aa-e25c-4190-a848-69d9f46fd8ab", "value": "JagerDecryptor" }, { "description": "Ransomware Windows, Linux. Campaign stopped. Actor claimed he deleted the master key.", "meta": { "encryption": "RC6 (files), RSA 2048 (RC6 key)", "payment-method": "Bitcoin", "price": "0.046627", "ransomnotes-filenames": [ "readme_liesmich_encryptor_raas.txt" ], "refs": [ "http://www.nyxbone.com/malware/RaaS.html", "http://blog.trendmicro.com/trendlabs-security-intelligence/the-rise-and-fall-of-encryptor-raas/" ], "synonyms": [ "Encryptor RaaS", "Sarento" ] }, "uuid": "50014fe7-5efd-4639-82ef-30d36f4d2918", "value": "Jeiphoos" }, { "description": "Ransomware Same codebase as DNRansomware Lock screen password is M3VZ>5BwGGVH", "meta": { "extensions": [ ".killedXXX" ], "payment-method": "PaySafeCard", "price": "0.1", "refs": [ "https://download.bleepingcomputer.com/demonslay335/DoNotOpenDecrypter.zip", "https://twitter.com/BleepinComputer/status/822509105487245317" ] }, "uuid": "fedd7285-d4bd-4411-985e-087954cee96d", "value": "Jhon Woddy" }, { "description": "Ransomware Has a GUI", "meta": { "encryption": "AES-256", "extensions": [ ".btc", ".kkk", ".fun", ".gws", ".porno", ".payransom", ".payms", ".paymst", ".AFD", ".paybtcs", ".epic", ".xyz", ".encrypted", ".hush", ".paytounlock", ".uk-dealer@sigaint.org", ".gefickt", ".nemo-hacks.at.sigaint.org", ".LolSec" ], "payment-method": "PaySafeCard", "price": "0.4 (150 $)", "refs": [ "http://www.bleepingcomputer.com/news/security/jigsaw-ransomware-decrypted-will-delete-your-files-until-you-pay-the-ransom/", "https://www.helpnetsecurity.com/2016/04/20/jigsaw-crypto-ransomware/", "https://twitter.com/demonslay335/status/795819556166139905", "https://id-ransomware.blogspot.com/2016/04/jigsaw-ransomware.html" ], "synonyms": [ "CryptoHitMan", "Jigsaw Original" ] }, "related": [ { "dest-uuid": "910c3fd2-56e5-4f1d-8df0-2aa0b293b7d9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "1e3384ae-4b48-4c96-b7c2-bc1cc1eda203", "value": "Jigsaw" }, { "description": "Ransomware Based on HiddenTear, but uses TripleDES, decrypter is PoC", "meta": { "encryption": "TripleDES", "extensions": [ ".locked", ".css" ], "payment-method": "PaySafeCard", "price": "300 €", "ransomnotes-filenames": [ "Comment débloquer mes fichiers.txt", "Readme.txt" ], "refs": [ "http://www.nyxbone.com/malware/jobcrypter.html", "http://forum.malekal.com/jobcrypter-geniesanstravaille-extension-locked-crypto-ransomware-t54381.html", "https://twitter.com/malwrhunterteam/status/828914052973858816", "http://id-ransomware.blogspot.com/2016/05/jobcrypter-ransomware.html" ], "synonyms": [ "JobCrypter" ] }, "uuid": "7c9a273b-1534-4a13-b201-b7a782b6c32a", "value": "Job Crypter" }, { "description": "Ransomware", "meta": { "payment-method": "Email", "refs": [ "http://id-ransomware.blogspot.com/2016/04/johnycryptor-ransomware.html" ] }, "uuid": "5af5be3e-549f-4485-8c2e-1459d4e5c7d7", "value": "JohnyCryptor" }, { "description": "Ransomware", "meta": { "payment-method": "rubles", "price": "6 000", "ransomnotes-filenames": [ "How Decrypt Files.txt" ], "refs": [ "https://safezone.cc/resources/kawaii-decryptor.195/", "http://id-ransomware.blogspot.com/2016/09/kawaiilocker-ransomware.html" ] }, "uuid": "b6d0ea4d-4e55-4b42-9d60-485d605d6c49", "value": "KawaiiLocker" }, { "description": "Ransomware OS X Ransomware", "meta": { "encryption": "AES", "extensions": [ ".encrypted" ], "payment-method": "Bitcoin", "price": "1", "refs": [ "http://news.drweb.com/show/?i=9877&lng=en&c=5", "http://www.welivesecurity.com/2016/03/07/new-mac-ransomware-appears-keranger-spread-via-transmission-app/", "https://id-ransomware.blogspot.com/2016/03/keranger-ransomware.html" ] }, "related": [ { "dest-uuid": "01643bc9-bd61-42e8-b9f1-5fbf83dcd786", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "63292b32-9867-4fb2-9e59-d4983d4fd5d1", "value": "KeRanger" }, { "description": "Ransomware", "meta": { "extensions": [ "keybtc@inbox_com" ], "payment-method": "Email", "ransomnotes-filenames": [ "DECRYPT_YOUR_FILES.txt", "READ.txt", "readme.txt" ], "refs": [ "https://decrypter.emsisoft.com/" ] }, "uuid": "3964e617-dde5-4c95-b4a0-e7c19c6e7d7f", "value": "KeyBTC" }, { "description": "Ransomware via remote attacker. tuyuljahat@hotmail.com contact address", "meta": { "payment-method": "Bitcoin", "price": "1.5 (500 $)", "ransomnotes-filenames": [ "how_decrypt.gif", "how_decrypt.html" ], "refs": [ "http://www.bleepingcomputer.com/forums/t/559463/keyholder-ransomware-support-and-help-topic-how-decryptgifhow-decrypthtml", "https://id-ransomware.blogspot.com/2016/06/keyholder-ransomware-xor-cfb-cipher.html" ] }, "uuid": "66eda328-9408-4e98-ad27-572fd6b2acd8", "value": "KEYHolder" }, { "description": "Ransomware Possibly Portuguese dev", "meta": { "extensions": [ ".rip" ], "payment-method": "Bitcoin", "refs": [ "https://twitter.com/malwrhunterteam/status/782232299840634881", "http://id-ransomware.blogspot.com/2016/10/killerlocker-ransomware.html" ] }, "uuid": "ea8e7350-f243-4ef7-bc31-4648df8a4d96", "value": "KillerLocker" }, { "description": "Ransomware websites only", "meta": { "encryption": "AES", "extensions": [ ".kimcilware", ".locked" ], "payment-method": "Dollars", "price": "140 - 415", "refs": [ "https://blog.fortinet.com/post/kimcilware-ransomware-how-to-decrypt-encrypted-files-and-who-is-behind-it", "http://www.bleepingcomputer.com/news/security/the-kimcilware-ransomware-targets-web-sites-running-the-magento-platform/", "http://id-ransomware.blogspot.com/2016/04/kimcilware-ransomware.html" ] }, "uuid": "950e2514-8a7e-4fdb-a3ad-5679f6342e5d", "value": "KimcilWare" }, { "description": "Ransomware Based on HiddenTear", "meta": { "encryption": "AES-256", "extensions": [ ".암호화됨" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-filenames": [ "ReadMe.txt" ], "refs": [ "http://www.nyxbone.com/malware/koreanRansom.html", "http://id-ransomware.blogspot.com/2016/08/korean-ransomware.html" ] }, "uuid": "4febffe0-3837-41d7-b95f-e26d126275e4", "value": "Korean" }, { "description": "Ransomware Potential Kit selectedkozy.jozy@yahoo.com kozy.jozy@yahoo.com unlock92@india.com", "meta": { "encryption": "RSA-2048", "extensions": [ ".31392E30362E32303136_[ID-KEY]_LSBJ1", ".([0-9A-Z]{20})_([0-9]{2})_([A-Z0-9]{4,5})" ], "payment-method": "Email", "ransomnotes-filenames": [ "w.jpg" ], "refs": [ "http://www.nyxbone.com/malware/KozyJozy.html", "http://www.bleepingcomputer.com/forums/t/617802/kozyjozy-ransomware-help-support-wjpg-31392e30362e32303136-num-lsbj1/", "https://id-ransomware.blogspot.com/2016/06/kozy.html" ], "synonyms": [ "QC" ] }, "uuid": "47b5d261-11bd-4c7b-91f9-e5651578026a", "value": "Kozy.Jozy" }, { "description": "Ransomware kratosdimetrici@gmail.com", "meta": { "extensions": [ ".kratos" ], "payment-method": "Bitcoin", "price": "0.03", "ransomnotes-filenames": [ "README_ALL.html" ], "refs": [ "https://twitter.com/demonslay335/status/746090483722686465", "https://id-ransomware.blogspot.com/2016/06/kratoscrypt-ransomware-aes-256-0.html" ] }, "uuid": "cc819741-830b-4859-bb7c-ccedf3356acd", "value": "KratosCrypt" }, { "description": "Ransomware Based on HiddenTear", "meta": { "encryption": "AES-256", "payment-method": "ransom", "ransomnotes-filenames": [ "KryptoLocker_README.txt" ], "refs": [ "https://id-ransomware.blogspot.com/2016/07/kryptolocker-ransomware-aes-256.html" ] }, "uuid": "e68d4f37-704a-4f8e-9718-b12039fbe424", "value": "KryptoLocker" }, { "description": "Ransomware Variant of open-source MyLittleRansomware", "meta": { "payment-method": "Bitcoin", "price": "0.5", "ransomnotes": [ "@__help__@" ], "refs": [ "https://twitter.com/struppigel/status/847689644854595584", "http://id-ransomware.blogspot.com/2017/03/lanran-ransomware.html" ] }, "uuid": "9e152871-fb16-475d-bf3b-f3b870d0237a", "value": "LanRan" }, { "description": "Ransomware Encrypts first 0x2000 and last 0x2000 bytes. Via remote attacker", "meta": { "extensions": [ ".LeChiffre" ], "payment-method": "Email", "ransomnotes-filenames": [ "How to decrypt LeChiffre files.html" ], "refs": [ "https://decrypter.emsisoft.com/lechiffre", "https://blog.malwarebytes.org/threat-analysis/2016/01/lechiffre-a-manually-run-ransomware/", "http://id-ransomware.blogspot.com/2016/05/lechiffre-ransomware.html" ] }, "uuid": "ea1ba874-07e6-4a6d-82f0-e4ce4210e34e", "value": "LeChiffre" }, { "description": "Ransomware Variant of Kirk", "meta": { "extensions": [ ".Licked" ], "payment-method": "Monero", "price": "50 - 500", "ransomnotes-filenames": [ "RANSOM_NOTE.txt" ], "refs": [ "https://twitter.com/JakubKroustek/status/842404866614038529", "https://www.2-spyware.com/remove-lick-ransomware-virus.html" ] }, "uuid": "f2e76070-0cea-4c9c-8d6b-1d847e777575", "value": "Lick" }, { "description": "Ransomware Linux Ransomware", "meta": { "payment-method": "Bitcoin", "price": "1 (450 $)", "refs": [ "https://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-predictable-encryption-key/" ], "synonyms": [ "Linux.Encoder.{0,3}" ] }, "uuid": "b4992483-a693-4e73-b39e-0f45c9f645b5", "value": "Linux.Encoder" }, { "description": "Ransomware Based on HiddenTear", "meta": { "payment-method": "Bitcoin", "price": "0.5", "refs": [ "https://twitter.com/malwrhunterteam/status/845183290873044994", "http://id-ransomware.blogspot.com/2017/03/lk-encryption-ransomware.html" ] }, "uuid": "af52badb-3211-42b0-a1ac-e4d35d5829d7", "value": "LK Encryption" }, { "description": "Ransomware Targeting Spanish speaking victims", "meta": { "encryption": "AES-256", "extensions": [ ".ENCRYPTED_BY_LLTP", ".ENCRYPTED_BY_LLTPp" ], "payment-method": "Bitcoin", "price": "0.2 (200 $)", "ransomnotes-filenames": [ "LEAME.txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/new-lltp-ransomware-appears-to-be-a-rewritten-venus-locker/", "http://id-ransomware.blogspot.com/2017/03/lltp-ransomware.html" ] }, "uuid": "0cec6928-80c7-4085-ba47-cdc52177dfd3", "value": "LLTP Locker" }, { "description": "Ransomware has GUI", "meta": { "payment-method": "Bitcoin", "price": "0.1", "refs": [ "http://www.bleepingcomputer.com/forums/t/577246/locker-ransomware-support-and-help-topic/page-32#entry3721545", "https://id-ransomware.blogspot.com/2016/04/locker-ransomware-2015.html" ], "synonyms": [ "LockeR" ] }, "uuid": "abc7883c-244a-44ac-9c86-559dafa4eb63", "value": "Locker" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".locklock" ], "payment-method": "Email", "ransomnotes-filenames": [ "READ_ME.TXT" ], "refs": [ "https://www.bleepingcomputer.com/forums/t/626750/locklock-ransomware-locklock-help-support/", "https://id-ransomware.blogspot.com/2016/09/locklock-ransomware.html" ] }, "uuid": "7850bf92-394b-443b-8830-12f9ddbb50dc", "value": "LockLock" }, { "description": "Ransomware Affiliations with Dridex and Necurs botnets", "meta": { "encryption": "AES-128", "extensions": [ ".locky", ".zepto", ".odin", ".shit", ".thor", ".aesir", ".zzzzz", ".osiris", "([A-F0-9]{32}).locky", "([A-F0-9]{32}).zepto", "([A-F0-9]{32}).odin", "([A-F0-9]{32}).shit", "([A-F0-9]{32}).thor", "([A-F0-9]{32}).aesir", "([A-F0-9]{32}).zzzzz", "([A-F0-9]{32}).osiris", ".lukitus" ], "payment-method": "Bitcoin", "price": "3 - 5 - 7", "ransomnotes": [ "DesktopOSIRIS.(bmp|htm)", "lukitus.bmp." ], "ransomnotes-filenames": [ "_Locky_recover_instructions.txt", "_Locky_recover_instructions.bmp", "_HELP_instructions.txt", "_HELP_instructions.bmp", "_HOWDO_text.html", "_WHAT_is.html", "_INSTRUCTION.html", "OSIRIS-[0-9]{4}.htm", "lukitus.htm" ], "refs": [ "http://www.bleepingcomputer.com/news/security/new-locky-version-adds-the-zepto-extension-to-encrypted-files/", "http://blog.trendmicro.com/trendlabs-security-intelligence/new-locky-ransomware-spotted-in-the-brazilian-underground-market-uses-windows-script-files/", "https://nakedsecurity.sophos.com/2016/10/06/odin-ransomware-takes-over-from-zepto-and-locky/", "https://www.bleepingcomputer.com/news/security/locky-ransomware-switches-to-egyptian-mythology-with-the-osiris-extension/", "https://id-ransomware.blogspot.com/2016/02/locky.html" ], "synonyms": [ "Locky-Odin", "Locky-Osiris", "Locky-Osiris 2016", "Locky-Osiris 2017" ] }, "related": [ { "dest-uuid": "24c9bb9f-1f9a-4e01-95d8-86c51733e11c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "8d51a22e-3485-4480-af96-8ed0305a7aa6", "value": "Locky" }, { "description": "Ransomware", "meta": { "extensions": [ ".crime" ], "payment-method": "Dollars", "price": "5", "refs": [ "https://id-ransomware.blogspot.com/2016/06/lortok-ransomware-aes-256-5.html" ] }, "uuid": "bc23872a-7cd3-4a66-9d25-6b4e6f90cc4e", "value": "Lortok" }, { "description": "Ransomware Prepends filenames", "meta": { "extensions": [ "oor." ], "payment-method": "Bitcoin", "price": "4", "refs": [ "http://id-ransomware.blogspot.com/2016/04/lowlevel04-ransomware.html" ] }, "uuid": "d4fb0463-6cd1-45ac-a7d2-6eea8be39590", "value": "LowLevel04" }, { "description": "Ransomware Does not encrypt Unlock code=suckmydicknigga", "meta": { "payment-method": "Bitcoin", "price": "0.3", "refs": [ "https://twitter.com/jiriatvirlab/status/808015275367002113", "http://id-ransomware.blogspot.com/2016/12/m4n1f3sto-ransomware.html" ] }, "uuid": "f5d19af8-1c85-408b-818e-db50208d62b1", "value": "M4N1F3STO" }, { "description": "Ransomware OS X ransomware (PoC)", "meta": { "payment-method": "Bitcoin", "refs": [ "https://www.youtube.com/watch?v=9nJv_PN2m1Y" ] }, "uuid": "f9214319-6ad4-4c4e-bc6d-fb710f61da48", "value": "Mabouia" }, { "description": "Ransomware Based on HiddenTear", "meta": { "payment-method": "Bitcoin", "price": "0.5", "refs": [ "http://id-ransomware.blogspot.com/2017/03/macandchess-ransomware.html" ] }, "uuid": "fae8bf6e-47d1-4449-a1c6-761a4970fc38", "value": "MacAndChess" }, { "description": "Ransomware Based on EDA2", "meta": { "encryption": "AES-256", "extensions": [ ".magic" ], "payment-method": "Bitcoin", "price": "1 - 2", "ransomnotes-filenames": [ "DECRYPT_ReadMe1.TXT", "DECRYPT_ReadMe.TXT" ], "refs": [ "http://id-ransomware.blogspot.com/2016/04/magic-ransomware.html" ] }, "uuid": "31fa83fc-8247-4347-940a-e463acd66bac", "value": "Magic" }, { "description": "Ransomware", "meta": { "encryption": "AES-256 + RSA-2048", "extensions": [ "[a-z]{4,6}" ], "payment-method": "Bitcoin", "price": "1.4 - 3.9", "ransomnotes-filenames": [ "_DECRYPT_INFO_[extension pattern].html" ], "refs": [ "https://blog.malwarebytes.org/threat-analysis/2016/03/maktub-locker-beautiful-and-dangerous/", "http://id-ransomware.blogspot.com/2016/04/maktub-locker-ransomware.html" ] }, "uuid": "ef6ceb04-243e-4783-b476-8e8e9f06e8a7", "value": "MaktubLocker" }, { "description": "Ransomware", "meta": { "extensions": [ ".a19", ".ap19" ], "payment-method": "Bitcoin", "price": "0.7 - 1.1", "ransomnotes-filenames": [ "!!! Readme For Decrypt !!!.txt", "ReadMeFilesDecrypt!!!.txt" ], "refs": [ "https://securelist.ru/blog/issledovaniya/29376/polyglot-the-fake-ctb-locker/", "https://www.proofpoint.com/us/threat-insight/post/MarsJoke-Ransomware-Mimics-CTB-Locker", "http://id-ransomware.blogspot.com/2016/09/jokefrommars-ransomware.html" ] }, "uuid": "933bd53f-5ccf-4262-a70c-c01a6f05af3e", "value": "MarsJoke" }, { "description": "Ransomware Targeting French victims", "meta": { "payment-method": "Bitcoin", "price": "0.1", "refs": [ "https://twitter.com/siri_urz/status/840913419024945152" ] }, "uuid": "ce5a82ef-d2a3-405c-ac08-3dca71057eb5", "value": "Meister" }, { "description": "Ransomware", "meta": { "payment-method": "Email", "ransomnotes-filenames": [ "where_are_your_files.txt", "readme_your_files_have_been_encrypted.txt" ], "refs": [ "https://twitter.com/malwrhunterteam/status/844614889620561924", "http://id-ransomware.blogspot.com/2017/03/meteoritan-ransomware.html" ] }, "uuid": "34f292d9-cb68-4bcf-a3db-a717362aca77", "value": "Meteoritan" }, { "description": "Ransomware Prepends files Demands 48.48 BTC", "meta": { "encryption": "AES", "extensions": [ "Lock." ], "payment-method": "Bitcoin", "price": "48.48", "refs": [ "http://www.bleepingcomputer.com/forums/t/618457/microcop-ransomware-help-support-lock-mircop/", "https://www.avast.com/ransomware-decryption-tools#!", "http://blog.trendmicro.com/trendlabs-security-intelligence/instruction-less-ransomware-mircop-channels-guy-fawkes/", "http://www.nyxbone.com/malware/Mircop.html", "https://id-ransomware.blogspot.com/2016/06/mircop-ransomware-4848.html" ], "synonyms": [ "Crypt888", "MicroCop" ] }, "uuid": "7dd326a5-1168-4309-98b1-f2146d9cf8c7", "value": "MIRCOP" }, { "description": "Ransomware Based on HiddenTear", "meta": { "encryption": "AES-256", "extensions": [ ".fucked", ".fuck" ], "payment-method": "Bitcoin - Email", "ransomnotes-filenames": [ "READ_IT.txt" ], "refs": [ "http://id-ransomware.blogspot.com/2016/05/mireware-ransomware.html" ] }, "uuid": "9f01ded7-99f6-4863-b3a3-9d32aabf96c3", "value": "MireWare" }, { "description": "Ransomware Packaged with Petya PDFBewerbungsmappe.exe", "meta": { "extensions": [ ".([a-zA-Z0-9]{4})" ], "payment-method": "Bitcoin", "price": "1.9338", "ransomnotes": [ "YOUR_FILES_ARE_ENCRYPTED.TXT " ], "ransomnotes-filenames": [ "YOUR_FILES_ARE_ENCRYPTED.HTML" ], "refs": [ "http://www.bleepingcomputer.com/news/security/petya-is-back-and-with-a-friend-named-mischa-ransomware/", "https://id-ransomware.blogspot.com/2016/05/petya-mischa-ransomware.html" ], "synonyms": [ "\"Petya's little brother\"", "Misha", "Petya+Mischa", "Petya-2" ] }, "uuid": "a029df89-2bb1-409d-878b-a67572217a65", "value": "Mischa" }, { "description": "Ransomware Based on EDA2", "meta": { "encryption": "AES-256", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "1.011 (400 $)", "ransomnotes-filenames": [ "READ_IT.txt" ], "refs": [ "https://www.proofpoint.com/us/threat-insight/post/ransomware-explosion-continues-cryptflle2-brlock-mm-locker-discovered", "https://id-ransomware.blogspot.com/2016/06/mm-locker-ransomware-aes-2256-1.html" ], "synonyms": [ "Booyah" ] }, "related": [ { "dest-uuid": "eee75995-321f-477f-8b57-eee4eedf4ba3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "b95aa3fb-9f32-450e-8058-67d94f196913", "value": "MM Locker" }, { "description": "Ransomware", "meta": { "extensions": [ ".KEYZ", ".KEYH0LES" ], "payment-method": "Bitcoin", "price": "4", "ransomnotes": [ "IMPORTANT.README" ], "ransomnotes-filenames": [ "4-14-2016-INFECTION.TXT" ], "refs": [ "http://nyxbone.com/malware/Mobef.html", "http://researchcenter.paloaltonetworks.com/2016/07/unit42-cryptobit-another-ransomware-family-gets-an-update/", "http://nyxbone.com/images/articulos/malware/mobef/0.png", "http://id-ransomware.blogspot.com/2016/05/mobef-yakes-ransomware-4-bitcoins-2000.html" ], "synonyms": [ "Yakes", "CryptoBit" ] }, "related": [ { "dest-uuid": "1903ed75-05f7-4019-b0b7-7a8f23f22194", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8fa6b51a-a48d-48dc-87ec-cf0d30ad66e8", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "681f212a-af1b-4e40-a718-81b0dc46dc52", "value": "Mobef" }, { "description": "Ransomware Use the DarkLocker 5 porn screenlocker - Jigsaw variant", "meta": { "payment-method": "Bitcoin", "price": "0.15 - 0.2", "refs": [ "https://twitter.com/malwrhunterteam/status/844826339186135040" ] }, "uuid": "2702fb96-8118-4519-bd75-23eed40f25e9", "value": "Monument" }, { "description": "Ransomware Russian Koolova Variant", "meta": { "extensions": [ ".кибер разветвитель" ], "payment-method": "Bitcoin", "price": "0.5", "refs": [ "https://twitter.com/JakubKroustek/status/815961663644008448", "https://www.youtube.com/watch?v=dAVMgX8Zti4&feature=youtu.be&list=UU_TMZYaLIgjsdJMwurHAi4Q" ] }, "uuid": "8ec55495-fb31-49c7-a720-40250b5e085f", "value": "N-Splitter" }, { "description": "Ransomware Filemaker: \"333333333333\"", "meta": { "payment-method": "Bitcoin", "price": "1.5", "ransomnotes-filenames": [ "decrypt explanations.html" ], "refs": [ "https://twitter.com/demonslay335/status/790608484303712256", "https://twitter.com/demonslay335/status/831891344897482754", "http://id-ransomware.blogspot.com/2016/09/n1n1n1-ransomware.html" ], "synonyms": [ "N1N1N1" ] }, "uuid": "a439b37b-e123-4b1d-9400-94aca70b223a", "value": "n1n1n1" }, { "description": "Ransomware no extension change, has a GUI", "meta": { "encryption": "AES-256 + RSA", "payment-method": "Bitcoin", "price": "0.1 (43 $)", "ransomnotes-filenames": [ "ATTENTION.RTF" ], "refs": [ "http://github.com/Cyberclues/nanolocker-decryptor", "https://id-ransomware.blogspot.com/2016/06/nanolocker-ransomware-aes-256-rsa-01.html" ] }, "related": [ { "dest-uuid": "00e1373c-fddf-4b06-9770-e980cc0ada6b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "03a91686-c607-49a8-a4e2-2054833c0013", "value": "NanoLocker" }, { "description": "Ransomware 7zip (a0.exe) variant cannot be decrypted Encrypts the first 2048 Bytes", "meta": { "encryption": "XOR(255) + 7zip", "extensions": [ ".crypted" ], "payment-method": "Bitcoin", "price": "0.39983 - 4", "ransomnotes-filenames": [ "Decrypted.txt" ], "refs": [ "https://decrypter.emsisoft.com/nemucod", "https://github.com/Antelox/NemucodFR", "http://www.bleepingcomputer.com/news/security/decryptor-released-for-the-nemucod-trojans-crypted-ransomware/", "https://blog.cisecurity.org/malware-analysis-report-nemucod-ransomware/", "http://id-ransomware.blogspot.com/2016/04/nemucod-ransomware.html" ], "synonyms": [ "Nemucod-7z", "Nemucod-AES" ] }, "uuid": "f1ee9ae8-b798-4e6f-8f98-874395d0fa18", "value": "Nemucod" }, { "description": "Ransomware", "meta": { "extensions": [ "AES-256" ], "payment-method": "Bitcoin", "price": "0.18 (100 $)", "refs": [ "http://blog.trendmicro.com/trendlabs-security-intelligence/netflix-scam-delivers-ransomware/", "https://id-ransomware.blogspot.com/2017/01/netflix-ransomware.html" ], "synonyms": [ "RANSOM_NETIX.A" ] }, "uuid": "5d3ec71e-9e0f-498a-aa33-0433799e80b4", "value": "Netix" }, { "description": "Ransomware Does not encrypt the files / Files are destroyed", "meta": { "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "!_RECOVERY_HELP_!.txt", "HELP_ME_PLEASE.txt" ], "refs": [ "https://twitter.com/demonslay335/status/839221457360195589", "http://id-ransomware.blogspot.com/2017/03/nhtnwcuf-ransomware.html" ] }, "uuid": "1d8e8ca3-da2a-494c-9db3-5b1b6277c363", "value": "Nhtnwcuf" }, { "description": "Ransomware", "meta": { "encryption": "mix of RSA and AES-256", "extensions": [ ".maktub", ".__AiraCropEncrypted!" ], "payment-method": "Bitcoin", "price": "0.5 - 1.5", "ransomnotes-filenames": [ "Recupere seus arquivos. Leia-me!.txt" ], "refs": [ "https://decrypter.emsisoft.com/nmoreira", "https://twitter.com/fwosar/status/803682662481174528", "id-ransomware.blogspot.com/2016/11/nmoreira-ransomware.html" ], "synonyms": [ "XRatTeam", "XPan" ] }, "uuid": "51f00a39-f4b9-4ed2-ba0d-258c6bf3f71a", "value": "NMoreira" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "price": "250 NZD (299 $)", "refs": [ "https://twitter.com/JakubKroustek/status/757267550346641408", "https://www.bleepingcomputer.com/news/security/noobcrypt-ransomware-dev-shows-noobness-by-using-same-password-for-everyone/", "https://id-ransomware.blogspot.com/2016/07/noobcrypt-ransomare-250-nzd.html" ] }, "uuid": "aeb76911-ed45-4bf2-9a60-e023386e02a4", "value": "NoobCrypt" }, { "description": "Ransomware", "meta": { "encryption": "AES", "extensions": [ ".nuclear55" ], "payment-method": "Email", "ransomnotes-filenames": [ "!!_RECOVERY_instructions_!!.html", "!!_RECOVERY_instructions_!!.txt" ], "refs": [ "http://id-ransomware.blogspot.com/2016/10/nuke-ransomware.html" ] }, "uuid": "e0bcb7d2-6032-43a0-b490-c07430d8a598", "value": "Nuke" }, { "description": "Ransomware", "meta": { "extensions": [ "_nullbyte" ], "payment-method": "Bitcoin", "price": "0.1", "refs": [ "https://download.bleepingcomputer.com/demonslay335/NullByteDecrypter.zip", "https://www.bleepingcomputer.com/news/security/the-nullbyte-ransomware-pretends-to-be-the-necrobot-pokemon-go-application/", "http://id-ransomware.blogspot.com/2016/08/nullbyte-ransomware.html" ] }, "uuid": "460b700b-5d03-43f9-99e7-916ff180a036", "value": "Nullbyte" }, { "description": "Ransomware", "meta": { "encryption": "XOR", "extensions": [ ".odcodc", "C-email-abennaki@india.com-(NOMBRE_ARCHIVO.ext).odcodc" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "HOW_TO_RESTORE_FILES.txt" ], "refs": [ "http://download.bleepingcomputer.com/BloodDolly/ODCODCDecoder.zip", "http://www.nyxbone.com/malware/odcodc.html", "https://twitter.com/PolarToffee/status/813762510302183424", "http://www.nyxbone.com/images/articulos/malware/odcodc/1c.png", "http://id-ransomware.blogspot.com/2016/05/odcodc-ransomware-rsa-2048.html" ] }, "uuid": "f90724e4-c148-4479-ae1a-109498b4688f", "value": "ODCODC" }, { "description": "Ransomware email addresses overlap with .777 addresses", "meta": { "extensions": [ ".cbf", "email-[params].cbf" ], "payment-method": "Email", "ransomnotes-filenames": [ "desk.bmp", "desk.jpg" ], "refs": [ "https://support.kaspersky.com/viruses/disinfection/8547", "http://bartblaze.blogspot.com.co/2016/02/vipasana-ransomware-new-ransom-on-block.html" ], "synonyms": [ "Vipasana", "Cryakl" ] }, "related": [ { "dest-uuid": "4f3e494e-0e37-4894-94b2-741a8100f07a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "32fa6c53-b4fc-47f8-894c-1ea74180e02f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "3c51fc0e-42d8-4ff0-b1bd-5c8c20271a39", "value": "Offline ransomware" }, { "description": "Ransomware. Infection: drive-by-download; Platform: Windows; Extorsion by Prepaid Voucher", "meta": { "Encryption": "RSA", "extensions": [ ".LOL!", ".OMG!" ], "payment-method": "Bitcoin", "price": "100 $", "ransomnotes-filenames": [ "how to get data.txt" ], "refs": [ "https://arxiv.org/pdf/2102.06249.pdf" ], "synonyms": [ "GPCode" ] }, "related": [ { "dest-uuid": "127c3d76-6323-4363-93e0-cd06ade0dd52", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "7914f9c9-3257-464c-b918-3754c4d018af", "value": "OMG! Ransomware" }, { "description": "Ransomware Is a file infector (virus)", "meta": { "extensions": [ ".EXE" ], "payment-method": "Bitcoin", "price": "250 $", "refs": [ "http://news.thewindowsclub.com/operation-global-iii-ransomware-decryption-tool-released-70341/" ] }, "uuid": "e5800883-c663-4eb0-b05e-6034df5bc6e0", "value": "Operation Global III" }, { "description": "Ransomware", "meta": { "extensions": [ "dummy_file.encrypted", "dummy_file.encrypted.[extension]" ], "payment-method": "Bitcoin", "price": "0.29499335", "ransomnotes-filenames": [ "log.txt" ], "refs": [ "https://twitter.com/JakubKroustek/status/842342996775448576", "https://id-ransomware.blogspot.com/2016/10/cryptowire-ransomware.html" ], "synonyms": [ "CryptoWire" ] }, "related": [ { "dest-uuid": "bc0c1e48-102c-4e6b-9b86-c442c4798159", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "4bb11db7-17a0-4536-b817-419ae6299004", "value": "Owl" }, { "description": "Ransomware has a live support chat", "meta": { "extensions": [ ".padcrypt" ], "payment-method": "Bitcoin", "price": "0.8", "ransomnotes-filenames": [ "IMPORTANT READ ME.txt", "File Decrypt Help.html" ], "refs": [ "http://www.bleepingcomputer.com/news/security/padcrypt-the-first-ransomware-with-live-support-chat-and-an-uninstaller/", "https://twitter.com/malwrhunterteam/status/798141978810732544", "http://id-ransomware.blogspot.com/2016/04/padcrypt-ransomware.html" ] }, "related": [ { "dest-uuid": "c21335f5-b145-4029-b1bc-161362c7ce80", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "57c5df76-e72f-41b9-be29-89395f83a77c", "value": "PadCrypt" }, { "description": "Ransomware Unlock code is: ajVr/G\\ RJz0R", "meta": { "payment-method": "no ransom", "refs": [ "https://twitter.com/BleepinComputer/status/811635075158839296" ] }, "uuid": "8f41c9ce-9bd4-4bbd-96d7-c965d1621be7", "value": "Padlock Screenlocker" }, { "description": "Ransomware Targeting macOS users", "meta": { "extensions": [ ".crypt" ], "payment-method": "Bitcoin", "price": "0.25", "ransomnotes-filenames": [ "README!.txt" ], "refs": [ "https://blog.malwarebytes.com/cybercrime/2017/02/decrypting-after-a-findzip-ransomware-infection/", "https://www.bleepingcomputer.com/news/security/new-macos-patcher-ransomware-locks-data-for-good-no-way-to-recover-your-files/" ] }, "related": [ { "dest-uuid": "091c9923-5939-4bde-9db5-56abfb51f1a2", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "bad1057c-4f92-4747-a0ec-31bcc062dab8", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "e211ea8d-5042-48ae-86c6-15186d1f8dba", "value": "Patcher" }, { "description": "Ransomware encrypts disk partitions PDFBewerbungsmappe.exe", "meta": { "encryption": "Modified Salsa20", "payment-method": "Bitcoin - Website (onion)", "ransomnotes-filenames": [ "YOUR_FILES_ARE_ENCRYPTED.TXT" ], "refs": [ "http://www.thewindowsclub.com/petya-ransomware-decrypt-tool-password-generator", "https://www.youtube.com/watch?v=mSqxFjZq_z4", "https://blog.malwarebytes.org/threat-analysis/2016/04/petya-ransomware/", "https://www.bleepingcomputer.com/news/security/petya-ransomware-returns-with-goldeneye-version-continuing-james-bond-theme/" ], "synonyms": [ "Goldeneye" ] }, "related": [ { "dest-uuid": "34c9dbaa-97ac-4e1e-9eca-b7c492d67efc", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ac7affb8-971d-4c05-84f0-172b61d007d7", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "7c5a1e93-7ab2-4b08-ada9-e82c4feaed0a", "value": "Petya" }, { "description": "Ransomware Coded by \"The_Rainmaker\"", "meta": { "encryption": "AES-256", "extensions": [ ".locked", ".locked" ], "payment-method": "Bitcoin", "price": "0.3", "refs": [ "https://decrypter.emsisoft.com/philadelphia", "www.bleepingcomputer.com/news/security/the-philadelphia-ransomware-offers-a-mercy-button-for-compassionate-criminals/", "http://id-ransomware.blogspot.ru/2016/09/philadelphia-ransomware.html" ] }, "uuid": "6fd25982-9cf8-4379-a126-433c91aaadf2", "value": "Philadelphia" }, { "description": "Ransomware", "meta": { "extensions": [ ".id-[victim_id]-maestro@pizzacrypts.info" ], "payment-method": "Email", "refs": [ "http://download.bleepingcomputer.com/BloodDolly/JuicyLemonDecoder.zip", "https://id-ransomware.blogspot.com/2016/07/pizzacrypts-ransomware-1.html" ] }, "uuid": "2482122b-1df6-488e-8867-215b165a4f66", "value": "PizzaCrypts" }, { "description": "Ransomware Based on Hidden Tear", "meta": { "encryption": "AES-256", "extensions": [ ".locked" ], "payment-method": "Bitcoin - Email", "refs": [ "http://www.nyxbone.com/malware/pokemonGO.html", "http://www.bleepingcomputer.com/news/security/pokemongo-ransomware-installs-backdoor-accounts-and-spreads-to-other-drives/", "https://id-ransomware.blogspot.com/2016/08/pokemongo-ransomware-aes-256.html" ] }, "uuid": "8b151275-d4c4-438a-9d06-92da2835586d", "value": "PokemonGO" }, { "description": "Ransomware Immitates CTB-Locker", "meta": { "encryption": "AES-256", "payment-method": "Website (onion)", "refs": [ "https://support.kaspersky.com/8547", "https://securelist.com/blog/research/76182/polyglot-the-fake-ctb-locker/" ] }, "related": [ { "dest-uuid": "5ee77368-5e09-4016-ae73-82b99e830832", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "b22cafb4-ccef-4935-82f4-631a6e539b8e", "value": "Polyglot" }, { "description": "Ransomware Open-sourced PowerShell", "meta": { "encryption": "AES-128", "extensions": [ ".locky" ], "payment-method": "Bitcoin", "price": "500 $", "refs": [ "https://github.com/pan-unit42/public_tools/blob/master/powerware/powerware_decrypt.py", "https://download.bleepingcomputer.com/demonslay335/PowerLockyDecrypter.zip", "https://www.carbonblack.com/2016/03/25/threat-alert-powerware-new-ransomware-written-in-powershell-targets-organizations-via-microsoft-word/", "http://researchcenter.paloaltonetworks.com/2016/07/unit42-powerware-ransomware-spoofing-locky-malware-family/", "http://id-ransomware.blogspot.com/2016/04/powerware-ransomware.html" ], "synonyms": [ "PoshCoder" ] }, "related": [ { "dest-uuid": "5c5beab9-614c-4c86-b369-086234ddb43c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "9fa93bb7-2997-4864-aa0e-0e667990dec8", "value": "PowerWare" }, { "description": "Ransomware no decryption possible, throws key away, destroys the files", "meta": { "encryption": "AES", "payment-method": "Website (onion)", "ransomnotes-filenames": [ "DECRYPT_INSTRUCTION.html" ] }, "uuid": "b54d59d7-b604-4b01-8002-5a2930732ca6", "value": "PowerWorm" }, { "description": "Ransomware", "meta": { "extensions": [ "[a-z]{4,6},[0-9]" ], "payment-method": "Bitcoin", "price": "3 (1 800 $)", "ransomnotes": [ ".*id*" ], "ransomnotes-filenames": [ "!_HOW_TO_RESTORE_[extension].TXT", "!_HOW_TO_RESTORE_[extension].html", "!_HOW_TO_RESTORE_*id*.txt", "@_USE_TO_FIX_JJnY.txt" ], "refs": [ "https://hshrzd.wordpress.com/2016/11/17/princess-locker-decryptor/", "https://www.bleepingcomputer.com/news/security/introducing-her-royal-highness-the-princess-locker-ransomware/", "https://blog.malwarebytes.com/threat-analysis/2016/11/princess-ransomware/", "http://id-ransomware.blogspot.com/2016/09/princess-locker-ransomware.html" ] }, "uuid": "7c8ff7e5-2cad-48e8-92e8-4c8226933cbc", "value": "Princess Locker" }, { "description": "Ransomware", "meta": { "payment-method": "MoneyPak", "price": "300 $", "refs": [ "http://www.enigmasoftware.com/prismyourcomputerhasbeenlockedransomware-removal/" ] }, "uuid": "c0ebfb75-254d-4d85-9d02-a7af8e655068", "value": "PRISM" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "refs": [ "https://twitter.com/jiriatvirlab/status/803297700175286273" ] }, "uuid": "1da6653c-8657-4cdc-9eaf-0df9d2ebbf10", "value": "Ps2exe" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "price": "1 - 2", "ransomnotes-filenames": [ "Ransomware.txt" ], "refs": [ "https://twitter.com/malwrhunterteam/status/846705481741733892", "http://id-ransomware.blogspot.com/2017/03/r-ransomware.html" ], "synonyms": [ "NM3" ] }, "uuid": "f7cd8956-2825-4104-94b1-e9589ab1089a", "value": "R" }, { "description": "Ransomware", "meta": { "extensions": [ ".crypt" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-filenames": [ "DECRYPTION INSTRUCTIONS.txt", "rtext.txt" ], "refs": [ "https://otx.alienvault.com/pulse/57976b52b900fe01376feb01/", "http://id-ransomware.blogspot.com/2016/07/r980-ransomware-aes-256-rsa4096-05.html" ] }, "uuid": "6a7ebb0a-78bc-4fdc-92ae-1b02976b5499", "value": "R980" }, { "description": "Ransomware Possible affiliation with Pony", "meta": { "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "0.39 (215 $)", "ransomnotes-filenames": [ "!!!README!!![id].rtf" ], "refs": [ "https://reaqta.com/2016/06/raa-ransomware-delivering-pony/", "http://www.bleepingcomputer.com/news/security/the-new-raa-ransomware-is-created-entirely-using-javascript/", "https://id-ransomware.blogspot.com/2016/06/raa-ransomware-aes-256-039-250.html" ], "synonyms": [ "RAA", "RAA SEP" ] }, "uuid": "b6d4faa1-6d76-42ff-8a18-238eb70cff06", "value": "RAA encryptor" }, { "description": "Ransomware RaaS Copy of Ranion RaaS", "meta": { "payment-method": "Bitcoin", "price": "0.05", "refs": [ "https://twitter.com/CryptoInsane/status/846181140025282561" ] }, "uuid": "4a95257a-6646-492f-93eb-d15dff7ce1eb", "value": "Rabion" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".RDM", ".RRK", ".RAD", ".RADAMANT" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-filenames": [ "YOUR_FILES.url" ], "refs": [ "https://decrypter.emsisoft.com/radamant", "http://www.bleepingcomputer.com/news/security/new-radamant-ransomware-kit-adds-rdm-extension-to-encrypted-files/", "http://www.nyxbone.com/malware/radamant.html", "https://id-ransomware.blogspot.com/2016/04/radamant-ransomware.html" ] }, "related": [ { "dest-uuid": "98bcb2b9-bc3a-4ffb-859a-94bd03c1cc3c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "674c3bf6-2e16-427d-ab0f-b91676a460cd", "value": "Radamant" }, { "description": "Ransomware Files might be partially encrypted", "meta": { "extensions": [ ".locked", ".kraken", ".darkness", ".nochance", ".oshit", ".oplata@qq_com", ".relock@qq_com", ".crypto", ".helpdecrypt@ukr.net", ".pizda@qq_com", ".dyatel@qq_com", "_ryp", ".nalog@qq_com", ".chifrator@qq_com", ".gruzin@qq_com", ".troyancoder@qq_com", ".encrypted", ".cry", ".AES256", ".enc", ".hb15", ".coderksu@gmail_com_id[0-9]{2,3}", ".crypt@india.com.[\\w]{4,12}", "!@#$%___________%$#@.mail" ], "payment-method": "Email", "ransomnotes-filenames": [ "\\fud.bmp", "\\paycrypt.bmp", "\\strongcrypt.bmp", "\\maxcrypt.bmp", "%APPDATA%\\Roaming\\.bmp" ], "refs": [ "https://support.kaspersky.com/us/viruses/disinfection/10556", "https://id-ransomware.blogspot.com/2016/07/bandarchor-ransomware-aes-256.html" ], "synonyms": [ "Agent.iih", "Aura", "Autoit", "Pletor", "Rotor", "Lamer", "Isda", "Cryptokluchen", "Bandarchor" ] }, "related": [ { "dest-uuid": "af50d07e-3fc5-4014-9ac5-f5466cf042bc", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "c85a41a8-a0a1-4963-894f-84bb980e6e86", "value": "Rakhni" }, { "description": "Ransomware Based on the DUMB ransomware", "meta": { "payment-method": "Bitcoin", "price": "0.3169" }, "uuid": "5b81ea66-9a44-43d8-bceb-22e5b0582f8d", "value": "Ramsomeer" }, { "description": "Ransomware", "meta": { "extensions": [ "locked-.[a-zA-Z]{4}" ], "payment-method": "PaySafeCard", "price": "1000 $", "refs": [ "https://support.kaspersky.com/viruses/disinfection/8547" ] }, "uuid": "d45f089b-efc7-45f8-a681-845374349d83", "value": "Rannoh" }, { "description": "Ransomware", "meta": { "extensions": [ ".zXz" ], "payment-method": "Bitcoin", "ransomnotes": [ "VictemKey_0_5", "VictemKey_5_30", "VictemKey_30_100", "VictemKey_100_300", "VictemKey_300_700", "VictemKey_700_2000", "VictemKey_2000_3000", "VictemKey_3000" ], "ransomnotes-filenames": [ "zXz.html" ], "refs": [ "https://github.com/pan-unit42/public_tools/tree/master/ranran_decryption", "http://researchcenter.paloaltonetworks.com/2017/03/unit42-targeted-ransomware-attacks-middle-eastern-government-organizations-political-purposes/", "https://www.bleepingcomputer.com/news/security/new-ranran-ransomware-uses-encryption-tiers-political-messages/" ], "synonyms": [ "ZXZ" ] }, "uuid": "e01a0cfa-2c8c-4e08-963a-4fa1e8cc6a34", "value": "RanRan" }, { "description": "Ransomware Doesn't encrypt user files", "meta": { "payment-method": "Bitcoin", "price": "100 $", "refs": [ "https://www.proofpoint.com/us/threat-insight/post/ransoc-desktop-locking-ransomware-ransacks-local-files-social-media-profiles", "https://www.bleepingcomputer.com/news/security/ransoc-ransomware-extorts-users-who-accessed-questionable-content/" ] }, "related": [ { "dest-uuid": "5310903e-0704-4ca4-ab1b-52d243dddb06", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "f0fcbac5-6216-4c3c-adcb-3aa06ab23340", "value": "Ransoc" }, { "description": "Ransomware no extension change, Javascript Ransomware", "meta": { "encryption": "AES", "payment-method": "Bitcoin", "price": "1", "refs": [ "http://id-ransomware.blogspot.com/2016/04/ransom32.html" ] }, "uuid": "d74e2fa6-6b8d-49ed-80f9-07b274eecef8", "value": "Ransom32" }, { "description": "Ransomware Locks the desktop", "meta": { "encryption": "Asymmetric 1024 ", "payment-method": "Bitcoin", "price": "500 $", "refs": [ "https://www.symantec.com/security_response/writeup.jsp?docid=2009-041513-1400-99&tabid=2" ] }, "uuid": "24f98123-192c-4e31-b2ee-4c77afbdc3be", "value": "RansomLock" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "price": "1 - 50", "ransomnotes-filenames": [ "RarVault.htm" ], "refs": [ "http://id-ransomware.blogspot.com/2016/09/rarvault-ransomware.html" ] }, "uuid": "c8ee96a3-ac22-40c7-8ed2-df67aeaca08d", "value": "RarVault" }, { "description": "Ransomware", "meta": { "encryption": "AES-128", "extensions": [ ".razy", ".fear" ], "payment-method": "Link", "refs": [ "http://www.nyxbone.com/malware/Razy(German).html", "http://nyxbone.com/malware/Razy.html", "http://id-ransomware.blogspot.com/2016/08/razy-ransomware-aes.html" ] }, "uuid": "f2a38c7b-054e-49ab-aa0e-67a7aac71837", "value": "Razy" }, { "description": "Ransomware", "meta": { "extensions": [ ".vscrypt", ".infected", ".bloc", ".korrektor" ], "payment-method": "Bitcoin Email", "refs": [ "https://support.kaspersky.com/viruses/disinfection/4264" ] }, "uuid": "08f519f4-df8f-4baf-b7ac-c7a0c66f7e74", "value": "Rector" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".rekt" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "Readme.txt" ], "refs": [ "https://support.kaspersky.com/viruses/disinfection/4264", "http://id-ransomware.blogspot.com/2016/08/rektlocker-ransomware.html" ] }, "uuid": "5448f038-0558-45c7-bda7-76950f82846a", "value": "RektLocker" }, { "description": "Ransomware", "meta": { "extensions": [ ".remind", ".crashed" ], "payment-method": "Bitcoin", "price": "2", "ransomnotes": [ "decypt_your_files.html " ], "refs": [ "http://www.nyxbone.com/malware/RemindMe.html", "http://i.imgur.com/gV6i5SN.jpg", "http://id-ransomware.blogspot.com/2016/05/remindme-ransomware-2.html" ] }, "uuid": "0120015c-7d37-469c-a966-7a0d42166e67", "value": "RemindMe" }, { "description": "Ransomware possibly related with Chimera", "meta": { "encryption": "Curve25519 + ChaCha", "extensions": [ ".rokku" ], "payment-method": "Bitcoin", "price": "0.2403 (100.29 $)", "ransomnotes-filenames": [ "README_HOW_TO_UNLOCK.TXT", "README_HOW_TO_UNLOCK.HTML" ], "refs": [ "https://blog.malwarebytes.org/threat-analysis/2016/04/rokku-ransomware/", "https://id-ransomware.blogspot.com/2016/04/rokku-ransomware.html" ] }, "related": [ { "dest-uuid": "38f57823-ccc2-424b-8140-8ba30325af9c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "61184aea-e87b-467d-b36e-cfc75ccb242f", "value": "Rokku" }, { "description": "Ransomware Stores your files in a password protected RAR file", "meta": { "payment-method": "Bitcoin", "price": "0.35", "refs": [ "https://twitter.com/siri_urz/status/842452104279134209", "https://id-ransomware.blogspot.com/2017/02/allyourdocuments-ransomware.html" ] }, "uuid": "e88a7509-9c79-42c1-8b0c-5e63af8e25b5", "value": "RoshaLock" }, { "description": "Ransomware Based on HT/EDA2 Utilizes the Jigsaw Ransomware background", "meta": { "payment-method": "Bitcoin", "refs": [ "https://twitter.com/struppigel/status/801812325657440256" ] }, "uuid": "266b366b-2b4f-41af-a30f-eab1c63c9976", "value": "Runsomewere" }, { "description": "Ransomware Variant of the Philadelphia ransomware", "meta": { "payment-method": "Bitcoin", "price": "0.3", "refs": [ "https://twitter.com/struppigel/status/823925410392080385" ] }, "uuid": "1149197c-89e7-4a8f-98aa-40ac0a9c0914", "value": "RussianRoulette" }, { "description": "Ransomware Variant of CryPy", "meta": { "payment-method": "Email", "refs": [ "https://twitter.com/malwrhunterteam/status/845356853039190016", "http://id-ransomware.blogspot.com/2017/03/sadstory-ransomware.html" ] }, "uuid": "6d81cee2-6c99-41fb-8b54-6581422d85dc", "value": "SADStory" }, { "description": "Ransomware Sage 2.2 deletes volume snapshots through vssadmin.exe, disables startup repair, uses process wscript.exe to execute a VBScript, and coordinates the execution of scheduled tasks via schtasks.exe.", "meta": { "extensions": [ ".sage" ], "payment-method": "Bitcoin", "price": "0.52803 (625 $)", "refs": [ "https://malwarebreakdown.com/2017/03/16/sage-2-2-ransomware-from-good-man-gate", "https://malwarebreakdown.com/2017/03/10/finding-a-good-man/" ] }, "uuid": "eacf3aee-ffb1-425a-862f-874e444a218d", "value": "Sage 2.2" }, { "description": "Ransomware Targeted attacks -Jexboss -PSExec -Hyena", "meta": { "encryption": "AES(256) + RSA(2096)", "extensions": [ ".encryptedAES", ".encryptedRSA", ".encedRSA", ".justbtcwillhelpyou", ".btcbtcbtc", ".btc-help-you", ".only-we_can-help_you", ".iwanthelpuuu", ".notfoundrans", ".encmywork", ".VforVendetta", ".theworldisyours", ".Whereisyourfiles", ".helpmeencedfiles", ".powerfulldecrypt", ".noproblemwedecfiles", ".weareyourfriends", ".otherinformation", ".letmetrydecfiles", ".encryptedyourfiles", ".weencedufiles", ".iaufkakfhsaraf", ".cifgksaffsfyghd", ".iloveworld", ".weapologize" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "HELP_DECRYPT_YOUR_FILES.html", "###-READ-FOR-HELLPP.html", "000-PLEASE-READ-WE-HELP.html", "CHECK-IT-HELP-FILES.html", "WHERE-YOUR-FILES.html", "HELP-ME-ENCED-FILES.html", "WE-MUST-DEC-FILES.html", "000-No-PROBLEM-WE-DEC-FILES.html", "TRY-READ-ME-TO-DEC.html", "000-IF-YOU-WANT-DEC-FILES.html", "LET-ME-TRY-DEC-FILES.html", "001-READ-FOR-DECRYPT-FILES.html", "READ-READ-READ.html", "IF_WANT_FILES_BACK_PLS_READ.html", "READ_READ_DEC_FILES.html", "HOW_TO_DECRYPT_FILES.html", "HELP_FOR_DECRYPT_FILE.html", "I_WILL_HELP_YOU_DECRYPT.html", "PLEASE_READ_FOR_DECRYPT_FILES.html", "WE-CAN-HELP-U.html", "0001-WE-CAN-HELP-U.html", "SORRY-FOR-FILES.html" ], "refs": [ "https://download.bleepingcomputer.com/demonslay335/SamSamStringDecrypter.zip", "http://blog.talosintel.com/2016/03/samsam-ransomware.html", "http://www.intelsecurity.com/advanced-threat-research/content/Analysis_SamSa_Ransomware.pdf", "https://www.bleepingcomputer.com/news/security/new-samsam-variant-requires-special-password-before-infection/", "https://www.bleepingcomputer.com/news/security/samsam-ransomware-crew-made-nearly-6-million-from-ransom-payments/", "https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf", "https://id-ransomware.blogspot.com/2016/03/samsam.html" ], "synonyms": [ "samsam.exe", "MIKOPONI.exe", "RikiRafael.exe", "showmehowto.exe", "SamSam Ransomware", "SamSam", "Samsam", "Samas" ] }, "related": [ { "dest-uuid": "696d78cb-1716-4ca0-b678-c03c7cfec19a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "731e4a5e-35f2-47b1-80ba-150b95fdc14d", "value": "Samas-Samsam" }, { "description": "Ransomware Based on HiddenTear, but heavily modified keygen", "meta": { "encryption": "AES-256 + RSA-2096", "extensions": [ ".sanction" ], "payment-method": "Bitcoin", "price": "3", "ransomnotes-filenames": [ "DECRYPT_YOUR_FILES.HTML" ], "refs": [ "http://id-ransomware.blogspot.com/2016/05/sanction-ransomware-3.html" ] }, "uuid": "e7b69fbe-26ba-49df-aa62-a64525f89343", "value": "Sanction" }, { "description": "Ransomware", "meta": { "encryption": "AES-256 + RSA-2048", "extensions": [ ".wallet" ], "payment-method": "Bitcoin", "price": "6", "ransomnotes-filenames": [ "RESTORE_ALL_DATA.html" ], "refs": [ "https://www.bleepingcomputer.com/news/security/sanctions-ransomware-makes-fun-of-usa-sanctions-against-russia/", "http://id-ransomware.blogspot.com/2017/03/sanctions-2017-ransomware.html" ], "synonyms": [ "Sanctions 2017" ] }, "uuid": "7b517c02-9f93-44c7-b957-10346803c43c", "value": "Sanctions" }, { "description": "Ransomware", "meta": { "extensions": [ ".enc" ], "payment-method": "Bitcoin", "price": "100 $", "refs": [ "https://twitter.com/BleepinComputer/status/835955409953357825" ] }, "uuid": "6e49ecfa-1c25-4841-ae60-3b1c3c9c7710", "value": "Sardoninir" }, { "description": "Ransomware", "meta": { "extensions": [ "Sarah_G@ausi.com___" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-filenames": [ "!satana!.txt" ], "refs": [ "https://blog.malwarebytes.com/threat-analysis/2016/06/satana-ransomware/", "https://blog.kaspersky.com/satana-ransomware/12558/", "https://id-ransomware.blogspot.com/2016/06/satana-ransomware-0.html" ] }, "related": [ { "dest-uuid": "09b555be-8bac-44b2-8741-922ee0b87880", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "a127a59e-9e4c-4c2b-b833-cabd076c3016", "value": "Satana" }, { "description": "Ransomware", "meta": { "refs": [ "http://securelist.com/blog/research/69481/a-flawed-ransomware-encryptor/" ] }, "uuid": "c0c685b8-a59d-4922-add9-e572d5fd48cd", "value": "Scraper" }, { "description": "Ransomware DetoxCrypto Variant", "meta": { "encryption": "AES", "payment-method": "Euros", "price": "50", "refs": [ "http://www.nyxbone.com/malware/Serpico.html", "http://id-ransomware.blogspot.com/2016/08/serpico-ransomware.html" ] }, "related": [ { "dest-uuid": "0d4ca924-7e7e-4385-b14d-f504b4d206e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "bd4bfbab-c21d-4971-b70c-b180bcf40630", "value": "Serpico" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "50 - 100 - 200 $", "ransomnotes-filenames": [ "Readme.txt" ], "refs": [ "http://www.bleepingcomputer.com/news/security/the-shark-ransomware-project-allows-to-create-your-own-customized-ransomware/", "http://www.bleepingcomputer.com/news/security/shark-ransomware-rebrands-as-atom-for-a-fresh-start/" ], "synonyms": [ "Atom" ] }, "related": [ { "dest-uuid": "ff471870-7c9a-4122-ba89-489fc819660b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "503c9910-902f-4bae-8c33-ea29db8bdd7f", "value": "Shark" }, { "description": "Ransomware", "meta": { "extensions": [ ".shino" ], "payment-method": "no ransom", "refs": [ "https://twitter.com/JakubKroustek/status/760560147131408384", "http://www.bleepingcomputer.com/news/security/new-educational-shinolocker-ransomware-project-released/", "https://id-ransomware.blogspot.com/2016/08/shinolocker-ransomware.html" ] }, "uuid": "bc029327-ee34-4eba-8933-bd85f2a1e9d1", "value": "ShinoLocker" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "文件解密帮助.txt" ], "refs": [ "http://www.nyxbone.com/malware/chineseRansom.html", "http://blog.trendmicro.com/trendlabs-security-intelligence/chinese-language-ransomware-makes-appearance/", "http://id-ransomware.blogspot.com/2016/05/chinese-ransomware.html" ], "synonyms": [ "KinCrypt" ] }, "related": [ { "dest-uuid": "77c20bd9-5403-4f99-bae5-c54f3f38a6b6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "b9963d52-a391-4e9c-92e7-d2a147d5451f", "value": "Shujin" }, { "description": "Ransomware", "meta": { "encryption": "AES", "extensions": [ ".~" ], "payment-method": "Bitcoin", "price": "0.8", "ransomnotes-filenames": [ "_RECOVER_INSTRUCTIONS.ini" ], "refs": [ "http://www.bleepingcomputer.com/news/security/the-shark-ransomware-project-allows-to-create-your-own-customized-ransomware/", "https://id-ransomware.blogspot.com/2016/07/tilde-ransomware-aes-08.html" ], "synonyms": [ "Tilde" ] }, "uuid": "2709b2ff-a2be-49a9-b268-2576170a5dff", "value": "Simple_Encoder" }, { "description": "Ransomware Based on EDA2", "meta": { "encryption": "AES-256", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-filenames": [ "READ_IT.txt" ], "refs": [ "http://www.bleepingcomputer.com/news/security/pompous-ransomware-dev-gets-defeated-by-backdoor/", "http://www.nyxbone.com/malware/SkidLocker.html", "http://id-ransomware.blogspot.com/2016/04/pompous-ransomware.html" ], "synonyms": [ "Pompous" ] }, "uuid": "44b6b99e-b1d9-4605-95c2-55c14c7c25be", "value": "SkidLocker" }, { "description": "Ransomware", "meta": { "payment-method": "no ransom", "refs": [ "https://www.bleepingcomputer.com/news/security/smash-ransomware-is-cute-rather-than-dangerous/" ] }, "uuid": "27283e74-abc6-4d8a-bcb6-a60804b8e264", "value": "Smash!" }, { "description": "Ransomware", "meta": { "extensions": [ ".encrypted" ], "payment-method": "Bitcoin", "price": "0.66 (300 $)", "ransomnotes-filenames": [ "_HOW_TO_Decrypt.bmp" ], "refs": [ "http://id-ransomware.blogspot.com/2016/08/smrss32-ransomware.html" ] }, "uuid": "cd21bb2a-0c6a-463b-8c0e-16da251f69ae", "value": "Smrss32" }, { "description": "Ransomware Based on EDA2", "meta": { "encryption": "AES-256", "extensions": [ ".RSNSlocked", ".RSplited" ], "payment-method": "Bitcoin", "price": "0.66 (300 $)", "ransomnotes-filenames": [ "READ_Me.txt" ], "refs": [ "http://nyxbone.com/malware/SNSLocker.html", "http://nyxbone.com/images/articulos/malware/snslocker/16.png", "http://id-ransomware.blogspot.com/2016/05/sns-locker-ransomware-aes-256-066.html" ] }, "uuid": "82658f48-6a62-4dee-bd87-382e76b84c3d", "value": "SNSLocker" }, { "description": "Ransomware", "meta": { "extensions": [ ".sport" ], "payment-method": "Bitcoin" }, "uuid": "9526efea-8853-42f2-89be-a04ee1ca4c7d", "value": "Sport" }, { "description": "Ransomware Coded by \"The_Rainmaker\" Randomly deletes a file every 6hrs up to 96hrs then deletes decryption key", "meta": { "encryption": "AES-256", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes": [ "Random message includes bitcoin wallet address with instructions" ], "refs": [ "https://success.trendmicro.com/portal_kb_articledetail?solutionid=1114221", "http://www.bleepingcomputer.com/news/security/stampado-ransomware-campaign-decrypted-before-it-started/", "https://decrypter.emsisoft.com/stampado", "https://cdn.streamable.com/video/mp4/kfh3.mp4", "http://blog.trendmicro.com/trendlabs-security-intelligence/the-economics-behind-ransomware-prices/", "https://id-ransomware.blogspot.com/2016/07/stampado-ransomware-1.html" ] }, "uuid": "6b8729b0-7ffc-4d07-98de-e5210928b274", "value": "Stampado" }, { "description": "Ransomware Based on EDA2, shows Guy Fawkes mask", "meta": { "encryption": "AES-256", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "500 - 1000 $", "refs": [ "http://www.nyxbone.com/malware/Strictor.html" ] }, "uuid": "d75bdd85-032a-46b7-a339-257fd5656c11", "value": "Strictor" }, { "description": "Ransomware Based on EDA2", "meta": { "encryption": "AES-256", "extensions": [ ".surprise", ".tzu" ], "payment-method": "Bitcoin", "price": "0.5 - 25", "ransomnotes": [ "DECRYPTION_HOWTO.Notepad" ], "refs": [ "http://id-ransomware.blogspot.com/2016/05/surprise-ransomware-aes-256.html" ] }, "uuid": "6848b77c-92c8-40ec-90ac-9c14b9f17272", "value": "Surprise" }, { "description": "Ransomware Still in development, shows FileIce survey", "meta": { "payment-method": "no ransom", "ransomnotes-filenames": [ "ThxForYurTyme.txt" ], "refs": [ "http://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/" ] }, "uuid": "11725992-3634-4715-ae17-b6f5ed13b877", "value": "Survey" }, { "description": "Ransomware Exploited Synology NAS firmware directly over WAN", "meta": { "payment-method": "Website (onion)" }, "uuid": "27740d5f-30cf-4c5c-812c-15c0918ce9f0", "value": "SynoLocker" }, { "description": "Ransomware", "meta": { "extensions": [ ".szf" ], "payment-method": "Email", "refs": [ "http://now.avg.com/dont-pay-the-ransom-avg-releases-six-free-decryption-tools-to-retrieve-your-files/", "https://id-ransomware.blogspot.com/2016/06/szflocker-polish-ransomware-email.html" ] }, "uuid": "a7845bbe-d7e6-4c7b-a9b8-dccbd93bc4b2", "value": "SZFLocker" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".___xratteamLucked" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "Como descriptografar os seus arquivos.txt" ], "refs": [ "https://securelist.com/blog/research/76153/teamxrat-brazilian-cybercrime-meets-ransomware/" ] }, "uuid": "65a31863-4f59-4c66-bc2d-31e8fb68bbe8", "value": "TeamXrat" }, { "description": "Ransomware Factorization", "meta": { "extensions": [ ".vvv", ".ecc", ".exx", ".ezz", ".abc", ".aaa", ".zzz", ".xyz" ], "payment-method": "Bitcoin", "ransomnotes-filenames": [ "HELP_TO_SAVE_FILES.txt", "Howto_RESTORE_FILES.html" ], "refs": [ "http://www.bleepingcomputer.com/forums/t/576600/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt/", "http://www.talosintel.com/teslacrypt_tool/" ], "synonyms": [ "AlphaCrypt" ] }, "uuid": "af92c71e-935e-4486-b4e7-319bf16d622e", "value": "TeslaCrypt 0.x - 2.2.0" }, { "description": "Ransomware 4.0+ has no extension", "meta": { "encryption": "AES-256 + ECHD + SHA1", "extensions": [ ".micro", ".xxx", ".ttt", ".mp3" ], "payment-method": "Bitcoin", "refs": [ "http://www.bleepingcomputer.com/forums/t/576600/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt/", "http://www.welivesecurity.com/2016/05/18/eset-releases-decryptor-recent-variants-teslacrypt-ransomware/", "https://blog.kaspersky.com/raknidecryptor-vs-teslacrypt/12169/" ] }, "uuid": "bd19dfff-7c8d-4c94-967e-f8ffc19e7dd9", "value": "TeslaCrypt 3.0+" }, { "description": "Ransomware", "meta": { "encryption": "AES-256 + ECHD + SHA1", "payment-method": "Bitcoin", "ransomnotes-filenames": [ "RECOVER<5_chars>.html", "RECOVER<5_chars>.png", "RECOVER<5_chars>.txt", "_how_recover+.txt", "_how_recover+.html", "help_recover_instructions+.html", "help_recover_instructions+.txt", "help_recover_instructions+.BMP", "_H_e_l_p_RECOVER_INSTRUCTIONS+.txt", "_H_e_l_p_RECOVER_INSTRUCTIONS+.html", "_H_e_l_p_RECOVER_INSTRUCTIONS+.png", "Recovery+<5 random chars>.txt, .html, e.g., Recovery+gwote.txt", "RESTORE_FILES_.TXT , e.g. restore_files_kksli.bmp", "HELP_RESTORE_FILES_.TXT , e.g. help_restore_files_kksli.bmp", "HOWTO_RECOVER_FILES_.TXT. e.g. howto_recover_files_xeyye.txt", "HELP_TO_SAVE_FILES.txt", "HELP_TO_SAVE_FILES.bmp" ], "refs": [ "http://www.bleepingcomputer.com/forums/t/576600/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt/", "http://www.welivesecurity.com/2016/05/18/eset-releases-decryptor-recent-variants-teslacrypt-ransomware/", "https://blog.kaspersky.com/raknidecryptor-vs-teslacrypt/12169/", "https://www.endgame.com/blog/your-package-has-been-successfully-encrypted-teslacrypt-41a-and-malware-attack-chain" ] }, "uuid": "ab6b8f56-cf2d-4733-8f9c-df3d52c05e66", "value": "TeslaCrypt 4.1A" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "ransomnotes-filenames": [ "RECOVER<5_chars>.html", "RECOVER<5_chars>.png", "RECOVER<5_chars>.txt", "_how_recover+.txt", "_how_recover+.html", "help_recover_instructions+.BMP", "help_recover_instructions+.html", "help_recover_instructions+.txt", "_H_e_l_p_RECOVER_INSTRUCTIONS+.txt", "_H_e_l_p_RECOVER_INSTRUCTIONS+.html", "_H_e_l_p_RECOVER_INSTRUCTIONS+.png", "Recovery+<5 random chars>.txt, .html, e.g., Recovery+gwote.txt", "RESTORE_FILES_.TXT , e.g. restore_files_kksli.bmp", "HELP_RESTORE_FILES_.TXT , e.g. help_restore_files_kksli.bmp", "HOWTO_RECOVER_FILES_.TXT. e.g. howto_recover_files_xeyye.txt", "HELP_TO_SAVE_FILES.txt", "HELP_TO_SAVE_FILES.bmp" ], "refs": [ "http://www.bleepingcomputer.com/forums/t/576600/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt/", "http://www.welivesecurity.com/2016/05/18/eset-releases-decryptor-recent-variants-teslacrypt-ransomware/", "https://blog.kaspersky.com/raknidecryptor-vs-teslacrypt/12169/", "http://www.bleepingcomputer.com/news/security/teslacrypt-4-2-released-with-quite-a-few-modifications/" ] }, "uuid": "eed65c12-b179-4002-a11b-7a2e2df5f0c8", "value": "TeslaCrypt 4.2" }, { "description": "Ransomware Files cannot be decrypted Has a GUI", "meta": { "payment-method": "Bitcoin", "price": "1.25", "ransomnotes-filenames": [ "HELP_DECRYPT.HTML" ] }, "uuid": "c0bce92a-63b8-4538-93dc-0911ae46596d", "value": "Threat Finder" }, { "description": "Ransomware Newer variants not decryptable. Only first 2 MB are encrypted", "meta": { "encryption": "AES-256 CBC for files + RSA-1024 for AES key uses LibTomCrypt", "extensions": [ ".Encrypted", ".enc" ], "payment-method": "Bitcoin", "price": "4.081", "ransomnotes-filenames": [ "HOW_TO_RESTORE_FILES.html", "DECRYPT_INSTRUCTIONS.html", "DESIFROVANI_POKYNY.html", "INSTRUCCIONES_DESCIFRADO.html", "ISTRUZIONI_DECRITTAZIONE.html", "ENTSCHLUSSELN_HINWEISE.html", "ONTSLEUTELINGS_INSTRUCTIES.html", "INSTRUCTIONS_DE_DECRYPTAGE.html", "SIFRE_COZME_TALIMATI.html", "wie_zum_Wiederherstellen_von_Dateien.txt" ], "refs": [ "http://www.bleepingcomputer.com/forums/t/547708/torrentlocker-ransomware-cracked-and-decrypter-has-been-made/", "https://twitter.com/PolarToffee/status/804008236600934403", "http://blog.talosintelligence.com/2017/03/crypt0l0cker-torrentlocker-old-dog-new.html", "http://id-ransomware.blogspot.ru/2016/05/torrentlocker-ransomware-aes-cbc-2048.html" ], "synonyms": [ "Crypt0L0cker", "CryptoFortress", "Teerac" ] }, "related": [ { "dest-uuid": "26c8b446-305c-4057-83bc-85b09630281e", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ae4aa1ef-4da0-4952-9583-9d47f84edad9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "7f6cd579-b021-4896-80da-fcc07c35c8b2", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "b817ce63-f1c3-49de-bd8b-fd56c3f956c9", "value": "TorrentLocker" }, { "description": "Ransomware", "meta": { "payment-method": "Bitcoin", "price": "100 - 150 $", "ransomnotes-filenames": [ "Payment_Instructions.jpg" ], "refs": [ "http://www.bleepingcomputer.com/forums/t/618055/towerweb-ransomware-help-support-topic-payment-instructionsjpg/", "https://id-ransomware.blogspot.com/2016/06/towerweb-ransonware-100.html" ] }, "uuid": "4d470cf8-09b6-4d0e-8e5a-2f618e48c560", "value": "TowerWeb" }, { "description": "Ransomware", "meta": { "extensions": [ ".toxcrypt" ], "payment-method": "Bitcoin", "price": "0.23", "ransomnotes-filenames": [ "tox.html" ], "refs": [ "https://id-ransomware.blogspot.com/2016/06/toxcrypt-ransomware-aes-crypto-0.html" ] }, "uuid": "08fc7534-fe85-488b-92b0-630c0d91ecbe", "value": "Toxcrypt" }, { "description": "Ransomware", "meta": { "extensions": [ ".braincrypt" ], "payment-method": "Email", "ransomnotes-filenames": [ "!!! HOW TO DECRYPT FILES !!!.txt" ], "refs": [ "https://download.bleepingcomputer.com/demonslay335/BrainCryptDecrypter.zip", "https://twitter.com/PolarToffee/status/811249250285842432", "http://id-ransomware.blogspot.com/2016/12/braincrypt-ransomware.html" ], "synonyms": [ "BrainCrypt" ] }, "uuid": "97673387-75ae-4da4-9a5f-38773f2492e7", "value": "Trojan" }, { "description": "Ransomware May download additional malware after encryption", "meta": { "encryption": "AES-256", "extensions": [ ".breaking_bad", ".better_call_saul", ".xtbl", ".da_vinci_code", ".windows10", ".no_more_ransom" ], "payment-method": "Email", "ransomnotes-filenames": [ "README.txt", "nomoreransom_note_original.txt" ], "refs": [ "https://www.nomoreransom.org/uploads/ShadeDecryptor_how-to_guide.pdf", "http://www.nyxbone.com/malware/Troldesh.html", "https://www.bleepingcomputer.com/news/security/kelihos-botnet-delivering-shade-troldesh-ransomware-with-no-more-ransom-extension/", "https://id-ransomware.blogspot.com/2016/06/troldesh-ransomware-email.html" ], "synonyms": [ "Shade", "Troldesh" ] }, "uuid": "6c3dd006-3501-4ebc-ab86-b06e4d555194", "value": "Troldesh orShade, XTBL" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".enc" ], "payment-method": "Bitcoin", "price": "0.2 (115 $)", "refs": [ "http://www.bleepingcomputer.com/news/security/truecrypter-ransomware-accepts-payment-in-bitcoins-or-amazon-gift-card/", "http://id-ransomware.blogspot.com/2016/04/truecrypter-ransomware.html" ] }, "uuid": "c46bfed8-7010-432a-8108-138f6d067000", "value": "TrueCrypter" }, { "description": "Ransomware", "meta": { "extensions": [ ".sifreli" ], "payment-method": "Bitcoin", "price": "100 $", "refs": [ "https://twitter.com/struppigel/status/821991600637313024" ] }, "uuid": "132c39fc-1364-4210-aef9-48f73afc1108", "value": "Turkish" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "2", "ransomnotes-filenames": [ "DOSYALARINIZA ULAŞMAK İÇİN AÇINIZ.html" ], "refs": [ "http://www.nyxbone.com/malware/turkishRansom.html" ] }, "uuid": "174dd201-0b0b-4a76-95c7-71f8141684d0", "value": "Turkish Ransom" }, { "description": "Ransomware CrypBoss Family", "meta": { "encryption": "AES", "extensions": [ "umbrecrypt_ID_[VICTIMID]" ], "payment-method": "Email", "ransomnotes-filenames": [ "README_DECRYPT_UMBRE_ID_[victim_id].jpg", "README_DECRYPT_UMBRE_ID_[victim_id].txt", "default32643264.bmp", "default432643264.jpg" ], "refs": [ "http://www.thewindowsclub.com/emsisoft-decrypter-hydracrypt-umbrecrypt-ransomware", "https://id-ransomware.blogspot.com/2016/06/umbrecrypt-ransomware-aes.html" ] }, "uuid": "028b3489-51da-45d7-8bd0-62044e9ea49f", "value": "UmbreCrypt" }, { "description": "Ransomware", "meta": { "payment-method": "Website", "price": "0.18", "ransomnotes-filenames": [ "Files encrypted.txt" ], "refs": [ "https://www.bleepingcomputer.com/forums/t/627582/unblockupc-ransomware-help-support-topic-files-encryptedtxt/", "http://id-ransomware.blogspot.com/2016/09/unblockupc-ransomware.html" ] }, "uuid": "5a9f9ebe-f4c8-4985-8890-743f59d658fd", "value": "UnblockUPC" }, { "description": "Ransomware Ransom note instructs to use Bitmessage to get in contact with attacker - Secretishere.key - SECRETISHIDINGHEREINSIDE.KEY - secret.key", "meta": { "encryption": "AES", "extensions": [ ".H3LL", ".0x0", ".1999" ], "payment-method": "Website", "price": "2.5", "ransomnotes-filenames": [ "READTHISNOW!!!.txt", "Hellothere.txt", "YOUGOTHACKED.TXT" ], "refs": [ "http://id-ransomware.blogspot.com/2016/05/bitmessage-ransomware-aes-256-25-btc.html" ] }, "uuid": "bb8c6b80-91cb-4c01-b001-7b9e73228420", "value": "Ungluk" }, { "description": "Ransomware", "meta": { "extensions": [ ".CRRRT", ".CCCRRRPPP" ], "payment-method": "Website", "ransomnotes-filenames": [ "READ_ME_!.txt" ], "refs": [ "https://twitter.com/malwrhunterteam/status/839038399944224768", "http://id-ransomware.blogspot.com/2017/02/unlock26-ransomware.html" ] }, "uuid": "dfe760e5-f878-492d-91d0-05fa45a2849d", "value": "Unlock92 " }, { "description": "Ransomware CryptoWire variant", "meta": { "payment-method": "Bitcoin", "price": "200 $", "refs": [ "https://twitter.com/struppigel/status/839771195830648833" ] }, "uuid": "7799247c-4e6a-4c20-b0b3-d8e6a8ab6783", "value": "VapeLauncher" }, { "description": "Ransomware", "meta": { "encryption": "uses gpg.exe", "extensions": [ ".vault", ".xort", ".trun" ], "payment-method": "Bitcoin", "price": "0.438", "ransomnotes-filenames": [ "VAULT.txt", "xort.txt", "trun.txt", ".hta | VAULT.hta" ], "refs": [ "http://www.nyxbone.com/malware/russianRansom.html" ], "synonyms": [ "CrypVault", "Zlader" ] }, "related": [ { "dest-uuid": "2195387d-ad9c-47e6-8f14-a49388b26eab", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "63a82b7f-9a71-47a8-9a79-14acc6595da5", "value": "VaultCrypt" }, { "description": "Ransomware", "meta": { "extensions": [ ".VBRANSOM" ], "payment-method": "Website (onion)", "refs": [ "https://twitter.com/BleepinComputer/status/817851339078336513" ] }, "uuid": "44a56cd0-8cd8-486f-972d-4b1b416e9077", "value": "VBRANSOM 7" }, { "description": "Ransomware Based on EDA2", "meta": { "encryption": "AES-256", "extensions": [ ".Venusf", ".Venusp" ], "payment-method": "Bitcoin", "price": "0.15 (100 $)", "ransomnotes-filenames": [ "ReadMe.txt" ], "refs": [ "https://blog.malwarebytes.com/threat-analysis/2016/08/venus-locker-another-net-ransomware/?utm_source=twitter&utm_medium=social", "http://www.nyxbone.com/malware/venusLocker.html", "https://id-ransomware.blogspot.com/2016/08/venuslocker-ransomware-aes-256.html" ] }, "uuid": "7340c6d6-a16e-4a01-8bb4-8ad3edc64d28", "value": "VenusLocker" }, { "description": "Ransomware Polymorphism / Self-replication", "meta": { "extensions": [ ".exe" ], "payment-method": "Bitcoin", "price": "250 $", "refs": [ "http://www.nyxbone.com/malware/Virlock.html", "http://www.welivesecurity.com/2014/12/22/win32virlock-first-self-reproducing-ransomware-also-shape-shifter/" ], "synonyms": [ "NSMF" ] }, "uuid": "5c736959-6c58-4bf2-b084-7197b42e500a", "value": "Virlock" }, { "description": "Ransomware", "meta": { "encryption": "AES-256", "extensions": [ ".CrySiS", ".xtbl", ".crypt", ".DHARMA", ".id-########.decryptformoney@india.com.xtbl", ".[email_address].DHARMA" ], "payment-method": "Bitcoin", "price": "2.5 - 3", "ransomnotes-filenames": [ "How to decrypt your data.txt" ], "refs": [ "http://www.welivesecurity.com/2016/11/24/new-decryption-tool-crysis-ransomware/", "http://media.kaspersky.com/utilities/VirusUtilities/EN/rakhnidecryptor.zip", "http://www.nyxbone.com/malware/virus-encoder.html", "http://blog.trendmicro.com/trendlabs-security-intelligence/crysis-targeting-businesses-in-australia-new-zealand-via-brute-forced-rdps/" ], "synonyms": [ "CrySiS" ] }, "uuid": "15a30d84-4f5f-4b75-a162-e36107d30215", "value": "Virus-Encoder" }, { "description": "Ransomware Zyklon variant", "meta": { "extensions": [ ".wflx" ], "payment-method": "Bitcoin", "price": "299 $", "ransomnotes-filenames": [ "HOW_TO_UNLOCK_FILES_README_().txt" ], "refs": [ "https://labs.opendns.com/2016/07/13/wildfire-ransomware-gaining-momentum/", "https://id-ransomware.blogspot.com/2016/06/wildfire-locker-ransomware-aes-256-cbc.html" ], "synonyms": [ "Hades Locker" ] }, "related": [ { "dest-uuid": "c0091a62-b1cd-495d-898b-d2f3b5af601e", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "31945e7b-a734-4333-9ea2-e52051ca015a", "value": "WildFire Locker" }, { "description": "Ransomware encrypted files will still have the original non-encrypted header of 0x33 bytes length", "meta": { "encryption": "XOR or TEA", "extensions": [ ".EnCiPhErEd", ".73i87A", ".p5tkjw", ".PoAr2w", ".fileiscryptedhard", ".encoderpass", ".zc3791", ".antihacker2017", "....PAY_IN_MAXIM_24_HOURS_OR_ALL_YOUR_FILES_WILL_BE_PERMANENTLY_DELETED_PLEASE_BE_REZONABLE_you_have_only_1_single_chance_YOU_NEED_TO_PURCHASE_THE_DECRYPTOR_FROM_US_FAST_AND_URGENT" ], "payment-method": "Bitcoin", "price": "0.8", "ransomnotes-filenames": [ "HOW TO DECRYPT FILES.TXT" ], "ransomnotes-refs": [ "https://pbs.twimg.com/media/Dfj9G_2XkAE0ZS2.jpg", "https://pbs.twimg.com/media/Dfj9H66WkAEHazN.jpg" ], "refs": [ "https://support.kaspersky.com/viruses/disinfection/2911", "https://decrypter.emsisoft.com/xorist", "https://twitter.com/siri_urz/status/1006833669447839745", "https://id-ransomware.blogspot.com/2016/06/xrtn-ransomware-rsa-1024-gnu-privacy.html" ] }, "uuid": "0a15a920-9876-4985-9d3d-bb0794722258", "value": "Xorist" }, { "description": "Ransomware VaultCrypt family", "meta": { "extensions": [ ".xrtn" ] }, "uuid": "22ff9f8c-f658-46cc-a404-1a54e1b74569", "value": "XRTN " }, { "description": "Ransomware Attempt to steal passwords", "meta": { "extensions": [ ".Locked" ], "payment-method": "Bitcoin", "price": "0.25", "refs": [ "https://twitter.com/malwrhunterteam/status/808280549802418181" ] }, "uuid": "0810ea3e-1cd6-4ea3-a416-5895fb685c5b", "value": "You Have Been Hacked!!!" }, { "description": "Ransomware", "meta": { "extensions": [ ".zcrypt" ], "payment-method": "Bitcoin", "price": "1.2 - 5", "refs": [ "https://blogs.technet.microsoft.com/mmpc/2016/05/26/link-lnk-to-ransom/", "http://id-ransomware.blogspot.com/2016/05/zcrypt-ransomware-rsa-2048-email.html" ], "synonyms": [ "Zcryptor" ] }, "uuid": "7eed5e96-0219-4355-9a9c-44643272894c", "value": "Zcrypt" }, { "description": "Ransomware mpritsken@priest.com", "meta": { "extensions": [ ".crypto" ], "payment-method": "Bitcoin", "price": "3", "ransomnotes-filenames": [ "how.txt" ], "refs": [ "http://www.bleepingcomputer.com/forums/t/617874/zimbra-ransomware-written-in-python-help-and-support-topic-crypto-howtotxt/", "https://id-ransomware.blogspot.com/2016/06/zimbra-ransomware-aes-optzimbrastore.html" ] }, "uuid": "07346620-a0b4-48d5-9158-5048741f5078", "value": "Zimbra" }, { "description": "Ransomware VaultCrypt family", "meta": { "encryption": "RSA", "extensions": [ ".vault" ], "payment-method": "Bitcoin", "price": "100 - 900 $", "refs": [ "http://www.nyxbone.com/malware/russianRansom.html" ], "synonyms": [ "Russian", "VaultCrypt", "CrypVault" ] }, "related": [ { "dest-uuid": "63a82b7f-9a71-47a8-9a79-14acc6595da5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "2195387d-ad9c-47e6-8f14-a49388b26eab", "value": "Zlader" }, { "description": "Ransomware", "meta": { "extensions": [ ".zorro" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "Take_Seriously (Your saving grace).txt" ], "refs": [ "https://twitter.com/BleepinComputer/status/844538370323812353", "http://id-ransomware.blogspot.com/2017/03/zorro-ransomware.html" ] }, "uuid": "b2bd25e1-d41c-42f2-8971-ecceceb6ba08", "value": "Zorro" }, { "description": "Ransomware Hidden Tear family, GNL Locker variant", "meta": { "extensions": [ ".zyklon" ], "payment-method": "Euro", "price": "250", "refs": [ "http://id-ransomware.blogspot.com/2016/05/zyklon-locker-ransomware-windows-250.html" ], "synonyms": [ "GNL Locker", "Zyklon Locker" ] }, "related": [ { "dest-uuid": "390abe30-8b9e-439e-a6d3-2ee978f05fba", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "721e9af0-8a60-4b9e-9137-c23e86d75722", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "78ef77ac-a570-4fb9-af80-d04c09dff9ab", "value": "Zyklon" }, { "description": "Ransomware", "meta": { "extensions": [ ".vxLock" ], "payment-method": "Bitcoin", "price": "0.3", "refs": [ "https://id-ransomware.blogspot.com/2017/01/vxlock-ransomware.html" ] }, "uuid": "37950a1c-0035-49e0-9278-e878df0a10f3", "value": "vxLock" }, { "description": "We recently observed several large scale email campaigns that were attempting to distribute a new variant of ransomware that has been dubbed \"Jaff\". Interestingly we identified several characteristics that we have previously observed being used during Dridex and Locky campaigns. In a short period of time, we observed multiple campaigns featuring high volumes of malicious spam emails being distributed, each using a PDF attachment with an embedded Microsoft Word document functioning as the initial downloader for the Jaff ransomware.", "meta": { "encryption": "AES", "extensions": [ ".jaff" ], "payment-method": "Bitcoin", "price": "1.82 - 2.036", "ransomnotes-filenames": [ "WallpapeR.bmp", "ReadMe.bmp", "ReadMe.html", "ReadMe.txt" ], "refs": [ "http://blog.talosintelligence.com/2017/05/jaff-ransomware.html", "https://www.bleepingcomputer.com/news/security/jaff-ransomware-distributed-via-necurs-malspam-and-asking-for-a-3-700-ransom/", "http://id-ransomware.blogspot.com/2017/05/jaff-ransomware.html" ] }, "related": [ { "dest-uuid": "2c51a717-726b-4813-9fcc-1265694b128e", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "8e3d44d0-6768-4b54-88b0-2e004a7f2297", "value": "Jaff" }, { "description": "Using EternalBlue SMB Exploit To Infect Victims", "meta": { "encryption": "may be a mixture of AES and RC4.", "extensions": [ "._[10_digit_victim_id].UIWIX" ], "payment-method": "Bitcoin", "price": "0.122", "ransomnotes-filenames": [ "DECODE_FILES.txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/uiwix-ransomware-using-eternalblue-smb-exploit-to-infect-victims/", "http://id-ransomware.blogspot.com/2017/05/uiwix-ransomware.html" ], "synonyms": [ "UIWIX" ] }, "uuid": "369d6fda-0284-44aa-9e74-f6651416fec4", "value": "Uiwix Ransomware" }, { "description": "Fileless, Code-injecting Ransomware", "meta": { "extensions": [ ".pr0tect" ], "payment-method": "Email", "ransomnotes-refs": [ "http://blog.trendmicro.com/trendlabs-security-intelligence/files/2017/06/SOREBRECT-3.jpg" ], "refs": [ "http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-fileless-code-injecting-sorebrect-ransomware/" ] }, "uuid": "34cedaf0-b1f0-4b5d-b7bd-2eadfc630ea7", "value": "SOREBRECT" }, { "description": "claims it detected \"Children Pornsites\" in your browser history", "meta": { "extensions": [ ".CYRON" ], "payment-method": "PaySafeCard", "price": "50 €", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2017/august/25/DHvA8CDWAAIR5er.jpg" ], "refs": [ "https://twitter.com/struppigel/status/899524853426008064", "https://id-ransomware.blogspot.com/2017/08/cyron-ransomware.html" ] }, "uuid": "f597d388-886e-46d6-a5cc-26deeb4674f2", "value": "Cyron" }, { "description": "Made with OXAR builder; decryptable", "meta": { "extensions": [ ".OXR" ], "payment-method": "Bitcoin Email", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2017/august/25/DHvDae7XoAE9usO[1].jpg" ], "refs": [ "https://twitter.com/struppigel/status/899528477824700416" ] }, "uuid": "3330e226-b71a-4ee4-8612-2b06b58368fc", "value": "Kappa" }, { "description": "CyberSplitter variant", "meta": { "extensions": [ ".Isis" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2017/august/25/DHvM552WsAAuDbi[1].jpg" ], "refs": [ "https://twitter.com/struppigel/status/899537940539478016" ] }, "uuid": "1fe6c23b-863e-49e4-9439-aa9e999aa2e1", "value": "Trojan Dz" }, { "description": "ransomware written by self proclaimed script kiddies that should really be considered trollware", "meta": { "extensions": [ ".xolzsec" ], "payment-method": "no ransom", "refs": [ "https://twitter.com/struppigel/status/899916577252028416", "http://id-ransomware.blogspot.com/2017/08/xolzsec-ransomware.html" ] }, "uuid": "f2930308-2e4d-4af5-b119-746be0fe7f2c", "value": "Xolzsec" }, { "description": "HiddenTear variant; decryptable", "meta": { "extensions": [ ".flat" ], "payment-method": "Bitcoin", "price": "250 $", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2017/august/25/DH5KChhXsAADOIu[1].jpg" ], "refs": [ "https://twitter.com/struppigel/status/900238572409823232", "https://id-ransomware.blogspot.com/2017/08/flatchestware-ransomware.html" ] }, "uuid": "d29341fd-f48e-4caa-8a28-b17853b779d1", "value": "FlatChestWare" }, { "description": "The ransomware does not use a customized desktop wallpaper to signal its presence, and the only way to discover that SynAck has infected your PC is by the ransom notes dropped on the user's desktop, named in the format: RESTORE_INFO-[id].txt. For example: RESTORE_INFO-4ABFA0EF.txt\n In addition, SynAck also appends its own extension at the end of all files it encrypted. This file extensions format is ten random alpha characters for each file. For example: test.jpg.XbMiJQiuoh. Experts believe the group behind SynAck uses RDP brute-force attacks to access remote computers and manually download and install the ransomware.", "meta": { "links": [ "http://xqkz2rmrqkeqf6sjbrb47jfwnqxcd4o2zvaxxzrpbh2piknms37rw2ad.onion/" ], "payment-method": "Bitcoin", "price": "2 100 $", "ransomnotes-filenames": [ "RESTORE_INFO-[id].txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/synack-ransomware-sees-huge-spike-in-activity/", "https://www.bleepingcomputer.com/news/security/synack-ransomware-uses-process-doppelg-nging-technique/", "https://id-ransomware.blogspot.com/2017/09/synack-ransomware.html", "https://www.zdnet.com/article/synack-ransomware-group-releases-decryption-keys-as-they-rebrand-to-el-cometa", "https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/", "https://therecord.media/synack-ransomware-gang-releases-decryption-keys-for-old-victims/", "https://www.ransomlook.io/group/synack" ], "synonyms": [ "Syn Ack" ] }, "related": [ { "dest-uuid": "a396a0bb-6dc5-424a-bdbd-f8ba808ca2c2", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "04585cd8-54ae-420f-9191-8ddb9b88a80c", "value": "SynAck" }, { "description": "A new ransomware called SyncCrypt was discovered by Emsisoft security researcher xXToffeeXx that is being distributed by spam attachments containing WSF files. When installed these attachments will encrypt a computer and append the .kk extension to encrypted files.", "meta": { "extensions": [ ".kk" ], "payment-method": "Bitcoin", "price": "0.1", "ransomnotes-filenames": [ "readme.html", "readme.png" ], "refs": [ "https://www.bleepingcomputer.com/news/security/synccrypt-ransomware-hides-inside-jpg-files-appends-kk-extension/", "http://id-ransomware.blogspot.com/2017/08/synccrypt-ransomware.html" ] }, "related": [ { "dest-uuid": "e717a26d-17aa-4cd7-88de-dc75aa365232", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "83d10b83-9038-4dd6-b305-f14c21478588", "value": "SyncCrypt" }, { "description": "On October 24, 2017, Cisco Talos was alerted to a widescale ransomware campaign affecting organizations across eastern Europe and Russia. As was the case in previous situations, we quickly mobilized to assess the situation and ensure that customers remain protected from this and other threats as they emerge across the threat landscape. There have been several large scale ransomware campaigns over the last several months. This appears to have some similarities to Nyetya in that it is also based on Petya ransomware. Major portions of the code appear to have been rewritten. The distribution does not appear to have the sophistication of the supply chain attacks we have seen recently.", "meta": { "encryption": "AES+RSA", "payment-method": "Bitcoin", "price": "0.05 (300 $)", "ransomnotes": [ "https://www.welivesecurity.com/wp-content/uploads/2017/10/mbr_cut.png" ], "refs": [ "http://blog.talosintelligence.com/2017/10/bad-rabbit.html", "https://id-ransomware.blogspot.com/2017/10/badrabbit-ransomware.html", "https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/", "https://securelist.com/bad-rabbit-ransomware/82851/", "http://www.intezer.com/notpetya-returns-bad-rabbit/" ], "synonyms": [ "BadRabbit", "Bad-Rabbit" ] }, "related": [ { "dest-uuid": "6f736038-4f74-435b-8904-6870ee0e23ba", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00c31914-bc0e-11e8-8241-3ff3b5e4671d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "e8af6388-6575-4812-94a8-9df1567294c5", "value": "Bad Rabbit" }, { "description": "A malware author by the name of Luc1F3R is peddling a new ransomware strain called Halloware for the lowly price of $40. Based on evidence gathered by Bleeping Computer, Luc1F3R started selling his ransomware this week, beginning Thursday.", "meta": { "extensions": [ "(Lucifer) [prepend]" ], "payment-method": "Bitcoin", "price": "150 $", "refs": [ "https://www.bleepingcomputer.com/news/security/halloware-ransomware-on-sale-on-the-dark-web-for-only-40/", "http://id-ransomware.blogspot.com/2017/11/halloware-ransomware.html" ] }, "uuid": "b366627d-dbc0-45ba-90bc-5f5694f45e35", "value": "Halloware" }, { "description": "Recently BleepingComputer has received a flurry of support requests for a new ransomware being named StorageCrypt that is targeting NAS devices such as the Western Digital My Cloud. Victims have been reporting that their files have been encrypted and a note left with a ransom demand of between .4 and 2 bitcoins to get their files back. User's have also reported that each share on their NAS device contains a Autorun.inf file and a Windows executable named 美女与野兽.exe, which translates to Beauty and the beast. From the samples BleepingComputer has received, this Autorun.inf is an attempt to spread the 美女与野兽.exe file to other computers that open the folders on the NAS devices.", "meta": { "extensions": [ ".locked" ], "payment-method": "Bitcoin", "price": "0.2 - 0.4 - 2", "ransomnotes": [ "Warning\n\nYour documents, photos,databases,important files have been encrypted by RSA-4096 and AES-256!\nIf you modify any file, it may cause make you cannot decrypt!!!\n\nDon't waste your precious time to try decrypt the files.\nIf there is no key that we provide to you , NO ONE can decrypt your precious files, even Jesus.\n\nHow to decrypt your files ?\n\nYou have to pay for decryption in bitcoin\nTo decrypt your files,please following the steps below\n\n1,Pay 2.0 bitcoin to this address: [bitcoin_address]\n\nPay To : [bitcoin_address]\nAmount : 2.0\n\n2,After you have finished paying,Contact us and Send us your Decrypt-ID via email\n\n3,Once we have confimed your deal,You can use the tool we sent to you to decrypt all your files.\n\nHow to obtain bitcoin ?\n\nThe easiest way to buy bitcoin is LocalBitcoins site.\nYou have to register, click Buy bitcoins and select the seller\nby payment method and price\n\nhttps://localbitcoins.com/buy_bitcoins\n\nhttps://paxful.com/buy-bitcoin\n\nhttp://bitcointalk.org/\n\n If you have any questions please do not hesitate to contact us\n\nContact Email:JeanRenoAParis@protonmail.com\n\nDecrypt-ID:" ], "ransomnotes-filenames": [ "_READ_ME_FOR_DECRYPT.txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/storagecrypt-ransomware-infecting-nas-devices-using-sambacry/", "https://id-ransomware.blogspot.com/2017/11/storagecrypter.html" ] }, "uuid": "0b920d03-971f-413c-8057-60d187192140", "value": "StorageCrypt" }, { "description": "A new ransomware called HC7 is infecting victims by hacking into Windows computers that are running publicly accessible Remote Desktop services. Once the developers gain access to the hacked computer, the HC7 ransomware is then installed on all accessible computers on the network.\nOriginally released as HC6, victims began posting about it in the BleepingComputer forums towards the end of November. As this is a Python-to-exe executable, once the script was extracted ID Ransomware creator Michael Gillespie was able determine that it was decryptable and released a decryptor.\nUnfortunately, a few days later, the ransomware developers released a new version called HC7 that was not decryptable. Thi sis because they removed the hard coded encryption key and instead switched to inputting the key as a command line argument when the attackers run the ransomware executable. Thankfully, there may be a way to get around that as well so that victims can recover their keys.", "meta": { "extensions": [ ".GOTYA" ], "payment-method": "Bitcoin", "price": "500 - 700 $", "ransomnotes": [ "ALL YOUR FILES WERE ENCRYPTED.\nTO RESTORE THIS FILE, YOU MUST SEND $700 BTC for MASCHINE\nOR $5,000 BTC FOR ALL NETWORK\nADDRESS: 15aM71TGtRZRrY97vdGcDEZeJYBWZhf4FP\nAFTER PAYMENT SENT EMAIL m4zn0v@keemail.me\nALONG WITH YOUR IDENTITY: VVNFUi1QQzA5\nNOT TO TURN OFF YOUR COMPUTER, UNLESS IT WILL BREAK" ], "ransomnotes-filenames": [ "RECOVERY.txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/hc7-gotya-ransomware-installed-via-remote-desktop-services-spread-with-psexec/", "https://id-ransomware.blogspot.com/2017/12/hc7-ransomware.html" ] }, "uuid": "9325e097-9fea-490c-9b89-c2d40c166101", "value": "HC7" }, { "description": "Predecessor of HC7", "meta": { "extensions": [ ".fucku" ], "payment-method": "Bitcoin", "price": "2 500 $", "refs": [ "https://twitter.com/demonslay335/status/935622942737817601?ref_src=twsrc%5Etfw", "https://www.bleepingcomputer.com/news/security/hc7-gotya-ransomware-installed-via-remote-desktop-services-spread-with-psexec/", "http://id-ransomware.blogspot.com/2017/11/hc6-ransomware.html" ] }, "uuid": "909fde65-e015-40a9-9012-8d3ef62bba53", "value": "HC6" }, { "description": "Security researchers have discovered a new ransomware strain named qkG that targets only Office documents for encryption and infects the Word default document template to propagate to new Word documents opened through the same Office suite on the same computer.", "meta": { "payment-method": "Bitcoin", "price": "300 $", "refs": [ "https://www.bleepingcomputer.com/news/security/qkg-ransomware-encrypts-only-word-documents-hides-and-spreads-via-macros/", "http://id-ransomware.blogspot.com/2017/11/qkg-ransomware.html" ], "synonyms": [ "QkG" ] }, "uuid": "1f3eab7f-da0a-4e0b-8a9f-cda2f146c819", "value": "qkG" }, { "description": "The Scarab ransomware is a relatively new ransomware strain that was first spotted by security researcher Michael Gillespie in June this year.\nWritten in Delphi, the first version was simplistic and was recognizable via the \".scarab\" extension it appended after the names of encrypted files.\nMalwarebytes researcher Marcelo Rivera spotted a second version in July that used the \".scorpio\" extension. The version spotted with the Necurs spam today has reverted back to using the .scarab extension.\nThe current version of Scarab encrypts files but does not change original file names as previous versions. This Scarab version appends each file's name with the \".[suupport@protonmail.com].scarab\" extension.\nScarab also deletes shadow volume copies and drops a ransom note named \"IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT\" on users' computers, which it opens immediately.", "meta": { "extensions": [ ".scarab", ".scorpio", ".[suupport@protonmail.com].scarab", ".fastrecovery@airmail.cc", ".files-xmail@cock.li.TXT", ".leen", ".qweuirtksd", ".mammon", ".omerta", ".bomber", ".CRYPTO", ".lolita", ".stevenseagal@airmail.cc", ".lol", ".crypted034", ".ironhead" ], "payment-method": "Bitcoin Email", "ransomnotes": [ "Attention: if you do not have money then you do not need to write to us!\nThe file is encrypted with the RSA-2048 algorithm, only we can decrypt the file.\n====================================================================================================\n fastrecovery@airmail.cc\n====================================================================================================\nYour files are encrypted!\nYour personal identifier:\n[redacted hex]\n====================================================================================================\nTo decrypt files, please contact us by email:\nfastrecovery@airmail.cc\n====================================================================================================\nThe file is encrypted with the RSA-2048 algorithm, only we can decrypt the file.\nAttention: if you do not have money then you do not need to write to us!", "Your files are now encrypted!\n\nYour personal identifier:\n[redacted hex]\n\nAll your files have been encrypted due to a security problem with your PC.\n\nNow you should send us email with your personal identifier.\nThis email will be as confirmation you are ready to pay for decryption key.\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us.\nAfter payment we will send you the decryption tool that will decrypt all your files.\n\nContact us using this email address: mr.leen@protonmail.com\n\nFree decryption as guarantee!\nBefore paying you can send us up to 3 files for free decryption.\nThe total size of files must be less than 10Mb (non archived), and files should not contain\nvaluable information (databases, backups, large excel sheets, etc.).\n\nHow to obtain Bitcoins?\n * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click\n 'Buy bitcoins', and select the seller by payment method and price:\n https://localbitcoins.com/buy_bitcoins\n * Also you can find other places to buy Bitcoins and beginners guide here:\n http://www.coindesk.com/information/how-can-i-buy-bitcoins\n\nAttention! \n * Do not rename encrypted files.\n * Do not try to decrypt your data using third party software, it may cause permanent data loss.\n * Decryption of your files with the help of third parties may cause increased price\n (they add their fee to our) or you can become a victim of a scam.", "Attention, all your files are encrypted with the AES cbc-128 algorithm!\n \nIt's not a virus like WannaCry and others, I hacked your computer,\nThe encryption key and bitcoin wallet are unique to your computer,\nso you are guaranteed to be able to return your files.\n \nBut before you pay, you can make sure that I can really decrypt any of your files.\n \nTo do this, send me several encrypted files to cyrill.fedor0v@yandex.com, a maximum of 5 megabytes each, I will decrypt them\nand I will send you back. No more than 5 files. Do not forget to send in the letter bitcoin address 1BhHZxek7iUTm1mdrgax6yVrPzViqLhr9u from this file.\n \nAfter that, pay the decryption in the amount of 500$ to the bitcoin address: 1BhHZxek7iUTm1mdrgax6yVrPzViqLhr9u\nAfter payment, send me a letter to cyrill.fedor0v@yandex.com with payment notification.\nOnce payment is confirmed, I will send you a decryption program.\n \nYou can pay bitcoins online in many ways:\nhttps://buy.blockexplorer.com/ - payment by bank card\nhttps://www.buybitcoinworldwide.com/\nhttps://localbitcoins.net\n \nAbout Bitcoins:\nhttps://en.wikipedia.org/wiki/Bitcoin\n\n If you have any questions, write to me at cyrill.fedor0v@yandex.com\n \nAs a bonus, I will tell you how hacked your computer is and how to protect it in the future." ], "ransomnotes-filenames": [ "IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT", "HOW TO RECOVER ENCRYPTED FILES-fastrecovery@airmail.cc.TXT", "HOW TO RECOVER ENCRYPTED FILES.TXT", "INSTRUCTIONS FOR RESTORING FILES.TXT", "!!!ReadMeToDecrypt.txt", "_How to restore files.TXT", "How to restore encrypted files.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/september/14/Scarab-ransomware.jpg", "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsnFZrGX4AE2H1c[1].jpg", "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/30/Ds8PMFpW0AIcYuJ[1].jpg", "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/7/DtzAAIAW0AEHC86[1].jpg", "https://pbs.twimg.com/media/DuC07vPWkAAMekP.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/scarab-ransomware-pushed-via-massive-spam-campaign/", "https://labsblog.f-secure.com/2017/11/23/necurs-business-is-booming-in-a-new-partnership-with-scarab-ransomware/", "https://blogs.forcepoint.com/security-labs/massive-email-campaign-spreads-scarab-ransomware", "https://twitter.com/malwrhunterteam/status/933643147766321152", "https://myonlinesecurity.co.uk/necurs-botnet-malspam-delivering-a-new-ransomware-via-fake-scanner-copier-messages/", "https://twitter.com/demonslay335/status/1006222754385924096", "https://twitter.com/demonslay335/status/1006908267862396928", "https://twitter.com/demonslay335/status/1007694117449682945", "https://twitter.com/demonslay335/status/1049316344183836672", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-12th-2018-notpetya-gandcrab-and-more/", "https://twitter.com/Amigo_A_/status/1039105453735784448", "https://twitter.com/GrujaRS/status/1072057088019496960", "http://id-ransomware.blogspot.com/2017/06/scarab-ransomware.html" ] }, "uuid": "cf8fbd03-4510-41cc-bec3-712fa7609aa4", "value": "Scarab" }, { "description": "A new ransomware called File Spider is being distributed through spam that targets victims in Bosnia and Herzegovina, Serbia, and Croatia. These spam emails contains malicious Word documents that will download and install the File Spider ransomware onto a victims computer.File Spider is currently being distributed through malspam that appears to be targeting countries such as Croatia, Bosnia and Herzegovina, and Serbia. The spam start with subjects like\"Potrazivanje dugovanja\", which translates to \"Debt Collection\" and whose message, according to Google Translate, appear to be in Serbian.", "meta": { "extensions": [ ".spider" ], "payment-method": "Bitcoin", "price": "0.00725", "ransomnotes": [ "As you may have already noticed, all your important files are encrypted and you no longer have access to them. A unique key has been generated specifically for this PC and two very strong encryption algorithm was applied in that process. Original content of your files are wiped and overwritten with encrypted data so it cannot be recovered using any conventional data recovery tool.\n\nThe good news is that there is still a chance to recover your files, you just need to have the right key.\n\nTo obtain the key, visit our website from the menu above. You have to be fast, after 96 hours the key will be blocked and all your files will remain permanently encrypted since no one will be able to recover them without the key!\n\nRemember, do not try anything stupid, the program has several security measures to delete all your files and cause the damage to your PC.\n\nTo avoid any misunderstanding, please read Help section." ], "ransomnotes-filenames": [ "HOW TO DECRYPT FILES.url" ], "refs": [ "https://www.bleepingcomputer.com/news/security/file-spider-ransomware-targeting-the-balkans-with-malspam/", "http://id-ransomware.blogspot.com/2017/12/file-spider-ransomware.html" ], "synonyms": [ "Spider" ] }, "uuid": "3e75ce6b-b6de-4e5a-9501-8f9f847c819c", "value": "File Spider" }, { "description": "A barely functional piece of macOS ransomware, written in Swift.", "meta": { "date": "Febuary 2017", "payment-method": "Bitcoin", "price": "0.25", "refs": [ "https://objective-see.com/blog/blog_0x25.html#FileCoder" ], "synonyms": [ "FindZip", "Patcher" ] }, "related": [ { "dest-uuid": "e211ea8d-5042-48ae-86c6-15186d1f8dba", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "bad1057c-4f92-4747-a0ec-31bcc062dab8", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "091c9923-5939-4bde-9db5-56abfb51f1a2", "value": "FileCoder" }, { "description": "A basic piece of macOS ransomware, offered via a 'malware-as-a-service' model.", "meta": { "date": "June 2017", "payment-method": "Bitcoin", "price": "0.25 (700 $)", "refs": [ "https://objective-see.com/blog/blog_0x25.html" ] }, "related": [ { "dest-uuid": "66862f1a-5823-4a9a-bd80-439aaafc1d8b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "7574c7f1-5075-4230-aca9-d6c0956f1fac", "value": "MacRansom" }, { "description": "A new ransomware called GandCrab was released towards the end of last week that is currently being distributed via exploit kits. GandCrab has some interesting features not seen before in a ransomware, such as being the first to accept the DASH currency and the first to utilize the Namecoin powered .BIT tld. ", "meta": { "date": "January 2018", "extensions": [ ".Crab", ".CRAB" ], "payment-method": "Dash", "price": "1 - 3", "ransomnotes": [ "---= GANDCRAB =---\n\nAttention!\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB \nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\nThe server with your key is in a closed network TOR. You can get there by the following ways:\n1. Download Tor browser - https://www.torproject.org/\n2. Install Tor browser\n3. Open Tor Browser\n4. Open link in tor browser:http://gdcbghvjyqy7jclk.onion/[id]\n5. Follow the instructions on this page\n\nIf Tor/Tor browser is locked in your country or you can not install it, open one of the following links in your regular browser:\n1. http://gdcbghvjyqy7jclk.onion.top/[id]\n2. http://gdcbghvjyqy7jclk.onion.casa/[id]\n3. http://gdcbghvjyqy7jclk.onion.guide/[id]\n4. http://gdcbghvjyqy7jclk.onion.rip/[id]\n5. http://gdcbghvjyqy7jclk.onion.plus/[id]\n\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\n\nDANGEROUS!\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!", "---= GANDCRAB =---\nAttention!\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.\nThe server with your key is in a closed network TOR. You can get there by the following ways:\n1. Download Tor browser - https://www.torproject.org/\n2. Install Tor browser\n3. Open Tor Browser\n4. Open link in tor browser: http://gdcbmuveqjsli57x.onion/[id]\n5. Follow the instructions on this page\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free.\nIf you can't download TOR and use it, or in your country TOR blocked, read it:\n1. Visit https://tox.chat/download.html\n2. Download and install qTOX on your PC.\n3. Open it, click \"New Profile\" and create profile.\n4. Search our contact - 6C5AD4057E594E090E0C987B3089F74335DA75F04B7403E0575663C26134956917D193B195A5\n5. In message please write your ID and wait our answer: 6361f798c4ba3647\nDANGEROUS!\nDo not try to modify files or use your own private key - this will result in the loss of your data forever!", "ENCRYPTED BY GANDCRAB 3\n\nDEAR [user_name],\n\nYOUR FILES ARE UNDER STRONG PROTECTION BY OUR SOFTWARE. IN ORDER TO RESTORE IT YOU MUST BUY DECRYPTOR\n\nFor further steps read CRAB-DECRYPT.txt that is located in every encrypted folder.", " ---= GANDCRAB V3 =--- \n\nAttention! \n\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .CRAB \n\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files. \n\n\nThe server with your key is in a closed network TOR. You can get there by the following ways: \n\n0. Download Tor browser - https://www.torproject.org/ \n\n1. Install Tor browser \n\n2. Open Tor Browser \n\n3. Open link in TOR browser: http://gandcrab2pie73et.onion/[id] \n\n4. Follow the instructions on this page \n\nOn our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. \n\n\nThe alternative way to contact us is to use Jabber messanger. Read how to:\n0. Download Psi-Plus Jabber Client: https://psi-im.org/download/\n1. Register new account: http://sj.ms/register.php\n0) Enter \"username\": [id]\n1) Enter \"password\": your password\n2. Add new account in Psi\n3. Add and write Jabber ID: ransomware@sj.ms any message\n4. Follow instruction bot \n\nATTENTION!\nIt is a bot! It's fully automated artificial system without human control!\nTo contact us use TOR links. We can provide you all required proofs of decryption availibility anytime. We are open to conversations.\nYou can read instructions how to install and use jabber here http://www.sfu.ca/jabber/Psi_Jabber_PC.pdf \n\nCAUGHTION! \n\nDo not try to modify files or use your own private key. This will result in the loss of your data forever! " ], "ransomnotes-filenames": [ "GDCB-DECRYPT.txt", "CRAB-Decrypt.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/g/gandcrab/v3/desktop-background.jpg", "https://www.bleepstatic.com/images/news/security/f/fallout-exploit-kit/gandcrab-fallout.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-distributed-by-exploit-kits-appends-gdcb-extension/", "https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-being-distributed-via-malspam-disguised-as-receipts/", "https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-version-2-released-with-new-crab-extension-and-other-changes/", "https://www.bleepingcomputer.com/news/security/gandcrab-version-3-released-with-autorun-feature-and-desktop-background/", "https://www.bleepingcomputer.com/news/security/new-fallout-exploit-kit-drops-gandcrab-ransomware-or-redirects-to-pups/", "https://www.bleepingcomputer.com/news/security/gandcrab-v5-ransomware-utilizing-the-alpc-task-scheduler-exploit/", "https://id-ransomware.blogspot.com/2018/01/gandcrab-ransomware.html" ] }, "related": [ { "dest-uuid": "1f05f646-5af6-4a95-825b-164f49616aa4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "dropped-by" } ], "uuid": "5920464b-e093-4fa0-a275-438dffef228f", "value": "GandCrab" }, { "description": "Security researchers uncovered a new ransomware named ShurL0ckr (detected by Trend Micro as RANSOM_GOSHIFR.B) that reportedly bypasses detection mechanisms of cloud platforms. Like Cerber and Satan, ShurL0ckr’s operators further monetize the ransomware by peddling it as a turnkey service to fellow cybercriminals, allowing them to earn additional income through a commission from each victim who pays the ransom.", "meta": { "date": "Febuary 2018", "payment-method": "Bitcoin", "price": "0.01 - 0.1", "refs": [ "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/shurl0ckr-ransomware-as-a-service-peddled-on-dark-web-can-reportedly-bypass-cloud-applications" ] }, "uuid": "cc7f6da3-fafd-444f-b7e9-f0e650fb4d4f", "value": "ShurL0ckr" }, { "description": "ransomware", "meta": { "date": "January 2018", "extensions": [ ".fairytail" ], "payment-method": "Bitcoin", "refs": [ "https://sensorstechforum.com/fr/fairytail-files-virus-cryakl-ransomware-remove-restore-data/", "https://www.technologynews.tech/cryakl-ransomware-virus", "http://www.zdnet.com/article/cryakl-ransomware-decryption-keys-now-available-for-free/" ] }, "related": [ { "dest-uuid": "3c51fc0e-42d8-4ff0-b1bd-5c8c20271a39", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "32fa6c53-b4fc-47f8-894c-1ea74180e02f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "4f3e494e-0e37-4894-94b2-741a8100f07a", "value": "Cryakl" }, { "description": "first ransomware seen to ask for payment to be made in Bitcoin Cash (BCH)", "meta": { "extensions": [ ".THANATOS" ], "payment-method": "Bitcoin", "price": "0.1", "refs": [ "https://mobile.twitter.com/EclecticIQ/status/968478323889332226", "https://www.eclecticiq.com/resources/thanatos--ransomware-first-ransomware-ask-payment-bitcoin-cash?type=intel-report", "http://id-ransomware.blogspot.com/2018/02/thanatos-ransomware.html" ] }, "related": [ { "dest-uuid": "24fabbe0-27a2-4c93-a6a6-c14767efaa25", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "361d7a90-2fde-4fc7-91ed-fdce26eb790f", "value": "Thanatos" }, { "description": "RSAUtil is distributed by the developer hacking into remote desktop services and uploading a package of files. This package contains a variety of tools, a config file that determines how the ransomware executes, and the ransomware itself.", "meta": { "payment-method": "Bitcoin", "price": "750 $", "ransomnotes": [ "Hello... :)\nFor instructions on how to recovery the files, write to me:\njonskuper578@india.com\njonskuper578@gmx.de\njonskuper578@protonmail.com\nIn the letter, indicate your personal ID (see the file format).\nIf you have not received an answer, write to me again.", "WARNING!!!\nYour ID 83624883\nOUR FILES ARE DECRIPTED\nYour documents, photos, database, save games and other important data was encrypted.\nData recovery the necessary interpreter. To get the interpreter, should send an email to helppme@india.com or hepl1112@aol.com.\nIn a letter to include Your personal ID (see the beginning of this document).\nIn response to the letter You will receive the address of your Bitcoin wallet to which you want to perform the transfer.\nWhen money transfer is confirmed, You will receive the decrypter file for Your computer.\nAfter starting the programm-interpreter, all Your files will be restored.\nAttention! Do not attempt to remove a program or run the anti-virus tools.", "ПРЕДУПРЕЖДЕНИЕ!!!\nВаш ID 83624883\nOUR FILES ARE DECRIPTED\nЗашифрованы ваши документы, фотографии, база данных, сохранения игр и другие важные данные.\nВосстановить данные нужен интерпретатор. Для получения интерпретатора надо отправить email на helppme@india.com или hepl1112@aol.com.\nВ письме укажите Ваш личный ID (см. начало этого документа).\nВ ответ на письмо Вы получите адрес вашего биткойн-кошелька, на который Вы хотите сделать перевод.\nКогда денежный перевод будет подтвержден, вы получите файл-декриптер для Вашего компьютера.\nПосле запуска программы-интерпретатора все Ваши файлы будут восстановлены.\nВнимание! Не пытайтесь удалить программу или запустить антивирусные программы.", "Hello…\nFor instructions on how to recovery the files, write to me:\nvine77725@gmx.de\nvine77725@india.com\nvine77725@protonmail.com\nIn the letter, indicate your personal ID (see the file format).\nIf you have not received an answer, write to me again.", "Привет мой друг!\nВсе файлы на твоем ПК зашифрованы!\nМой email: helppme@india.com или\nhepl1112@aol.com", "Hello my friend!\nAll files on your PC encryphted!\nmy email: helppme@india.com or\nhepl1112@aol.com" ], "ransomnotes-filenames": [ "How_return_files.txt", "Image.jpg" ], "ransomnotes-refs": [ "https://4.bp.blogspot.com/-6jE-GW6wCr8/WQY1L_uHsFI/AAAAAAAAE-A/3YR0bwwBJqgp8CsApZq4F_44JkMB0m2WwCLcB/s320/image-note.jpg", "https://2.bp.blogspot.com/-T4lvnNISc_A/WQY1SI1r1mI/AAAAAAAAE-E/tH7p02nS2LUTvXmq66poiyM1RYhHc4HbwCLcB/s200/lock-note.jpg" ], "refs": [ "https://www.securityweek.com/rsautil-ransomware-distributed-rdp-attacks", "https://www.bleepingcomputer.com/news/security/rsautil-ransomware-helppme-india-com-installed-via-hacked-remote-desktop-services/", "http://id-ransomware.blogspot.lu/2017/04/rsautil-ransomware.html", "http://id-ransomware.blogspot.lu/2017/04/" ], "synonyms": [ "Vagger", "DONTSLIP" ] }, "uuid": "f80b0a42-21ef-11e8-8ac7-0317408794e2", "value": "RSAUtil" }, { "description": "A new ransomware has been discovered that utilizes the legitimate GnuPG, or GPG, encryption program to encrypt a victim's files. Currently in the wild, this ransomware is called Qwerty Ransomware and will encrypt a victims files, overwrite the originals, and the append the .qwerty extension to an encrypted file's name.", "meta": { "payment-method": "Bitcoin", "ransomnotes": [ "Your computer is encrypted . Mail cryz1@protonmail.com . Send your ID 5612.\nNote! You have only 72 hours for write on e-mail (see below) or all your files will be lost!" ], "ransomnotes-filenames": [ "README_DECRYPT.txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/qwerty-ransomware-utilizes-gnupg-to-encrypt-a-victims-files/" ] }, "uuid": "15c370c0-2799-11e8-a959-57cdcd57e3bf", "value": "Qwerty Ransomware" }, { "description": "A new ransomware was discovered this week by MalwareHunterTeam called Zenis Ransomware. While it is currently unknown how Zenis is being distributed, multiple victims have already become infected with this ransomware. What is most disturbing about Zenis is that it not encrypts your files, but also purposely deletes your backups.", "meta": { "payment-method": "Bitcoin Email (Tor)", "ransomnotes": [ "*** All your files has been encrypted ***\n\nI am ZENIS. A mischievous boy who loves cryptography, hardware and programming. My world is full of unanswered questions and puzzles half and half, and I'm coming to discover a new world. A world in digital space that you are supposed to play the role of my toys.\n\nIf you want to win in this game, you have to listen carefully to my instructions, otherwise you will be caught up in a one-step game and you will become the main loser of the story.\n\nMy instructions are simple and clear. Then follow these steps:\n\n1. Send this file (Zenis-Instructions.html) to my email with one your encrypted file less than 2 MB to trust to the game.\n\n2. I decrypt your file for free and send for you.\n\n3. If you confirm the correctness of the files, verify that the files are correct via email\n\n4. Then receive the price of decrypting files\n\n5. After you have deposited, please send me the payment details\n\n6. After i confirm deposit, i send you the \"Zenis Decryptor\" along with \"Private Key\" to recovery all your files.\n\nNow you can finish the game. You won the game. congratulations.\n\n\nPlease submit your request to both emails:\n\nTheZenis@Tutanota.com\n\nTheZenis@MailFence.com\n\nIf you did not receive an email after six hours, submit your request to the following emails:\n\nTheZenis@Protonmail.com\n\nTheZenis@Mail2Tor.com (On the TOR network)\n\n\nWarning: 3rd party and public programs, It may cause irreversible damage to your files. And your files will be lost forever." ], "ransomnotes-filenames": [ "Zenis-Instructions.html" ], "refs": [ "https://www.bleepingcomputer.com/news/security/zenis-ransomware-encrypts-your-data-and-deletes-your-backups/", "https://id-ransomware.blogspot.com/2018/03/zenis-ransomware.html" ] }, "uuid": "cbe3ee70-2d11-11e8-84bb-9b3c525a48d9", "value": "Zenis Ransomware" }, { "meta": { "payment-method": "Dollars", "price": "199", "refs": [ "https://www.bleepingcomputer.com/news/security/author-of-polski-vortex-and-flotera-ransomware-families-arrested-in-poland/", "http://id-ransomware.blogspot.com/2017/03/flotera-ransomware.html" ] }, "uuid": "aab356ac-396c-11e8-90c8-631229f19d7a", "value": "Flotera Ransomware" }, { "description": "A new ransomware was discovered this week by MalwareHunterTeam called Black Ruby. This ransomware will encrypt the files on a computer, scramble the file name, and then append the BlackRuby extension. To make matters worse, Black Ruby will also install a Monero miner on the computer that utilizes as much of the CPU as it can. Discovered on February 6, 2018. May have been distributed through unknown vectors. Will not encrypt a machine if its IP address is identified as coming from Iran; this feature enables actors to avoid a particular Iranian cybercrime law that prohibits Iran-based actors from attacking Iranian victims. Encrypts files on the infected machine, scrambles files, and appends the .BlackRuby extension to them. Installs a Monero miner on the infected computer that utilizes the machine’s maximum CPU power. Delivers a ransom note in English asking for US$650 in Bitcoins. Might be installed via Remote Desktop Services.", "meta": { "extensions": [ ".BlackRuby" ], "payment-method": "Monero miner on the computer", "ransomnotes": [ " ____ __ __ ____ __\n / __ ) / /____ _ _____ / /__ / __ \\ __ __ / /_ __ __\n / __ |/ // __ `// ___// //_/ / /_/ // / / // __ \\ / / / /\n / /_/ // // /_/ // /__ / ,< / _, _// /_/ // /_/ // /_/ /\n /_____//_/ \\__,_/ \\___//_/|_| /_/ |_| \\__,_//_.___/ \\__, /\n /____/\n\n===================== Identification Key =====================\n\n[id]\n\n===================== Identification Key =====================\n\n[Can not access your files?]\n\nCongratulations, you are now part of our family #BlackRuby Ransomware. The range of this family is wider and bigger every day.\nOur hosts welcome our presence because we will give them a scant souvenir from the heart of Earth.\n\nThis time, we are guest with a new souvenir called \"Black Ruby\". A ruby ​​in black, different, beautiful, and brilliant, which has been bothered to extract those years and you must also endure this hard work to keep it. If you do not have the patience of this difficulty or you hate some of this precious stone, we are willing to receive the price years of mining and finding rubies for your relief and other people of the world who are guests of the black ruby.\n\nSo let's talk a little bit with you without a metaphor and literary terms to understand the importance of the subject.\nIt does not matter if you're a small business or you manage a large organization, no matter whether you are a regular user or a committed employee, it's important that you have a black ruby and to get rid of it, you need to get back to previous situation and we need a next step.\n\nThe breadth of this family is not supposed to stop, because we have enough knowledge and you also trust our knowledge.\nWe are always your backers and guardian of your information at this multi-day banquet and be sure that no one in the world can take it from you except for us who extracts this precious stone. We need a two-sided cooperation in developing cybersecurity knowledge. The background to this cooperation is a mutual trust, which will result in peace and tranquility. you must pay $650 (USD) worth of Bitcoins for restore your system to the previous state and you are free to choose to stay in this situation or return to the normal.\n\nDo not forget that your opportunity is limited. From these limits you can create golden situations. Be sure we will help you in this way and to know that having a black ruby does not always mean riches. You and your system are poor, poor knowledge of cybersecurity and lack of security on your system!.\n\n ========================================================================================================================\n\n [HOW TO DECRYPT FILES]\n\n 1. Copy \"Identification Key\".\n 2. Send this key with two encrypted files (less than 5 MB) for trust us to email address \"TheBlackRuby@Protonmail.com\".\n 3. We decrypt your two files and send them to your email.\n 4. After ensuring the integrity of the files, you must pay $650 (USD) with bitcoin and send transaction code to our email, our bitcoin address is \"19S7k3zHphKiYr85T25FnqdxizHcgmjoj1\".\n 5. You get \"Black Ruby Decryptor\" Along with the private key of your system.\n 6. Everything returns to the normal and your files will bereleased.\n\n========================================================================================================================\n\n[What is encryption?]\n\nEncryption is a reversible modification of information for security reasons but providing full access to it for authorised users.\n To become an authorised user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an \"Personal Identification Key\". But not only it. It is required also to have the special decryption software\n(in your case “Black Ruby Decryptor” software) for safe and complete decryption of all your files and data.\n\n[Everything is clear for me but what should I do?]\n\n The first step is reading these instructions to the end. Your files have been encrypted with the “Black Ruby Ransomware” software; the instructions (“HOW-TO-DECRYPT-FILES.txt”) in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the “Black Ruby Ransomware” where they find a lot of ideas, recommendation and instructions. It is necessary to realise that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them.\n\n[Have you got advice?]\n\n[*** Any attempts to get back you files with the third-party tools can be fatal for your encrypted files ***]\nThe most part of the tried-party software change data with the encrypted files to restore it but this cases damage to the files. \nFinally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realise that any intervention of the third-party software to restore files encrypted with the “Black Ruby Ransomware” software may be fatal for your files.\n\nIf you look through this text in the Internet and realise that something is wrong with your files but you do not have any instructions to restore your files, please contact your antivirus support." ], "ransomnotes-filenames": [ "HOW-TO-DECRYPT-FILES.txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/black-ruby-ransomware-skips-victims-in-iran-and-adds-a-miner-for-good-measure/", "https://www.accenture.com/t20180803T064557Z__w__/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf" ], "synonyms": [ "BlackRuby" ] }, "uuid": "abf3001c-396c-11e8-8da6-ef501eef12e1", "value": "Black Ruby" }, { "description": "A new ransomware has been discovered by MalwareHunterTeam that is based off of the InfiniteTear ransomware family, of which BlackRuby and Zenis are members. When this ransomware infects a computer it will encrypt the files, scramble the filenames, and append the .WHITEROSE extension to them.", "meta": { "extensions": [ ".WHITEROSE", "_ENCRYPTED_BY.WHITEROSE" ], "payment-method": "Website Tor", "ransomnotes": [ "[Rose ASCII art]\n\n[WhiteRose written in ASCII art]\n\nThe singing of the sparrows, the breezes of the northern mountains and smell of the earth that was raining in the morning filled the entire garden space. I'm sitting on a wooden chair next to a bush tree, I have a readable book in my hands and I am sweating my spring with a cup of bitter coffee. Today is a different day.\n\nBehind me is an empty house of dreams and in front of me, full of beautiful white roses. To my left is an empty blue pool of red fish and my right, trees full of spring white blooms.\n\n I drink coffee, I'll continue to read a book from William Faulkner. In the garden environment, peace and quiet. My life always goes that way. Always alone without even an intimate friend.\n\nI have neither a pet, nor a friend or an enemy; I am a normal person with fantastic wishes among the hordes of white rose flowers. Everything is natural. I'm just a little interested in hacking and programming. My only electronic devices in this big garden are an old laptop for do projects and an iPhone for check out the news feeds for malware analytics on Twitter without likes posts.\n\nBelieve me, my only assets are the white roses of this garden. I think of days and write at night: the story, poem, code, exploit or the accumulation of the number of white roses sold and I say to myself that the wealth is having different friends of different races, languages, habits and religions, Not only being in a fairly stylish garden with full of original white roses.\n\nToday, I think deeply about the decision that has involved my mind for several weeks. A decision to freedom and at the worth of unity, intimacy, joy and love and is the decision to release white roses and to give gifts to all peoples of the world.\n\nI do not think about selling white roses again. This time, I will plant all the white roses of the garden to bring a different gift for the people of each country. No matter where is my garden and where I am from, no matter if you are a housekeeper or a big company owner, it does not matter if you are the west of the world or its east, it's important that the white roses are endless and infinite. You do not need to send letters or e-mails to get these roses. Just wait it tomorrow. Wait for good days with White Rose.\n\nI hope you accept this gift from me and if it reaches you, close your eyes and place yourself in a large garden on a wooden chair and feel this beautiful scene to reduce your anxiety and everyday tension.\n\nThank you for trusting me. Now open your eyes. Your system has a flower like a small garden; A white rose flower.\n\n/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n\n[Recovery Instructions]\n\n I. Download qTox on your computer from [https://tox.chat/download.html]\nII. Create new profile then enter our ID in search contacts\n Our Tox ID: \"6F548F217897AA4140FB4C514C8187F2FFDBA3CAFC83795DEE2FBCA369E689006B7CED4A18E9\". III. Wait for us to accept your request.\nIV. Copy '[PersonalKey]' in \"HOW-TO-RECOVERY-FILES.TXT\" file and send this key with one encrypted file less size then 2MB for trust us in our Tox chat.\n IV.I. Only if you did not receive a reply after 24 hours from us, send your message to our secure tor email address \"TheWhiteRose@Torbox3uiot6wchz.onion\".\n IV.II. For perform \"Step IV.I\" and enter the TOR network, you must download tor and register in \"http://torbox3uiot6wchz.onion\" Mail Service)\nV. We decrypt your two files and we will send you.\nVI. After ensuring the integrity of the files, We will send you payment info.\nVII. Now after payment, you get \"WhiteRose Decryptor\" Along with the private key of your system.\nVIII.Everything returns to the normal and your files will be released.\n\n/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n\nWhat is encryption?\n\n In cryptography, encryption is the process of encoding a message or information in such a way that only authorized parties can access it, and those who are not authorized cannot. Encryption does not itself prevent interference, but denies the intelligible content to a would-be interceptor. In an encryption scheme, the intended information or message, referred to as plaintext, is encrypted using an encryption algorithm – a cipher – generating ciphertext that can be read only if decrypted. For technical reasons, an encryption scheme usually uses a pseudo-random encryption key generated by an algorithm. It is in principle possible to decrypt the message without possessing the key, but, for a well-designed encryption scheme, considerable computational resources and skills are required. An authorized recipient can easily decrypt the message with the key provided by the originator to recipients but not to unauthorized users. in your case “WhiteRose Decryptor” software for safe and complete decryption of all your files and data.\n\nAny other way?\n\nIf you look through this text in the Internet and realise that something is wrong with your files but you do not have any instructions to restore your files, please contact your antivirus support." ], "ransomnotes-filenames": [ "HOW-TO-RECOVERY-FILES.TXT" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-whiterose-ransomware-is-decryptable-and-tells-a-strange-story/", "http://id-ransomware.blogspot.com/2018/03/whiterose-ransomware.html" ] }, "uuid": "abc80362-396c-11e8-bc5c-8bca89c0f797", "value": "WhiteRose" }, { "description": "In what could only be a joke, a new ransomware has been discovered called \"PUBG Ransomware\" that will decrypt your files if you play the game called PlayerUnknown's Battlegrounds. Discovered by MalwareHunterTeam, when the PUBG Ransomware is launched it will encrypt a user's files and folders on the user's desktop and append the .PUBG extension to them. When it has finished encrypting the files, it will display a screen giving you two methods that you can use to decrypt the encrypted files.", "meta": { "extensions": [ ".PUBG" ], "payment-method": "Game", "price": "Play to decrypt", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/p/pubg-ransomware/pubg-ransomware.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/pubg-ransomware-decrypts-your-files-if-you-play-playerunknowns-battlegrounds/", "https://id-ransomware.blogspot.com/2018/04/pubg-ransomware.html" ] }, "uuid": "2239b3ca-3c9b-11e8-873e-53608d51ee71", "value": "PUBG Ransomware" }, { "description": "LockCrypt is an example of yet another simple ransomware created and used by unsophisticated attackers. Its authors ignored well-known guidelines about the proper use of cryptography. The internal structure of the application is also unprofessional. Sloppy, unprofessional code is pretty commonplace when ransomware is created for manual distribution. Authors don’t take much time preparing the attack or the payload. Instead, they’re rather focused on a fast and easy gain, rather than on creating something for the long run. Because of this, they could easily be defeated.", "meta": { "extensions": [ ".BadNews" ], "payment-method": "Bitcoin", "price": "0.5 - 1", "ransomnotes-filenames": [ "How To Decode Files.hta" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/DlsLwUjXsAA0xyY[1].jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/lockcrypt-ransomware-cracked-due-to-bad-crypto/", "https://twitter.com/malwrhunterteam/status/1034436350748053504", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/", "http://id-ransomware.blogspot.com/2017/06/lockcrypt-ransomware.html" ] }, "uuid": "ac070e9a-3cbe-11e8-9f9d-839e888f2340", "value": "LockCrypt" }, { "description": "Magniber is a new ransomware being distributed by the Magnitude Exploit Kit that appears to be the successor to the Cerber Ransomware. While many aspects of the Magniber Ransomware are different than Cerber, the payment system and the files it encrypts are very similar.", "meta": { "extensions": [ ".ihsdj", ".kgpvwnr", ".ndpyhss" ], "payment-method": "Bitcoin", "price": "0.2", "ransomnotes": [ " ALL Y0UR D0CUMENTS, PHOTOS, DATABASES AND OTHER IMP0RTANT FILES HAVE BEEN ENCRYPTED!\n ====================================================================================================\n Your files are NOT damaged! Your files are modified only. This modification is reversible.\n\n The only 1 way to decrypt your files is to receive the private key and decryption program.\n\n Any attempts to restore your files with the third-party software will be fatal for your files!\n ====================================================================================================\n To receive the private key and decryption program follow the instructions below:\n\n 1. Download \"Tor Browser\" from https://www.torproject.org/ and install it.\n\n 2. In the \"Tor Browser\" open your personal page here:\n\n\n http://[victim_id].ofotqrmsrdc6c3rz.onion/EP866p5M93wDS513\n\n\n Note! This page is available via \"Tor Browser\" only.\n ====================================================================================================\n Also you can use temporary addresses on your personal page without using \"Tor Browser\":\n\n\n http://[victim_id].bankme.date/EP866p5M93wDS513\n\n http://[victim_id].jobsnot.services/EP866p5M93wDS513\n\n http://[victim_id].carefit.agency/EP866p5M93wDS513\n\n http://[victim_id].hotdisk.world/EP866p5M93wDS513\n\n\n Note! These are temporary addresses! They will be available for a limited amount of time!" ], "ransomnotes-filenames": [ "READ_ME_FOR_DECRYPT_[id].txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/decrypters-for-some-versions-of-magniber-ransomware-released/", "https://www.bleepingcomputer.com/news/security/goodbye-cerber-hello-magniber-ransomware/", "https://twitter.com/demonslay335/status/1005133410501787648", "http://id-ransomware.blogspot.com/2017/10/my-decryptor-ransomware.html" ] }, "uuid": "a0c1790a-3ee7-11e8-9774-93351d675a9e", "value": "Magniber Ransomware" }, { "meta": { "extensions": [ ".improved" ], "payment-method": "Bitcoin", "price": "10 000 $", "ransomnotes": [ "UNCRYPT.README" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/april/6/vurten.jpg" ], "refs": [ "https://twitter.com/siri_urz/status/981191281195044867", "http://id-ransomware.blogspot.com/2018/04/vurten-ransomware.html" ] }, "uuid": "7666e948-3f09-11e8-b0b2-af79c067d856", "value": "Vurten" }, { "description": "A ransomware family that targets users from certain countries or regions. It locks the computer and displays a location-specific webpage that covers the desktop and demands that the user pay a fine for the supposed possession of illicit material. The Reveton ransomware is one of the first screen-locking ransomware strains, and it appeared when Bitcoin was still in its infancy, and before it became the cryptocurrency of choice in all ransomware operations. Instead, Reveton operators asked victims to buy GreenDot MoneyPak vouchers, take the code on the voucher and enter it in the Reveton screen locker.", "meta": { "payment-method": "Bitcoin", "price": "200 $", "refs": [ "https://www.bleepingcomputer.com/news/security/microsoft-engineer-charged-in-reveton-ransomware-case/", "https://en.wikipedia.org/wiki/Ransomware#Reveton", "https://nakedsecurity.sophos.com/2012/08/29/reveton-ransomware-exposed-explained-and-eliminated/" ] }, "uuid": "1912ec68-4145-11e8-ac06-9b6643035a71", "value": "Reveton ransomware" }, { "description": "Fusob is one of the major mobile ransomware families. Between April 2015 and March 2016, about 56 percent of accounted mobile ransomware was Fusob.\nLike a typical mobile ransomware, it employs scare tactics to extort people to pay a ransom. The program pretends to be an accusatory authority, demanding the victim to pay a fine from $100 to $200 USD or otherwise face a fictitious charge. Rather surprisingly, Fusob suggests using iTunes gift cards for payment. Also, a timer clicking down on the screen adds to the users’ anxiety as well.\nIn order to infect devices, Fusob masquerades as a pornographic video player. Thus, victims, thinking it is harmless, unwittingly download Fusob.\nWhen Fusob is installed, it first checks the language used in the device. If it uses Russian or certain Eastern European languages, Fusob does nothing. Otherwise, it proceeds on to lock the device and demand ransom. Among victims, about 40% of them are in Germany with the United Kingdom and the United States following with 14.5% and 11.4% respectively.\nFusob has lots in common with Small, which is another major family of mobile ransomware. They represented over 93% of mobile ransomwares between 2015 and 2016.", "meta": { "payment-method": "Bitcoin", "price": "100 - 200 $", "refs": [ "https://en.wikipedia.org/wiki/Ransomware#Fusob" ] }, "uuid": "c921d9ac-4145-11e8-965b-df5002d4cad8", "value": "Fusob" }, { "meta": { "extensions": [ ".FUCK" ], "ransomnotes": [ "What Happened to My Computer?\nYour important files are encrypted.\nMany of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service.\n\nCan I Recover My Files?\nSure. We guarantee that you can recover all your files safely and easily. But you have not so enough time.\nBut if you want to decrypt all your files, you need to pay.\n\nHow Do I Pay?\nPayment is accepted in Bitcoin only.\nPlease check the current price of Bitcoin and buy some bitcoins.\nAnd send the correct amount to the address specified in this window.\n\nWe strongly recommend you to not remove this software, and disable your anti-virus for a while, until you pay and the payment gets processed. If your anti-virus gets updated and removes this software automatically, it will not be able to recover your files even if you pay!\nOnce the payment is sent, send us an e-mail to the specified address specifying your \"Client ID\", you will be sent your decryption key in return.\nHow to buy Bitcoins?\n\nStep 1 : Create a portfolio on the Blockchain website at the address : https://blockchain.info/fr/wallet/#/signup\nStep 2 : Sign in to your account you just created and purchase the amount shown : https://blockchain.info/wallet/#/buy-sell\n Step 3 : Send the amount to the indicated Bitcoin address, once this is done send us an email with your \"Client ID\" you can retreive this in the file \"instruction.txt\" or \"Whats Appens With My File.s.txt\" in order to ask us the key of decryption of your data.\n\nContact us at : spaghetih@protonmail.com\nSend 20$ to Bitcoin at 1MFA4PEuDoe2UCKgabrwm8P4KztASKtiuv if you want decrypt your files !\nYour Client ID is : [id]" ], "ransomnotes-refs": [ "https://pastebin.com/xkRaRytW" ], "refs": [ "https://twitter.com/demonslay335/status/981270787905720320" ] }, "uuid": "b0ce2b90-4171-11e8-af82-0f4431fd2726", "value": "OXAR" }, { "meta": { "payment-method": "Bitcoin", "price": "100 $", "refs": [ "http://id-ransomware.blogspot.com/2018/03/bansomqarewanna-ransomware.html" ] }, "uuid": "b95a76d8-4171-11e8-b9b3-1bf62ec3265e", "value": "BansomQare Manna Ransomware" }, { "uuid": "60e79876-4178-11e8-8c04-63662c94ba03", "value": "Haxerboi Ransomware" }, { "meta": { "payment-method": "Bitcoin Email", "refs": [ "https://twitter.com/malwrhunterteam/status/982229994364547073", "http://id-ransomware.blogspot.com/2018/04/skyfile-ransomware.html" ] }, "uuid": "b4654c94-417a-11e8-8c2c-5b5748496f92", "value": "SkyFile" }, { "description": "Supposed joke ransomware, decrypt when running an exectable with the string \"Minecraft\"", "meta": { "payment-method": "Game", "refs": [ "https://www.bleepingcomputer.com/news/security/minecraft-and-cs-go-ransomware-strive-for-media-attention/" ] }, "uuid": "443c55c6-43d1-11e8-9072-6fdcf89aa4e6", "value": "MC Ransomware" }, { "description": "Supposed joke ransomware, decrypt when running an exectable with the string \"csgo\"", "meta": { "payment-method": "Game", "price": "Play during 5 hours", "refs": [ "https://www.bleepingcomputer.com/news/security/minecraft-and-cs-go-ransomware-strive-for-media-attention/" ] }, "uuid": "449e18b0-43d1-11e8-847e-0fed641732a1", "value": "CSGO Ransomware" }, { "meta": { "extensions": [ ".Encrypted[BaYuCheng@yeah.net].XiaBa", ".XiaoBa1", ".XiaoBa2", ".XiaoBa3", ".XiaoBa4", ".XiaoBa5", ".XiaoBa6", ".XiaoBa7", ".XiaoBa8", ".XiaoBa9", ".XiaoBa10", ".XiaoBa11", ".XiaoBa12", ".XiaoBa13", ".XiaoBa14", ".XiaoBa15", ".XiaoBa16", ".XiaoBa17", ".XiaoBa18", ".XiaoBa19", ".XiaoBa20", ".XiaoBa21", ".XiaoBa22", ".XiaoBa23", ".XiaoBa24", ".XiaoBa25", ".XiaoBa26", ".XiaoBa27", ".XiaoBa28", ".XiaoBa29", ".XiaoBa30", ".XiaoBa31", ".XiaoBa32", ".XiaoBa33", ".XiaoBa34", ".AdolfHitler" ], "payment-method": "Bitcoin", "price": "1 200 yuan (180,81 $)", "ransomnotes-filenames": [ "_@XiaoBa@_.bmp", "_@Explanation@_.hta", "_XiaoBa_Info_.hta", "_XiaoBa_Info_.bmp", "# # DECRYPT MY FILE # #.bmp" ], "ransomnotes-refs": [ "https://pbs.twimg.com/media/DNIoIFuX4AAce7J.jpg", "https://pbs.twimg.com/media/DNx5Of-X0AASVda.jpg", "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/De8WvF_X0AARtYr[1].jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/xiaoba-ransomware-retooled-as-coinminer-but-manages-to-ruin-your-files-anyway/", "https://twitter.com/malwrhunterteam/status/923847744137154560", "https://twitter.com/struppigel/status/926748937477939200", "https://twitter.com/demonslay335/status/968552114787151873", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-8th-2018-crybrazil-cryptconsole-and-magniber/", "https://twitter.com/malwrhunterteam/status/1004048636530094081", "https://id-ransomware.blogspot.com/2017/10/xiaoba-ransomware.html" ] }, "uuid": "ef094aa6-4465-11e8-81ce-739cce28650b", "value": "XiaoBa ransomware" }, { "description": "The NMCRYPT Ransomware is a generic file encryption Trojan that was detected in the middle of April 2018. The NMCRYPT Ransomware is a file encoder Trojan that is designed to make data unreadable and convince users to pay a fee for unlocking content on the infected computers. The NMCRYPT Ransomware is nearly identical to hundreds of variants of the HiddenTear open-source ransomware and compromised users are unable to use the Shadow Volume snapshots made by Windows to recover. Unfortunately, the NMCRYPT Ransomware disables the native recovery features on Windows, and you need third-party applications to rebuild your data.", "meta": { "date": "April 2018", "encryption": "AES+RSA", "extensions": [ ".NMCRYPT" ], "payment-method": "Bitcoin", "price": "7000 $", "ransomnotes": [ "Encrypted files! All your files are encrypted. Using AES256-bit encryption and RSA-2048-bit encryption. Making it impossible to recover files without the correct private key. If you are interested in getting is the key and recover your files You should proceed with the following steps. The only way to decrypt your files safely is to buy the Descrypt and Private Key software. Any attempts to restore your files with the third-party software will be fatal for your files! Important use Firefox or Chrome browser To proceed with the purchase you must access one of the link below https://lylh3uqyzay3lhrd.onion.to/ https://lylh3uqyzay3lhrd.onion.link/ If neither of the links is online for a long period of time, there is another way to open it, you should install the Tor Browser..." ], "ransomnotes-refs": [ "https://sensorstechforum.com/wp-content/uploads/2018/04/stf-NMCRYPT-ransomware-virus-ransom-note-tor-onion-network-page-768x827.png" ], "refs": [ "https://sensorstechforum.com/nmcrypt-files-ransomware-virus-remove-restore-data/", "https://www.enigmasoftware.com/nmcryptansomware-removal/" ] }, "uuid": "bd71be69-fb8c-4b1f-9d96-993ab23d5f2b", "value": "NMCRYPT Ransomware" }, { "description": "It is currently unknown if Iron is indeed a new variant by the same creators of Maktub, or if it was simply inspired by the latter, by copying the design for the payment portal for example.\nWe know the Iron ransomware has mimicked at least three ransomware families:Maktub (payment portal design)\nDMA Locker (Iron Unlocker, decryption tool)\nSatan (exclusion list)", "meta": { "payment-method": "Bitcoin", "price": "0.2", "ransomnotes": [ "We’re very sorry that all of your personal files have been encrypted :( But there are good news – they aren’t gone, you still have the opportunity to restore them! Statistically, the lifespan of a hard-drive is anywhere from 3 to 5 years. If you don’t make copies of important information, you could lose everything! Just imagine! In order to receive the program that will decrypt all of your files, you will need to pay a certain amount. But let’s start with something else…" ], "ransomnotes-filenames": [ "!HELP_YOUR_FILES.HTML" ], "refs": [ "https://bartblaze.blogspot.lu/2018/04/maktub-ransomware-possibly-rebranded-as.html", "http://id-ransomware.blogspot.com/2018/04/ironlocker-ransomware.html" ] }, "uuid": "ba64d47c-46cd-11e8-87df-ff6252b4ea76", "value": "Iron" }, { "meta": { "extensions": [ ".tron" ], "payment-method": "Bitcoin", "price": "0.007305 - 0.05", "ransomnotes-refs": [ "https://pbs.twimg.com/media/DavxIr-W4AEq3Ny.jpg" ], "refs": [ "https://twitter.com/malwrhunterteam/status/985152346773696512", "http://id-ransomware.blogspot.com/2018/04/tron-ransomware.html" ] }, "uuid": "94290f1c-46ff-11e8-b9c6-ef8852c58952", "value": "Tron ransomware" }, { "description": "A new in-development ransomware was discovered that has an interesting characteristic. Instead of the distributed executable performing the ransomware functionality, the executables compiles an embedded encrypted C# program at runtime and launches it directly into memory.", "meta": { "extensions": [ "sequre@tuta.io_[hex]" ], "payment-method": "Bitcoin", "price": "0.14", "ransomnotes-filenames": [ "HOW DECRIPT FILES.hta" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/c/compiled-ransomware/ransom-note.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/new-c-ransomware-compiles-itself-at-runtime/" ] }, "uuid": "c1788ac0-4fa0-11e8-b0fd-63f5a2914926", "value": "Unnamed ramsomware 1" }, { "description": "Attackers are targeting Internet accessible HPE iLO 4 remote management interfaces, supposedly encrypting the hard drives, and then demanding Bitcoins to get access to the data again.\nAccording to the victim, the attackers are demanding 2 bitcoins to gain access to the drives again. The attackers will also provide a bitcoin address to the victim that should be used for payment. These bitcoin addresses appear to be unique per victim as the victim's was different from other reported ones.\nAn interesting part of the ransom note is that the attackers state that the ransom price is not negotiable unless the victim's are from Russia. This is common for Russian based attackers, who in many cases tries to avoid infecting Russian victims.\nFinally, could this be a decoy/wiper rather than an actual true ransomware attack? Ransomware attacks typically provide a unique ID to the victim in order to distinguish one victim from another. This prevents a victim from \"stealing\" another victim's payment and using it to unlock their computer.\nIn a situation like this, where no unique ID is given to identify the encrypted computer and the email is publicly accessible, it could be a case where the main goal is to wipe a server or act as a decoy for another attack.", "meta": { "payment-method": "Bitcoin", "price": "2", "ransomnotes": [ "Security Notice\n\nHey. Your hard disk is encrypted using RSA 2048 asymmetric encryption. To decrypt files you need to obtain the private key.\nIt means We are the only ones in the world to recover files back to you. Not even god can help you. Its all math and cryptography .\nIf you want your files back, Please send an email to 15fd9ngtetwjtdc@yopmail.com.\nWe don't know who are you, All what we need is some money and we are doing it for good cause.\nDon't panic if we don't answer you during 24 hours. It means that we didn't received your letter and write us again.\nYou can use of that bitcoin exchangers for transfering bitcoin.\nhttps://localbitcoins.com\nhttps://www.kraken.com\nPlease use english language in your letters. If you don't speak english then use https://translate.google.com to translate your letter on english language.\n\nProcess:\n1) Pay some BTC to our wallet address.(negotations almost impossible unless you are a russian citizen)\n2) We will send you private key and instructions to decrypt your hard drive\n3) Boom! You got your files back." ], "refs": [ "https://www.bleepingcomputer.com/news/security/ransomware-hits-hpe-ilo-remote-management-interfaces/", "https://twitter.com/M_Shahpasandi/status/989157283799162880", "https://id-ransomware.blogspot.com/2018/04/hpe-ilo-ransomware.html" ] }, "uuid": "39cb0268-528b-11e8-ac30-0fa44afdc8de", "value": "HPE iLO 4 Ransomware" }, { "description": "When Sigrun is executed it will first check \"HKEY_CURRENT_USER\\Keyboard Layout\\Preload\" to see if it is set to the Russian layout. If the computer is using a Russian layout, it will not encrypt the computer and just delete itself. Otherwise Sigrun will scan a computer for files to encrypt and skip any that match certain extensions, filenames, or are located in particular folders. ", "meta": { "extensions": [ ".sigrun" ], "payment-method": "Bitcoin Email", "price": "2500 $", "ransomnotes": [ "SIGRUN 1.0 RANSOMWARE\n\nAll your important files are encrypted\n\nYour files has been encrypted by sigrun ransomware with unique decryption key.\n\nThere is only one way to get your files back: contact with us, pay, and get decryptor software. \n\nWe accept Bitcoin and Dash, you can find exchangers on https://www.bitcoin.com/buy-bitcoin and https://www.dash.org/exchanges/ and others.\n\nYou have unique idkey (in a yellow frame), write it in letter when contact with us.\n\nAlso you can decrypt 3 files for test, its guarantee what we can decrypt your files.\n\nIDKEY:\n>>> [id_key] <<<\nContact information:\n\nemail: sigrun_decryptor@protonmail.ch", "~~~~~~SIGRUN 1.0 RANSOMWARE~~~~~~~~~\n\nAttention! \n\nAll your files documents, photos, databases and other important files are encrypted and have the extension: .sigrun\n\nThe only method of recovering files is to purchase a private key. It is on our server and only we can recover your files. \n\nBut don't worry! You still can restore it!\n\nIn order to restore it you need to contact with us via e-mail.\n\n-----------------------------------------------\n|Our e-mail is: sigrun_decryptor@protonmail.ch|\n-----------------------------------------------\n\nAs a proof we will decrypt 3 files for free!\n\nPlease, attach this to your message:\n[id_key]" ], "ransomnotes-filenames": [ "RESTORE-SIGRUN.html", "RESTORE-SIGRUN.txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/sigrun-ransomware-author-decrypting-russian-victims-for-free/", "http://id-ransomware.blogspot.com/2018/05/sigrun-ransomware.html" ] }, "uuid": "5a53eec2-6993-11e8-a4d5-67480005dcbd", "value": "Sigrun Ransomware" }, { "description": "Mostly Hidden Tear with some codes from Eda2 & seems compiled w/ Italian VS. Maybe related to OpsVenezuela?", "meta": { "extensions": [ ".crybrazil" ], "payment-method": "Website", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/crybrazil.jpg" ], "refs": [ "https://twitter.com/malwrhunterteam/status/1002953824590614528", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-8th-2018-crybrazil-cryptconsole-and-magniber/", "https://id-ransomware.blogspot.com/2018/06/crybrazil-ransomware.html" ] }, "uuid": "30625df6-6e3e-11e8-b0cf-a7103cb03e05", "value": "CryBrazil" }, { "description": "new destrucrtive ransomware called Pedcont that claims to encrypt files because the victim has accessed illegal content on the deep web. The screen then goes blank and becomes unresponsive.", "meta": { "payment-method": "Bitcoin", "price": "0.0065 (50 $)", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/De00yEDVQAE_p9z[1].jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-8th-2018-crybrazil-cryptconsole-and-magniber/ ", "http://id-ransomware.blogspot.com/2018/06/pedcont-ransomware.html" ] }, "uuid": "b0e074fc-6e45-11e8-8366-dbfc88552a23", "value": "Pedcont" }, { "description": "new Scarab Ransomware variant called DiskDoctor that appends the .DiskDoctor extension and drops a ransom note named HOW TO RECOVER ENCRYPTED FILES.TXT", "meta": { "extensions": [ ".DiskDoctor" ], "payment-method": "Bitcoin Email", "ransomnotes-filenames": [ "HOW TO RECOVER ENCRYPTED FILES.TXT" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/De2sj4GW0AAuQer[1].jpg" ], "refs": [ "https://id-ransomware.blogspot.com/2018/06/scarab-diskdoctor-ransomware.html", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-8th-2018-crybrazil-cryptconsole-and-magniber/" ], "synonyms": [ "Scarab-DiskDoctor" ] }, "uuid": "aa66e0c2-6fb5-11e8-851d-4722b7b3e9b9", "value": "DiskDoctor" }, { "description": "Jakub Kroustek discovered the RedEye Ransomware, which appends the .RedEye extension and wipes the contents of the files. RedEye can also rewrite the MBR with a screen that gives authors contact info and YouTube channel. Bart also wrote an article on this ransomware detailing how it works and what it does on a system.The ransomware author contacted BleepingComputer and told us that this ransomware was never intended for distribution and was created just for fun.", "meta": { "extensions": [ ".RedEye" ], "payment-method": "Bitcoin", "price": "0.1", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/DfCO0T2WsAQvclJ[1].jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-8th-2018-crybrazil-cryptconsole-and-magniber/", "https://twitter.com/JakubKroustek/status/1004463935905509376", "https://bartblaze.blogspot.com/2018/06/redeye-ransomware-theres-more-than.html", "https://id-ransomware.blogspot.com/2018/06/redeye-ransomware.html" ] }, "uuid": "e675e8fa-7065-11e8-95e0-cfdc107099d8", "value": "RedEye" }, { "description": "Typical ransom software, Aurora virus plays the role of blackmailing PC operators. It encrypts files and the encryption cipher it uses is pretty strong. After encryption, the virus attaches .aurora at the end of the file names that makes it impossible to open the data. Thereafter, it dispatches the ransom note totaling 6 copies, without any change to the main objective i.e., victims must write an electronic mail addressed to anonimus.mr@yahoo.com while stay connected until the criminals reply telling the ransom amount.", "meta": { "extensions": [ ".aurora", ".animus", ".Aurora", ".desu", ".ONI" ], "payment-method": "Bitcoin", "price": "100 - 500", "ransomnotes": [ "==========================# aurora ransomware #==========================\n\nSORRY! Your files are encrypted.\nFile contents are encrypted with random key.\nWe STRONGLY RECOMMEND you NOT to use any \"decryption tools\".\nThese tools can damage your data, making recover IMPOSSIBLE.\nAlso we recommend you not to contact data recovery companies.\nThey will just contact us, buy the key and sell it to you at a higher price.\nIf you want to decrypt your files, you have to get RSA private key.\nIn order to get private key, write here:\nbig.fish@vfemail.net\nAnd send me your id, your id:\n[redacted]\nAnd pay 200$ on 1GSbmCoKzkHVkSUxqdSH5t8SxJQVnQCeYf wallet\nIf someone else offers you files restoring, ask him for test decryption.\n Only we can successfully decrypt your files; knowing this can protect you from fraud.\nYou will receive instructions of what to do next.\n==========================# aurora ransomware #==========================", "%UserProfile%wall.i", "==========================# zorro ransomware #==========================\nSORRY! Your files are encrypted.\nFile contents are encrypted with random key.\nRandom key is encrypted with RSA public key (2048 bit)\n.We STRONGLY RECOMMEND you NOT to use any \"decryption tools\".\nThese tools can damage your data, making recover IMPOSSIBLE.\nAlso we recommend you not to contact data recovery companies.\nThey will just contact us, buy the key and sell it to you at a higher price.\nIf you want to decrypt your files, you need to get the RSA-key from us.\n--\nTo obtain an RSA-key, follow these steps in order:\n1. pay this sum 500$ to this BTC-purse: 18sj1xr86c3YHK44Mj2AXAycEsT2QLUFac\n2. write on the e-mail ochennado@tutanota.com or anastacialove21@mail.com indicating in the letter this ID-[id] and BTC-purse, from which paid.\nIn the reply letter you will receive an RSA-key and instructions on what to do next.\nWe guarantee you the recovery of files, if you do it right.\n==========================# zorro ransomware #==========================" ], "ransomnotes-filenames": [ "#RECOVERY-PC#.txt", "!-GET_MY_FILES-!.txt", "@_RESTORE-FILES_@.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/a/aurora/ransom-note.jpg", "https://www.bleepstatic.com/images/news/ransomware/a/aurora/wallpaper.jpg" ], "refs": [ "https://www.spamfighter.com/News-21588-Aurora-Ransomware-Circulating-the-Cyber-Space.htm", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-8th-2018-crybrazil-cryptconsole-and-magniber/", "https://twitter.com/demonslay335/status/1004435398687379456", "https://www.bleepingcomputer.com/news/security/aurora-zorro-ransomware-actively-being-distributed/", "https://id-ransomware.blogspot.com/2018/05/aurora-ransomware.html" ], "synonyms": [ "Zorro Ransomware" ] }, "uuid": "3ee0664e-706d-11e8-800d-9f690298b437", "value": "Aurora Ransomware" }, { "meta": { "extensions": [ ".digiworldhack@tutanota.com" ], "payment-method": "Bitcoin", "price": "500 $", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/8/pgpsnippet-variant.jpg", "http://id-ransomware.blogspot.com/2018/05/pgpsnippet-ransomware.html" ], "refs": [ "https://twitter.com/demonslay335/status/1005138187621191681" ] }, "uuid": "682ff7ac-7073-11e8-8c8b-bf1271b8800b", "value": "PGPSnippet Ransomware" }, { "meta": { "extensions": [ ".SF" ], "payment-method": "Bitcoin Email", "refs": [ "https://twitter.com/demonslay335/status/1005136022282428419", "https://id-ransomware.blogspot.com/2018/04/spartacus-ransomware.html" ] }, "uuid": "fe42c270-7077-11e8-af82-d7bf7e6ab8a9", "value": "Spartacus Ransomware" }, { "description": "S!Ri found a new ransomware called Donut that appends the .donut extension and uses the email donutmmm@tutanota.com.", "meta": { "extensions": [ ".donut" ], "payment-method": "Bitcoin", "price": "100 $", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/june/15/DfQI_lnXUAAukGK[1].jpg" ], "refs": [ "https://twitter.com/siri_urz/status/1005438610806583296", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-15th-2018-dbger-scarab-and-more/", "http://id-ransomware.blogspot.com/2018/06/donut-ransomware.html" ] }, "uuid": "e57e1f4a-72da-11e8-8c0d-af46e8f393d2", "value": "Donut" }, { "description": "Ransomware as a Service", "meta": { "payment-method": "Bitcoin", "price": "10", "refs": [ "https://twitter.com/Damian1338B/status/1005411102660923392", "https://www.bleepingcomputer.com/news/security/nemes1s-raas-is-padcrypt-ransomwares-affiliate-system/", "https://id-ransomware.blogspot.com/2017/01/nemesis-ransomware.html" ] }, "uuid": "3ac0f41e-72e0-11e8-85a8-f7ae254ab629", "value": "NemeS1S Ransomware" }, { "description": "MalwareHunterTeam discovered a new Paradise Ransomware variant that uses the extension _V.0.0.0.1{paradise@all-ransomware.info}.prt and drops a ransom note named PARADISE_README_paradise@all-ransomware.info.txt.", "meta": { "extensions": [ "_V.0.0.0.1{paradise@all-ransomware.info}.prt" ], "payment-method": "Bitcoin Email", "ransomnotes-filenames": [ "PARADISE_README_paradise@all-ransomware.info.txt" ], "refs": [ "https://twitter.com/malwrhunterteam/status/1005420103415017472", "https://twitter.com/malwrhunterteam/status/993499349199056897", "http://id-ransomware.blogspot.com/2017/09/paradise-ransomware.html" ] }, "uuid": "db06d2e0-72f9-11e8-9413-73999e1a9373", "value": "Paradise Ransomware" }, { "description": "uses the .reycarnasi1983@protonmail.com.gw3w amd a ransom note named ScrewYou.txt", "meta": { "extensions": [ ".reycarnasi1983@protonmail.com.gw3w", ".ssananunak1987@protonmail.com.b2fr" ], "payment-method": "Bitcoin", "price": "0.1 - 0.3", "ransomnotes": [ "Your files were encrypted with AES-256.\n\nAsk how to restore your files by email reycarnasi1983@protonmail.com\n\nUse only gmail.com, yahoo.com, protonmail.com.\nMessages written from other mail services we can not get.\n\nWe always respond to messages. If there is no answer within 24 hours, then write us with another email service.\n\n[OR]\n\nIf within 24 hours you have not received a response, you need to follow the following instructions:\n\na) Download and install TOR browser: https://www.torproject.org/download/download-easy.html.en\nb) From the TOR browser, follow the link: torbox3uiot6wchz.onion\nc) Register your e-mail (Sign Up)\nd) Write us on e-mail: reycarnasi1983@torbox3uiot6wchz.onion\nATTENTION: e-mail (reycarnasi1983@torbox3uiot6wchz.onion) accepts emails, only with e-mail registered in the TOR browser at torbox3uiot6wchz.onion\n\n################################\n\nAny actions on your part over encrypted files can damage them. Be sure to make backups!\n\n################################\n\nIn the message write us this ID:\n[redacted base64]-----END KEY-----", "Your files were encrypted with AES-256.\n\nAsk how to restore your files by email ssananunak1987@protonmail.com\n\nUse only gmail.com, yahoo.com, protonmail.com.\nMessages written from other mail services we can not get.\n\nWe always respond to messages. If there is no answer within 24 hours, then write us with another email service.\n\n[OR]\n\nIf within 24 hours you have not received a response, you need to follow the following instructions:\n\na) Download and install TOR browser: https://www.torproject.org/download/download-easy.html.en\nb) From the TOR browser, follow the link: torbox3uiot6wchz.onion\nc) Register your e-mail (Sign Up)\nd) Write us on e-mail: ssananunak1987@torbox3uiot6wchz.onion\nATTENTION: e-mail (ssananunak1987@torbox3uiot6wchz.onion) accepts emails, only with e-mail registered in the TOR browser at torbox3uiot6wchz.onion\n\n################################\n\nAny actions on your part over encrypted files can damage them. Be sure to make backups!\n\n################################\n\nIn the message write us this ID:\n[redacted base64]" ], "ransomnotes-filenames": [ "ScrewYou.txt", "Readme.txt" ], "refs": [ "https://twitter.com/demonslay335/status/1006220895302705154", "https://id-ransomware.blogspot.com/2018/03/b2dr-ransomware.html" ] }, "uuid": "4a341cf4-72ff-11e8-8371-b74902a1dff3", "value": "B2DR Ransomware" }, { "description": "uses the extension .codyprince92@mail.com.ovgm and drops a ransom note named Readme.txt", "meta": { "extensions": [ ".codyprince92@mail.com.ovgm" ], "payment-method": "Email Tor", "ransomnotes": [ "Hello. Your files have been encrypted.\n\nFor help, write to this e-mail: codyprince92@mail.com\nAttach to the letter 1-2 files (no more than 3 MB) and your personal key.\n\n\nIf within 24 hours you have not received a response, you need to follow the following instructions:\n\n\na) Download and install TOR browser: https://www.torproject.org/download/download-easy.html.en\nb) From the TOR browser, follow the link: torbox3uiot6wchz.onion\nc) Register your e-mail (Sign Up)\nd) Write us on e-mail: codyprince@torbox3uiot6wchz.onion\n\n\nATTENTION: e-mail (codyprince@torbox3uiot6wchz.onion) accepts emails, only with e-mail registered in the TOR browser at torbox3uiot6wchz.onion\n\n\n\nYour personal key:\n\n[redacted hex]" ], "ransomnotes-filenames": [ "Readme.txt" ], "refs": [ "https://twitter.com/demonslay335/status/1006237353474756610", "http://id-ransomware.blogspot.com/2017/05/yyto-ransomware.html" ] }, "uuid": "ef38d8b4-7392-11e8-ba1e-cfb37f0b9c73", "value": "YYTO Ransomware" }, { "meta": { "extensions": [ ".qnbqw" ], "payment-method": "Email", "ransomnotes": [ "Your files was encrypted using AES-256 algorithm. Write me to e-mail: qnbqwqe@protonmail.com to get your decryption key.\nYour USERKEY: [redacted 1024 bytes in base64]" ], "ransomnotes-filenames": [ "Notice.txt" ], "refs": [ "https://twitter.com/demonslay335/status/1007334654918250496" ] }, "uuid": "53e6e068-739c-11e8-aae4-df58f7f27ee5", "value": "Unnamed ramsomware 2" }, { "meta": { "extensions": [ ".[everbe@airmail.cc].everbe", ".embrace", "pain", ".[yoursalvations@protonmail.ch].neverdies@tutanota.com" ], "payment-method": "Bitcoin", "price": "3003 $", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsoIB_0U0AAXgEz[1].jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/decryptor-released-for-the-everbe-ransomware/", "https://twitter.com/malwrhunterteam/status/1065675918000234497", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-23rd-2018-stop-dharma-and-more/", "http://id-ransomware.blogspot.com/2018/03/everbe-ransomware.html" ] }, "uuid": "9d09ac4a-73a0-11e8-b71c-63b86eedf9a2", "value": "Everbe Ransomware" }, { "meta": { "payment-method": "Bitcoin", "refs": [ "https://www.johannesbader.ch/2015/03/the-dga-of-dircrypt/" ] }, "related": [ { "dest-uuid": "61b2dd12-2381-429d-bb64-e3210804a462", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "cdcc59a0-955e-412d-b481-8dff4bce6fdf", "value": "DirCrypt" }, { "description": "The authors of the Satan ransomware have rebranded their \"product\" and they now go by the name of DBGer ransomware, according to security researcher MalwareHunter, who spotted this new version earlier today. The change was not only in name but also in the ransomware's modus operandi. According to the researcher, whose discovery was later confirmed by an Intezer code similarity analysis, the new (Satan) DBGer ransomware now also incorporates Mimikatz, an open-source password-dumping utility. The purpose of DBGer incorporating Mimikatz is for lateral movement inside compromised networks. This fits a recently observed trend in Satan's modus operandi.", "meta": { "extensions": [ "image.png -- > [dbger@protonmail.com]image.png.dbger" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes": [ "Some files have been encrypted\nPlease send ( 1 ) bitcoins to my wallet address\nIf you paid, send the machine code to my email\nI will give you the key\nIf there is no payment within three days,\nwe will no longer support decryption\nIf you exceed the payment time, your data will be open to the public download\nWe support decrypting the test file.\nSend three small than 3 MB files to the email address\n\nBTC Wallet : [redacted]\nEmail: dbger@protonmail.com\nYour HardwareID:" ], "ransomnotes-filenames": [ "_How_to_decrypt_files.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/u/986406/Ransomware/DBGer/DBGer-ransom-note.png" ], "refs": [ "https://www.bleepingcomputer.com/news/security/dbger-ransomware-uses-eternalblue-and-mimikatz-to-spread-across-networks/", "http://id-ransomware.blogspot.com/2018/06/dbger-ransomware.html" ] }, "uuid": "541a479c-73a5-11e8-9d70-47736508231f", "value": "DBGer Ransomware" }, { "description": "Hidden Tear variant discovered in October 2016. After activation, provides victims with an unlimited amount of time to gather the requested ransom money and pay it. Related unlock keys and the response sent to and from a Gmail addres", "meta": { "payment-method": "Bitcoin", "price": "250 $", "refs": [ "https://www.accenture.com/t20180803T064557Z__w__/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf", "https://id-ransomware.blogspot.com/2017/11/rastakhiz-ransomware.html" ] }, "uuid": "884eaa14-9ba8-11e8-a6ec-7f903f720e60", "value": "RASTAKHIZ" }, { "description": "DUMB variant discovered on November 16, 2017. Disguised itself as a popular virtual private network (VPN) in Iran known as Psiphon and infected Iranian users. Included Farsi-language ransom note, decryptable in the same way as previous DUMB-based variants. Message requested only US$15 for unlock key. Advertised two local and Iran-based payment processors: exchange.ir and webmoney.ir.Shared unique and specialized indicators with RASTAKHIZ; iDefense threat intelligence analysts believe this similarity confirms that the same actor was behind the repurposing of both types of ransomware.", "meta": { "payment-method": "Bitcoin", "price": "15 $", "refs": [ "https://www.accenture.com/t20180803T064557Z__w__/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf", "http://id-ransomware.blogspot.com/2017/10/tyrant-ransomware.html" ], "synonyms": [ "Crypto Tyrant" ] }, "uuid": "701f2a3e-9baa-11e8-a044-4b8bc49ea971", "value": "TYRANT" }, { "description": "zCrypt variant discovered on November 17, 2017, one day after the discovery of TYRANT. Used Farsi-language ransom note asking for a staggering 20 Bitcoin ransom payment. Also advertised local Iran-based payment processors and exchanges—www.exchangeing[.]ir, www.payment24[.]ir, www.farhadexchange.net, and www.digiarz.com)—through which Bitcoins could be acquired.", "meta": { "payment-method": "Bitcoin", "price": "20", "refs": [ "https://www.accenture.com/t20180803T064557Z__w__/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf", "https://id-ransomware.blogspot.com/2017/11/wannasmile-ransomware.html" ] }, "uuid": "b3f04486-9bc4-11e8-bbfe-cf096483b45e", "value": "WannaSmile" }, { "description": "Uses APK Editor Pro. Picks and activates DEX>Smali from APK Editor. Utilizes LockService application and edits the “const-string v4, value” to a desired unlock key. Changes contact information within the ransom note. Once the victim has downloaded the malicious app, the only way to recover its content is to pay the ransom and receive the unlock key. ", "meta": { "payment-method": "Email", "refs": [ "https://www.accenture.com/t20180803T064557Z__w__/us-en/_acnmedia/PDF-83/Accenture-Cyber-Threatscape-Report-2018.pdf" ] }, "uuid": "b48a7d62-9bc4-11e8-a7c5-47d13fad265f", "value": "Unnamed Android Ransomware" }, { "description": "A new distribution campaign is underway for a STOP Ransomware variant called KeyPass based on the amount of victims that have been seen. Unfortunately, how the ransomware is being distributed is unknown at this time.", "meta": { "extensions": [ ".KEYPASS" ], "payment-method": "Bitcoin", "price": "300 $", "ransomnotes": [ "Attention!\n\nAll your files, documents, photos, databases and other important files are encrypted and have the extension: .KEYPASS\n\nThe only method of recovering files is to purchase an decrypt software and unique private key.\n\nAfter purchase you will start decrypt software, enter your unique private key and it will decrypt all your data.\n\nOnly we can give you this key and only we can recover your files.\n\nYou need to contact us by e-mail keypass@bitmessage.ch send us your personal ID and wait for further instructions.\n\nFor you to be sure, that we can decrypt your files - you can send us a 1-3 any not very big encrypted files and we will send you back it in a original form FREE.\n\nPrice for decryption $300.\n\nThis price avaliable if you contact us first 72 hours.\n\nE-mail address to contact us:\n\nkeypass@bitmessage.ch\n\n\n\nReserve e-mail address to contact us:\n\nkeypass@india.com\n\n\n\nYour personal id:\n[id]" ], "ransomnotes-filenames": [ "!!!KEYPASS_DECRYPTION_INFO!!!.txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/new-keypass-ransomware-campaign-underway/", "https://www.kaspersky.com/blog/keypass-ransomware/23447/" ], "synonyms": [ "KeyPass" ] }, "uuid": "22b4070e-9efe-11e8-b617-ab269f54596c", "value": "KEYPASS" }, { "description": "Emmanuel_ADC-Soft found a new STOP Ransomware variant that appends the .INFOWAIT extension and drops a ransom note named !readme.txt.", "meta": { "extensions": [ ".INFOWAIT", "-DATASTOP", ".PUMA" ], "payment-method": "Bitcoin", "price": "200 - 600 $", "ransomnotes-filenames": [ "!readme.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsW33OQXgAAwJzv[1].jpg", "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsobVENXcAAR3GC[1].jpg" ], "refs": [ "https://twitter.com/Emm_ADC_Soft/status/1064459080016760833", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-23rd-2018-stop-dharma-and-more/", "https://twitter.com/MarceloRivero/status/1065694365056679936", "http://id-ransomware.blogspot.com/2017/12/stop-ransomware.html" ] }, "uuid": "c76c4d24-9f99-11e8-808d-a7f1c66a53c5", "value": "STOP Ransomware" }, { "description": "A new ransomware that only encrypts .EXE files on a computer. It then displays a screen with a picture of President Obama that asks for a \"tip\" to decrypt the files.", "meta": { "payment-method": "Bitcoin", "ransomnotes": [ "Hello, your computer is encrypted by me! Yeah, that means your EXE file isn't open! Because I encrypted it.\nSo you can decrypt it, but you have to tip it. This is a big thing. You can email this email: 2200287831@qq.com gets more information." ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/b/barack-obama-ransomware/barack-obama-everlasting-blue-blackmail-virus.jpg" ], "refs": [ "https://twitter.com/malwrhunterteam/status/1032242391665790981", "https://www.bleepingcomputer.com/news/security/barack-obamas-blackmail-virus-ransomware-only-encrypts-exe-files/", "https://id-ransomware.blogspot.com/2018/08/barack-obamas-ransomware.html" ], "synonyms": [ "Barack Obama's Blackmail Virus Ransomware" ] }, "uuid": "1a98f5ca-b024-11e8-b828-1fb7dbd6619e", "value": "Barack Obama's Everlasting Blue Blackmail Virus Ransomware" }, { "description": "When the CryptoNar, or Crypto Nar, Ransomware encrypts a victims files it will perform the encryption differently depending on the type of file being encrypted.\nIf the targeted file has a .txt or .md extension, it will encrypt the entire file and append the .fully.cryptoNar extension to the encrypted file's name. All other files will only have the first 1,024 bytes encrypted and will have the .partially.cryptoNar extensions appended to the file's name.", "meta": { "extensions": [ ".fully.cryptoNar", ".partially.cryptoNar" ], "payment-method": "Bitcoin", "price": "200 $", "ransomnotes-filenames": [ "CRYPTONAR RECOVERY INFORMATION.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/ransom-note.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/cryptonar-ransomware-discovered-and-quickly-decrypted/", "https://twitter.com/malwrhunterteam/status/1034492151541977088", "https://id-ransomware.blogspot.com/2018/08/cryptonar-ransomware.html" ] }, "related": [ { "dest-uuid": "2fb307a2-8752-4521-8973-75b68703030d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "10f92054-b028-11e8-a51f-2f82236ac72d", "value": "CryptoNar" }, { "description": "Jakub Kroustek found what appears to be an in-dev version of the CreamPie Ransomware. It does not currently display a ransom note, but does encrypt files and appends the .[backdata@cock.li].CreamPie extension to them.", "meta": { "extensions": [ ".[backdata@cock.li].CreamPie" ], "payment-method": "Bitcoin", "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/", "https://twitter.com/JakubKroustek/status/1033656080839139333", "https://id-ransomware.blogspot.com/2018/08/creampie-ransomware.html" ] }, "uuid": "1b5a756e-b034-11e8-9e7d-c3271796acab", "value": "CreamPie Ransomware" }, { "description": "Looks to be in-development as it does not encrypt.", "meta": { "refs": [ "https://twitter.com/leotpsc/status/1033625496003731458", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/" ] }, "uuid": "7854c8bc-b036-11e8-bfb0-4ff71e54bbb2", "value": "Jeff the Ransomware" }, { "description": "Michael Gillespie saw an encrypted file uploaded to ID Ransomware that appends the .cassetto extension and drops a ransom note named IMPORTANT ABOUT DECRYPT.txt.", "meta": { "extensions": [ ".cassetto" ], "payment-method": "Bitcoin", "price": "0.5", "ransomnotes": [ "L!W2Be%BS4\nWARNING!! YOU ARE SO F*UCKED!!!\n\nYour Files Has Encrypted\n\nWhat happened to your files?\nAll of your files were protected by a strong encryptation\nThere is no way to decrypt your files without the key.\nIf your files not important for you just reinstall your system.\nx§If your files is important just email us to discuss the the price and how to decrypt your files.\n\nYou can email us to omg-help-me@openmailbox.org\n\nWe accept just BITCOIN if you don´t know what it is just google it.\nWe will give instructions where and how you buy bitcoin in your country.\nPrice depends on how important your files and network is.\nIt could be 0.5 bitcoin to 25 bitcoin.\nYou can send us a encrypted file for decryption.\nFell free to email us with your country, computer name and username of the infected system." ], "ransomnotes-filenames": [ "IMPORTANT ABOUT DECRYPT.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/DlpDe-kXsAA2lmH[1].jpg" ], "refs": [ "https://twitter.com/demonslay335/status/1034213399922524160", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/", "https://id-ransomware.blogspot.com/2018/08/cassetto-ransomware.html" ] }, "uuid": "7d3287f0-b03d-11e8-b1ef-23485f43e7f9", "value": "Cassetto Ransomware" }, { "description": "Leo discovered a screenlocker that calls itself Acroware Cryptolocker Ransomware. It does not encrypt.", "meta": { "payment-method": "Bitcoin", "price": "80 $", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/Dlq8W3FXoAAYR1v[1].jpg" ], "refs": [ "https://twitter.com/leotpsc/status/1034346447112679430", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/" ], "synonyms": [ "Acroware Screenlocker" ] }, "uuid": "f1b76b66-b044-11e8-8ae7-cbe7e28dd584", "value": "Acroware Cryptolocker Ransomware" }, { "description": "Ben Hunter discovered a new ransomware called Termite Ransomware. When encrypting a computer it will append the .aaaaaa extension to encrypted files.", "meta": { "extensions": [ ".aaaaaa" ], "payment-method": "Bitcoin", "price": "100 - 500 $", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/DlraMbTWwAA_367[1].jpg" ], "refs": [ "https://twitter.com/B_H101/status/1034379267956715520", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/" ] }, "uuid": "a8a772b4-b04d-11e8-ad94-ab9124dff412", "value": "Termite Ransomware" }, { "description": "S!Ri found a new Thanatos Ransomware variant called PICO Ransomware. This ransomware will append the .PICO extension to encrypted files and drop a ransom note named README.txt.", "meta": { "extensions": [ ".PICO" ], "payment-method": "Bitcoin", "price": "100 $", "ransomnotes-filenames": [ "README.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/Dl2M9kdX0AAcGbJ[1].jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/", "https://twitter.com/siri_urz/status/1035138577934557184" ], "synonyms": [ "Pico Ransomware" ] }, "uuid": "5d0c28f6-b050-11e8-95a8-7b8e480b9bd2", "value": "PICO Ransomware" }, { "description": "Today one of our volunteers, Aura, told me about a new new malspam campaign pretending to be from Craigslist that is under way and distributing the Sigma Ransomware. These spam emails contain password protected Word or RTF documents that download the Sigma Ransomware executable from a remote site and install it on a recipients computer.", "meta": { "payment-method": "Bitcoin", "price": "400 $", "ransomnotes-filenames": [ "ReadMe.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/s/sigma/craigslist-malspam/ransom-note-html-part_01.jpg", "https://www.bleepstatic.com/images/news/ransomware/s/sigma/craigslist-malspam/ransom-note-html-part_02.jpg", "https://www.bleepstatic.com/images/news/ransomware/s/sigma/craigslist-malspam/payment-portal.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/sigma-ransomware-being-distributed-using-fake-craigslist-malspam/" ] }, "uuid": "df025902-b29e-11e8-a2ab-739167419c52", "value": "Sigma Ransomware" }, { "uuid": "32406292-b738-11e8-ab97-1f674b130624", "value": "Crypt0saur" }, { "description": "An attack called Mongo Lock is targeting remotely accessible and unprotected MongoDB databases, wiping them, and then demanding a ransom in order to get the contents back. While this new campaign is using a name to identify itself, these types of attacks are not new and MongoDB databases have been targeted for a while now. These hijacks work by attackers scanning the Internet or using services such as Shodan.io to search for unprotected MongoDB servers. Once connected, the attackers may export the databases, delete them, and then create a ransom note explaining how to get the databases back.", "meta": { "payment-method": "Bitcoin", "price": "0.1", "ransomnotes": [ "Your database was encrypted by 'Mongo Lock'. if you want to decrypt your database, need to be pay us 0.1 BTC (Bitcoins), also don't delete 'Unique_KEY' and save it to safe place, without that we cannot help you. Send email to us: mongodb@8chan.co for decryption service." ], "refs": [ "https://www.bleepingcomputer.com/news/security/mongo-lock-attack-ransoming-deleted-mongodb-databases/" ] }, "uuid": "2aa481fe-c254-11e8-ad1c-efee78419960", "value": "Mongo Lock" }, { "description": "The Kraken Cryptor Ransomware is a newer ransomware that was released in August 2018. A new version, called Kraken Cryptor 1.5, was recently released that is masquerading as the legitimate SuperAntiSpyware anti-malware program in order to trick users into installing it. ", "meta": { "payment-method": "Dollars", "price": "80", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/security/f/fallout-exploit-kit/savefiles/ransom-note-red.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/fallout-exploit-kit-now-installing-the-kraken-cryptor-ransomware/", "https://www.bleepingcomputer.com/news/security/kraken-cryptor-ransomware-masquerading-as-superantispyware-security-program/", "https://twitter.com/MarceloRivero/status/1059575186117328898", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-9th-2018-mostly-dharma-variants/" ] }, "uuid": "c49f88f6-c87d-11e8-b005-d76e8162ced5", "value": "Kraken Cryptor Ransomware" }, { "meta": { "extensions": [ ".SAVEfiles." ], "payment-method": "Email", "ransomnotes-filenames": [ "!!!SAVE__FILES__INFO!!!.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/security/f/fallout-exploit-kit/savefiles/ransom-note-red.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/fallout-exploit-kit-pushing-the-savefiles-ransomware/" ] }, "uuid": "76bfb132-cc70-11e8-8623-bb3f209be6c9", "value": "SAVEfiles" }, { "description": "The File-Locker Ransomware is a Hidden Tear variant that is targeting victims in Korea. When victim's are infected it will leave a ransom requesting 50,000 Won, or approximately 50 USD, to get the files back. This ransomware uses AES encryption with a static password of \"dnwls07193147\", so it is easily decryptable.", "meta": { "extensions": [ ".locked" ], "payment-method": "Won", "price": "50 000 (50 $)", "ransomnotes": [ "한국어: 경고!!! 모든 문서, 사진, 데이테베이스 및 기타 중요한 파일이 암호화되었습니다!!\n당신은 돈을 지불해야 합니다\n비트코인 5만원을 fasfry2323@naver.com로 보내십시오 비트코인 지불코드: 1F1tAaz5x1HUXrCNLbtMDqcw6o5GNn4xqX 결제 사이트 http://www.localbitcoins.com/ \nEnglish: Warning!!! All your documents, photos, databases and other important personal files were encrypted!!\nYou have to pay for it.\nSend fifty thousand won to fasfry2323@naver.com Bitcoin payment code: 1BoatSLRHtKNngkdXEeobR76b53LETtpyT Payment site http://www.localbitcoins.com/" ], "ransomnotes-filenames": [ "Warning!!!!!!.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/f/file-locker/ransom-note%20-%20Copy.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/file-locker-ransomware-targets-korean-victims-and-asks-for-50k-won/" ] }, "uuid": "c06a1938-dcee-11e8-bc74-474b0080f0e5", "value": "File-Locker" }, { "description": "A new ransomware called CommonRansom was discovered that has a very bizarre request. In order to decrypt a computer after a payment is made, they require the victim to open up Remote Desktop Services on the affected computer and send them admin credentials in order to decrypt the victim's files.", "meta": { "extensions": [ ".[old@nuke.africa].CommonRansom" ], "payment-method": "Bitcoin", "price": "0.1", "ransomnotes": [ "+-----------------------+\n¦----+CommonRansom+-----¦\n+-----------------------+\nHello dear friend,\nYour files were encrypted!\nYou have only 12 hours to decrypt it\nIn case of no answer our team will delete your decryption password\nWrite back to our e-mail: old@nuke.africa\n\n\nIn your message you have to write:\n1. This ID-[VICTIM_ID]\n2. [IP_ADDRESS]:PORT(rdp) of infected machine\n3. Username:Password with admin rights\n4. Time when you have paid 0.1 btc to this bitcoin wallet:\n35M1ZJhTaTi4iduUfZeNA75iByjoQ9ibgF\n\n\nAfter payment our team will decrypt your files immediatly\n\n\nFree decryption as guarantee:\n1. File must be less than 10MB\n2. Only .txt or .lnk files, no databases\n3. Only 5 files\n\n\nHow to obtain bitcoin:\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\nhttps://localbitcoins.com/buy_bitcoins\nAlso you can find other places to buy Bitcoins and beginners guide here:\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/" ], "ransomnotes-filenames": [ "DECRYPTING.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/c/CommonRansom/ransom-note.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/commonransom-ransomware-demands-rdp-access-to-decrypt-files/" ] }, "uuid": "c0dffb94-dcee-11e8-81b9-3791d1c6638f", "value": "CommonRansom" }, { "description": "MalwareHunterTeam found a new ransomware called God Crypt that does not appear to decrypt and appears to be a joke ransomware. Has an unlock code of 29b579fb811f05c3c334a2bd2646a27a.", "meta": { "payment-method": "Bitcoin Website", "refs": [ "https://twitter.com/malwrhunterteam/status/1048616343975682048", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-12th-2018-notpetya-gandcrab-and-more/" ], "synonyms": [ "Godsomware v1.0", "Ransomware God Crypt" ] }, "uuid": "1b74bfda-c32c-4713-8ff6-793d8e787645", "value": "God Crypt Joke Ransomware" }, { "description": "Michael Gillespie found a new ransomware uploaded to ID Ransomware that appends the .encr extension and drops a ransom note named readmy.txt.", "meta": { "extensions": [ ".encr" ], "payment-method": "Email", "ransomnotes": [ "Attention! All your files are encrypted!\nTo recover your files and access them,\nsend a message with your id to email DecryptFox@protonmail.com\n \nPlease note when installing or running antivirus will be deleted\n important file to decrypt your files and data will be lost forever!!!!\n \nYou have 5 attempts to enter the code. If you exceed this\nthe number, all the data, will be irreversibly corrupted. Be\ncareful when entering the code!\n \nyour id [redacted 32 lowercase hex]" ], "ransomnotes-filenames": [ "readmy.txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-12th-2018-notpetya-gandcrab-and-more/", "https://twitter.com/demonslay335/status/1049325784979132417" ] }, "uuid": "a920dea5-9f30-4fa2-9665-63f306874381", "value": "DecryptFox Ransomware" }, { "description": "Michael Gillespie found a new ransomware that appends the .garrantydecrypt extension and drops a ransom note named #RECOVERY_FILES#.txt", "meta": { "extensions": [ ".garrantydecrypt" ], "payment-method": "Bitcoin", "price": "780 $", "ransomnotes-filenames": [ "#RECOVERY_FILES#.txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-12th-2018-notpetya-gandcrab-and-more/", "https://www.bleepingcomputer.com/news/security/ransomware-pretends-to-be-proton-security-team-securing-data-from-hackers/" ] }, "uuid": "f251740b-1594-460a-a378-371f3a2ae92c", "value": "garrantydecrypt" }, { "description": "Siri discovered a new ransomware that is appending the .mvp extension to encrypted files.", "meta": { "extensions": [ ".mvp" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/september/14/mvp.jpg" ], "refs": [ "https://twitter.com/siri_urz/status/1039077365039673344", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-14th-2018-kraken-dharma-and-matrix/" ] }, "uuid": "ea643bfd-613e-44d7-9408-4991d53e08fa", "value": "MVP Ransomware" }, { "description": "Michael Gillespie noticed numerous submissions to ID Ransomware from South Korea for the StorageCrypter ransomware. This version is using a new ransom note named read_me_for_recover_your_files.txt.", "meta": { "payment-method": "Bitcoin", "price": "0.8", "ransomnotes": [ "All your important files on this device have been encrypted.\n\nNo one can decrypt your files except us.\n\nIf you want to recover all your files. contact us via E-mail.\nDON'T forget to send us your ID!!!\n\nTo recover your files,You have to pay 0.8 bitcoin.\n\n\n\n\nContact Email : Leviathan13@protonmail.com\n\nYour ID :\n\n[redacted 0x200 bytes in base64 form]\n\n\nFree decryption as guarantee\n\nIf you can afford the specified amount of bitcoin,\nyou can send to us up to 2 files for demonstration.\n\nPlease note that files must NOT contain valuable information\nand their total size must be less than 2Mb." ], "ransomnotes-filenames": [ "read_me_for_recover_your_files.txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-14th-2018-kraken-dharma-and-matrix/" ], "synonyms": [ "SambaCry" ] }, "uuid": "3675e50d-3f76-45f8-b3f3-4a645779e14d", "value": "StorageCrypter" }, { "description": "GrujaRS discovered a new ransomware called Rektware that appends the .CQScSFy extension", "meta": { "extensions": [ ".CQScSFy" ], "payment-method": "Email", "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-14th-2018-kraken-dharma-and-matrix/", "https://twitter.com/GrujaRS/status/1040677247735279616" ] }, "uuid": "e90a57b5-cd17-4dce-b83f-d007053c7b35", "value": "Rektware" }, { "meta": { "extensions": [ ".mariacbc" ], "payment-method": "Bitcoin", "price": "0.002 (50 $)", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/9/moira.jpg" ], "refs": [ "https://twitter.com/malwrhunterteam/status/1058775145005887489", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-9th-2018-mostly-dharma-variants/" ], "synonyms": [ "M@r1a", "BlackHeart" ] }, "uuid": "1009b7f3-e737-49fd-a872-1e0fd1df4c00", "value": "M@r1a ransomware" }, { "meta": { "extensions": [ "(enc) prepend" ], "payment-method": "Bitcoin", "price": "25 000 sek (sweden)", "ransomnotes": [ "Hi. Thank you for using my program. If you're reading this, a lot of your files have\nbeen encrypted. To decrypt them, you need my decryption program. For this, I want 25 000 sek, I want\nthem in bitcoin. Email me when you've paid with details about the transaction. I'll give you two days.\nIf you have not paid in two days(from the day you received the email), It will cost 1000 sek more per day.\n If I have not heard from you after five days (from the day you received the email), I assume your files are not that\nimportant to you. So I'll delete your decryption-key, and you will never see your files again.\n\n\nAfter the payment, email me the following information:\n* the bitcoin address you sent from (important, write it down when you do the transaction)\n* the ID at the bottom of this document (this is important!! Otherwise I don't know which key belongs\nto you).\nThen I will send you the decryption-program and provide you with instructions of how to remove\nthe virus if you have not already figured it out.\n\n\nEmail:\naperfectday2018@protonmail.com\n\nBitcoin adress: \n1LX3tBkW161hoF5DbGzbrm3sdXaF6XHv2D\n\nMake sure to get the bitcoin adress right, copy and paste and double check. If you send the bitcoin\nto the wrong adress, it will be lost forever. You cant stop or regret a bitcoin transaction.\n\n\nIMPORTANT: \n\nDo not loose this document. You also have a copy of it on your desktop.\nDo NOT change any filenames!!! !!!\n\n\nThank you for the money, it means a lot to me. \n\n\n\nID: [redacted 13 numbers]" ], "ransomnotes-filenames": [ "aboutYourFiles.txt" ], "refs": [ "https://twitter.com/demonslay335/status/1059470985055875074", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-9th-2018-mostly-dharma-variants/" ], "synonyms": [ "Aperfectday2018" ] }, "uuid": "ad600737-6d5f-4771-ae80-3e434e29c749", "value": "\"prepending (enc) ransomware\" (Not an official name)" }, { "meta": { "extensions": [ ".impect" ], "payment-method": "Bitcoin", "price": "300 $", "ransomnotes": [ "Attention MOTHERFUCKER!\n\nAll your main files were encrypted!\n\nYour personal files (documents, databases, jpeg, docx, doc,\netc.) were encrypted, their further using impossible.\nTO DECRYPT YOUR FILES YOU NEED TO BUY A SOFTWARE WITH YOUR UNIQUE PRIVATE KEY. ONLY OUR\nSOFTWARE WILL ALLOW YOU DECRYPT YOUR FILES.\nNOTE:\nYou have only 6 hours from the moment when an encryption was done to buy our software at $300, in bitcoin\nYou all files will get deleted after the lapse of 6 hours.\nAny attempts to remove this encryption will be unsuccessful. You cannot do this without our software with your key.\nDo not send any emails with threats and rudeness to us. Example of email format: Hi, I need a decryption of my files.\n\nBitcoin address = 1GstvLM6SumX3TMMgN9PvXQsEy3FR9ZqWX\n\nContact us by email only: ayaan321308@gmail.com" ], "ransomnotes-filenames": [ "how to get back you files.txt" ], "ransomnotes-refs": [ "https://pbs.twimg.com/media/DrkmCriWwAMCdqF.jpg" ], "refs": [ "https://twitter.com/demonslay335/status/1060921043957755904" ], "synonyms": [ "Dxh26wam" ] }, "uuid": "f7fa6978-c932-4e62-b4fc-3fbbbc195602", "value": "PyCL Ransomware" }, { "description": "MalwareHunterTeam discovered the Vapor Ransomware that appends the .Vapor extension to encrypted files. Will delete files if you do not pay in time.", "meta": { "extensions": [ ".Vapor" ], "payment-method": "Email", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/vapor.jpg" ], "refs": [ "https://twitter.com/malwrhunterteam/status/1063769884608348160", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-23rd-2018-stop-dharma-and-more/" ] }, "uuid": "f53205a0-7a8f-41d1-a427-bf3ab9bd77bb", "value": "Vapor Ransomware" }, { "description": "GrujaRS discovered a new ransomware called EnyBenyHorsuke Ransomware that appends the .Horsuke extension to encrypted files.", "meta": { "extensions": [ ".Horsuke " ], "payment-method": "Bitcoin", "price": "0.00000001", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsPVGaHXcAAtnXz[1].jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-23rd-2018-stop-dharma-and-more/", "https://twitter.com/GrujaRS/status/1063930127610986496" ] }, "uuid": "677aeb47-587d-40a4-80b7-22672ba1160c", "value": "EnyBenyHorsuke Ransomware" }, { "meta": { "extensions": [ ".demonslay335_you_cannot_decrypt_me!", ".malwarehunterteam" ], "payment-method": "Bitcoin", "price": "999999.5", "ransomnotes-filenames": [ "!=How_recovery_files=!.html" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsiUA0LXgAAoqkd[1].jpg", "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/23/DsuMFrZW0AIIUXs[1].jpg" ], "refs": [ "https://twitter.com/petrovic082/status/1065223932637315074", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-23rd-2018-stop-dharma-and-more/", "https://twitter.com/demonslay335/status/1066099799705960448" ], "synonyms": [ "DelphiMorix", "DelphiMorix!" ] }, "uuid": "7f82fb04-1bd2-40a1-9baa-895b53c6f7d4", "value": "DeLpHiMoRix" }, { "description": "@GrujaRS discovered a new in-dev ransomware called EnyBeny Nuclear Ransomware that meant to append the extension .PERSONAL_ID:.Nuclear to encrypted files, but failed due to a bug.", "meta": { "extensions": [ ".PERSONAL_ID:.Nuclear" ], "payment-method": "Bitcoin", "price": "0.00000001", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/november/30/Ds4IYbfWsAECNuJ[1].jpg", "https://pbs.twimg.com/media/Ds4IKL3X4AIHKrj.jpg", "https://pbs.twimg.com/media/Ds4IYbfWsAECNuJ.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-30th-2018-indictments-sanctions-and-more/", "https://twitter.com/GrujaRS/status/1066799421080461312", "https://www.youtube.com/watch?v=_aaFon7FVbc" ] }, "uuid": "950d5501-b5eb-4f53-b33d-76e789912c16", "value": "EnyBeny Nuclear Ransomware" }, { "description": "Michael Gillespie discovered a new ransomware that renamed encrypted files to \"[[email]][original].[random].lucky\" and drops a ransom note named _How_To_Decrypt_My_File_.txt.", "meta": { "extensions": [ "[]..lucky" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes": [ "I am sorry to tell you.\nSome files has crypted\nif you want your files back , send 1 bitcoin to my wallet\nmy wallet address : 3HCBsZ6QQTnSsthbmVtYE4XSZtism4j7qd\nIf you have any questions, please contact us.\n\nEmail:[nmare@cock.li]" ], "ransomnotes-filenames": [ "_How_To_Decrypt_My_File_.txt" ], "refs": [ "https://twitter.com/demonslay335/status/1067109661076262913", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-30th-2018-indictments-sanctions-and-more/" ] }, "uuid": "a8eb9743-dfb6-4e13-a95e-e68153df94e9", "value": "Lucky Ransomware" }, { "description": "Over 100,000 thousand computers in China have been infected in just a few days with poorly-written ransomware that encrypts local files and steals credentials for multiple Chinese online services. The crooks show a screen titled UNNAMED1989 and demand the victim a ransom of 110 yuan ($16) in exchange for decrypting the files, payable via Tencent's WeChat payment service by scanning a QR code.", "meta": { "payment-method": "Yuan", "price": "110 (16 $)", "refs": [ "https://www.bleepingcomputer.com/news/security/ransomware-infects-100k-pcs-in-china-demands-wechat-payment/", "https://www.bleepingcomputer.com/news/security/chinese-police-arrest-dev-behind-unnamed1989-wechat-ransomware/" ], "synonyms": [ "UNNAMED1989" ] }, "uuid": "b2aa807d-98fa-48e4-927b-4e81a50736e5", "value": "WeChat Ransom" }, { "meta": { "extensions": [ ".israbye" ], "payment-method": "Politic", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/7/Dtlxf0eW4AAJCdZ[1].jpg", "https://pbs.twimg.com/media/DtlxfFsW4AAs-Co.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-7th-2018-wechat-ransomware-scammers-and-more/", "https://www.youtube.com/watch?v=QevoUzbqNTQ", "https://twitter.com/GrujaRS/status/1070011234521673728" ] }, "uuid": "3ade75c8-6ef7-4c54-84d0-cab0161d3415", "value": "IsraBye" }, { "meta": { "extensions": [ "prepend (encrypted)" ], "payment-method": "Bitcoin Website", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/7/DtkQKCDWoAM13kD[1].jpg" ], "refs": [ "https://twitter.com/struppigel/status/1069905624954269696", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-7th-2018-wechat-ransomware-scammers-and-more/" ] }, "related": [ { "dest-uuid": "c71819a4-f6ce-4265-b0cd-24a98d84321c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "d3337bec-fd4e-11e8-a3ad-e799cc59c59c", "value": "Dablio Ransomware" }, { "meta": { "extensions": [ ".XY6LR", ".gerber5", ".FJ7QvaR9VUmi" ], "payment-method": "Email", "ransomnotes-filenames": [ "DECRYPT.txt" ], "ransomnotes-refs": [ "https://pbs.twimg.com/media/Dtz4PD2WoAIWtRv.jpg", "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/14/Dt-APfCW0AADWV8[1].jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-7th-2018-wechat-ransomware-scammers-and-more/", "https://twitter.com/petrovic082/status/1071003939015925760", "https://twitter.com/Emm_ADC_Soft/status/1071716275590782976" ] }, "uuid": "3bcc725f-6b89-4350-ad79-f50daa30f74e", "value": "Gerber Ransomware 1.0" }, { "uuid": "54240144-05c2-43f0-8386-4301a85330bb", "value": "Gerber Ransomware 3.0" }, { "meta": { "extensions": [ ".protected" ], "payment-method": "Bitcoin", "price": "900 $", "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/december/7/Dt1_DpMXcAMC8J_[1].jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-7th-2018-wechat-ransomware-scammers-and-more/", "https://twitter.com/GrujaRS/status/1071153192975642630", "https://www.youtube.com/watch?v=iB019lDvArs" ] }, "uuid": "9ebfa028-a9dd-46ec-a915-1045fb297824", "value": "Outsider" }, { "description": "Uses http://ccrypt.sourceforge.net/ encryption program", "meta": { "payment-method": "Bitcoin", "price": "0.3", "refs": [ "https://twitter.com/demonslay335/status/1071123090564923393", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-7th-2018-wechat-ransomware-scammers-and-more/" ] }, "uuid": "23fcbbf1-93ee-4baf-9082-67ca26553643", "value": "JungleSec" }, { "description": "GrujaRS discovered the EQ Ransomware that drops a ransom note named README_BACK_FILES.htm and uses .f**k (censored) as its extension for encrypted files. May be GlobeImposter.", "meta": { "extensions": [ ".fuck" ], "payment-method": "Bitcoin", "price": "1", "ransomnotes-filenames": [ "README_BACK_FILES.htm" ], "ransomnotes-refs": [ "https://pbs.twimg.com/media/Dt4xTDjWwAEBjBh.jpg" ], "refs": [ "https://twitter.com/GrujaRS/status/1071349228172124160", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-14th-2018-slow-week/", "https://www.youtube.com/watch?v=uHYY6XZZEw4" ] }, "uuid": "edd4c8d0-d971-40a6-b7c6-5c57a4b51e48", "value": "EQ Ransomware" }, { "description": "extension \".Mercury\", note \"!!!READ_IT!!!.txt\" with 4 different 64-char hex as ID, 3 of which have dashes. Possible filemarker, same in different victim's files.", "meta": { "extensions": [ ".mercury" ], "payment-method": "Email", "ransomnotes": [ "!!! ATTENTION, YOUR FILES WERE ENCRYPTED !!!\n\nPlease follow few steps below:\n\n1.Send us your ID.\n2.We can decrypt 1 file what would you make sure that we have decription tool!\n3.Then you'll get payment instruction and after payment you will get your decryption tool!\n\n\n Do not try to rename files!!! Only we can decrypt all your data!\n\n Contact us:\n\ngetmydata@india.com\nmydataback@aol.com\n\n Your ID:[redacted 64 uppercase hex]:[redacted 64 uppercase hex with dashes]\n[redacted 64 uppercase hex with dashes]:[redacted 64 uppercase hex with dashes]" ], "ransomnotes-filenames": [ "!!!READ_IT!!!.txt" ], "refs": [ "https://twitter.com/demonslay335/status/1072164314608480257" ] }, "uuid": "968cf828-0653-4d86-a01d-186db598f391", "value": "Mercury Ransomware" }, { "meta": { "extensions": [ ".locked" ], "payment-method": "Email", "ransomnotes-filenames": [ "ODSZYFRFUJ_PLIKI_TERAZ.txt" ], "ransomnotes-refs": [ "https://pbs.twimg.com/media/DuIsIoWXQAEGKlr.jpg" ], "refs": [ "https://twitter.com/GrujaRS/status/1072468548977680385" ], "synonyms": [ "FORMA" ] }, "uuid": "ea390fa7-94ac-4287-8a2d-c211330671b0", "value": "Forma Ransomware" }, { "meta": { "extensions": [ ".djvu" ], "payment-method": "Email", "ransomnotes": [ "---------------------------------------------- ALL YOUR FILES ARE ENCRYPTED ----------------------------------------------- \n\nDon't worry, you can return all your files!\nAll your files documents, photos, databases and other important are encrypted with strongest encryption and unique key.\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\nThis software will decrypt all your encrypted files.\nWhat guarantees do we give to you?\nYou can send one of your encrypted file from your PC and we decrypt it for free.\nBut we can decrypt only 1 file for free. File must not contain valuable information\nDon't try to use third-party decrypt tools because it will destroy your files.\nDiscount 50% available if you contact us first 72 hours.\n\n---------------------------------------------------------------------------------------------------------------------------\n\n\nTo get this software you need write on our e-mail:\nhelpshadow@india.com\n\nReserve e-mail address to contact us:\nhelpshadow@firemail.cc\n\nYour personal ID:\n[redacted 43 alphanumeric chars]" ], "ransomnotes-filenames": [ "_openme.txt" ], "refs": [ "https://twitter.com/demonslay335/status/1072907748155842565" ] }, "uuid": "e37ddc9e-8ceb-4817-a17e-755aa379ed14", "value": "Djvu" }, { "description": "Similar to Samas and BitPaymer, Ryuk is specifically used to target enterprise environments. Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release. Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors. However, Ryuk is only used by GRIM SPIDER and, unlike Hermes, Ryuk has only been used to target enterprise environments. Since Ryuk’s appearance in August, the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD.", "meta": { "payment-method": "Bitcoin", "price": "13.57", "ransomnotes-filenames": [ "RyukReadMe.txt" ], "ransomnotes-refs": [ "https://www.crowdstrike.com/blog/wp-content/uploads/2019/01/RansomeNote-fig3.png", "https://www.crowdstrike.com/blog/wp-content/uploads/2019/01/RansomeNote-fig4.png" ], "refs": [ "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2019-ACT-005.pdf" ] }, "uuid": "f9464c80-b776-4f37-8682-ffde0cf8f718", "value": "Ryuk ransomware" }, { "description": "In August 2017, a new ransomware variant identified as BitPaymer was reported to have ransomed the U.K.’s National Health Service (NHS), with a high ransom demand of 53 BTC (approximately $200,000 USD). The targeting of an organization rather than individuals, and the high ransom demands, made BitPaymer stand out from other contemporary ransomware at the time. Though the encryption and ransom functionality of BitPaymer was not technically sophisticated, the malware contained multiple anti-analysis features that overlapped with Dridex. Later technical analysis of BitPaymer indicated that it had been developed by INDRIK SPIDER, suggesting the group had expanded its criminal operation to include ransomware as a monetization strategy.", "meta": { "payment-method": "Bitcoin Email", "refs": [ "https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/" ], "synonyms": [ "FriedEx", "IEncrypt" ] }, "uuid": "09fa0e0a-f0b2-46ea-8477-653e627b1c22", "value": "BitPaymer" }, { "meta": { "extensions": [ ".locked" ], "payment-method": "Email", "ransomnotes-filenames": [ "README-NOW.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/u/1100723/Ransomware/LockerGoga-ransom-note.png" ], "refs": [ "https://www.bleepingcomputer.com/news/security/new-lockergoga-ransomware-allegedly-used-in-altran-attack/", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2019-ACT-005.pdf" ] }, "related": [ { "dest-uuid": "0529c53a-afe7-4549-899e-3f8735467f96", "tags": [ "estimative-language:likelihood-probability=\"roughly-even-chance\"" ], "type": "similar" } ], "uuid": "1e19dae5-80c3-4358-abcd-2bf0ba4c76fe", "value": "LockerGoga" }, { "description": "We have been observing a malvertising campaign via Rig exploit kit delivering a cryptocurrency-mining malware and the GandCrab ransomware since July 25. On August 1, we found Rig’s traffic stream dropping a then-unknown ransomware. Delving into this seemingly new ransomware, we checked its ransom payment page in the Tor network and saw it was called Princess Evolution (detected by Trend Micro as RANSOM_PRINCESSLOCKER.B), and was actually a new version of the Princess Locker ransomware that emerged in 2016. Based on its recent advertisement in underground forums, it appears that its operators are peddling Princess Evolution as a ransomware as a service (RaaS) and are looking for affiliates.\nThe new malvertising campaign we observed since July 25 is notable in that the malvertisements included Coinhive (COINMINER_MALXMR.TIDBF). Even if users aren’t diverted to the exploit kit and infected with the ransomware, the cybercriminals can still earn illicit profit through cryptocurrency mining. Another characteristic of this new campaign is that they hosted their malvertisement page on a free web hosting service and used domain name system canonical name (DNS CNAME) to map their advertisement domain on a malicious webpage on the service.", "meta": { "payment-method": "Bitcoin", "price": "0.12 (773 $)", "refs": [ "https://blog.trendmicro.com/trendlabs-security-intelligence/ransomware-as-a-service-princess-evolution-looking-for-affiliates/" ], "synonyms": [ "PrincessLocker Evolution" ] }, "uuid": "53da7991-62b7-4fe2-af02-447a0734f41d", "value": "Princess Evolution" }, { "description": "A new Ransomware-as-a-Service called Jokeroo is being promoted on underground hacking sites and via Twitter that allows affiliates to allegedly gain access to a fully functional ransomware and payment server.\nAccording to a malware researcher named Damian, the Jokeroo RaaS first started promoting itself as a GandCrab Ransomware RaaS on the underground hacking forum Exploit.in. ", "meta": { "payment-method": "Bitcoin", "price": "0.0077", "refs": [ "https://www.bleepingcomputer.com/news/security/jokeroo-ransomware-as-a-service-offers-multiple-membership-packages/" ], "synonyms": [ "Fake GandCrab" ] }, "uuid": "8cfa694b-3e6b-410a-828f-037d981870b2", "value": "Jokeroo" }, { "description": "During December 2017, a new variant of the GlobeImposter Ransomware was detected for the first time and reported on malware-traffic-analysis. At first sight this ransomware looks very similar to other ransomware samples and uses common techniques such as process hollowing. However, deeper inspection showed that like LockPoS, which was analyzed by CyberBit, GlobeImposter too bypasses user-mode hooks by directly invoking system calls. Given this evasion technique is being leveraged by new malware samples may indicate that this is a beginning of a trend aiming to bypass user-mode security products.", "meta": { "payment-method": "Bitcoin", "price": "0.35", "refs": [ "https://www.fortinet.com/blog/threat-research/analysis-of-new-globeimposter-ransomware-variant.html" ] }, "uuid": "a4631cef-dc51-4bee-a51f-3f1ea75ff201", "value": "GlobeImposter" }, { "description": "BlackWorm Ransomware is a malicious computer infection that encrypts your files, and then does everything it can to prevent you from restoring them. It needs you to pay $200 for the decryption key, but there is no guarantee that the people behind this infection would really issue the decryption tool for you.", "meta": { "payment-method": "Bitcoin", "price": "200 $", "refs": [ "https://spyware-techie.com/blackworm-ransomware-removal-guide" ] }, "uuid": "457e9a45-607e-41ef-8ad1-bf8684722445", "value": "BlackWorm" }, { "description": "Tellyouthepass is a ransomware that alters system files, registry entries and encodes personal photos, documents, and servers or archives. Army-grade encryption algorithms get used to change the original code of the file and make the data useless.", "meta": { "payment-method": "Bitcoin", "price": "0.2", "refs": [ "https://malware.wikia.org/wiki/Tellyouthepass" ] }, "uuid": "c6ca9b44-d0cd-40c9-9d00-39e0f7bcae79", "value": "Tellyouthepass" }, { "description": "BigBobRoss ransomware is the cryptovirus that requires a ransom in Bitcoin to return encrypted files marked with .obfuscated appendix.", "meta": { "payment-method": "Bitcoin", "refs": [ "https://www.2-spyware.com/remove-bigbobross-ransomware.html" ] }, "uuid": "5d3fc33b-8e90-4d9d-8f45-f047264ce8cb", "value": "BigBobRoss" }, { "description": "First discovered by malware security analyst, Lawrence Abrams, PLANETARY is an updated variant of another high-risk ransomware called HC7.", "meta": { "payment-method": "Bitcoin", "refs": [ "https://www.pcrisk.com/removal-guides/12121-planetary-ransomware" ] }, "uuid": "7c742031-6b3d-4c3a-8b36-9154a6dc7b30", "value": "Planetary" }, { "description": "Cr1ptT0r Ransomware Targets NAS Devices with Old Firmware.", "meta": { "payment-method": "Bitcoin", "refs": [ "https://www.coveware.com/blog/2019/3/13/cr1ptt0r-ransomware-targets-nas-devices-with-old-firmware", "https://malpedia.caad.fkie.fraunhofer.de/details/elf.cr1ptt0r" ], "synonyms": [ "Criptt0r", "Cr1pt0r", "Cripttor" ] }, "uuid": "e19d92d7-cf17-4b2b-8ec2-1efc6df2fa1e", "value": "Cr1ptT0r" }, { "description": "Attackers are actively exploiting a recently disclosed vulnerability in Oracle WebLogic to install a new variant of ransomware called \"Sodinokibi.\" Sodinokibi attempts to encrypt data in a user's directory and delete shadow copy backups to make data recovery more difficult. Oracle first patched the issue on April 26, outside of their normal patch cycle, and assigned it CVE-2019-2725. This vulnerability is easy for attackers to exploit, as anyone with HTTP access to the WebLogic server could carry out an attack. Because of this, the bug has a CVSS score of 9.8/10. Attackers have been making use of this exploit in the wild since at least April 17. Cisco's Incident Response (IR) team, along with Cisco Talos, are actively investigating these attacks and Sodinokibi.", "meta": { "links": [ "http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/", "http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/", "http://blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion/Blog" ], "refs": [ "https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html", "https://www.zdnet.com/article/revil-ransomware-group-resurfaces-after-brief-hiatus", "https://www.macrumors.com/2021/04/26/revil-delists-stolen-apple-schematics-threat", "https://www.theverge.com/2021/7/22/22589643/ransomware-kaseya-vsa-decryptor-revil", "http://www.fsb.ru/fsb/press/message/single.htm%21id%3D10439388%40fsbMessage.html", "https://analyst1.com/file-assets/History-of-REvil.pdf", "https://angle.ankura.com/post/102hcny/revix-linux-ransomware", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://cybersecurity.att.com/blogs/labs-research/revils-new-linux-version", "https://cybleinc.com/2021/07/03/uncensored-interview-with-revil-sodinokibi-ransomware-operators/", "https://diicot.ro/mass-media/3341-comunicat-de-presa-2-08-11-2021", "https://documents.trendmicro.com/assets/rpt/rpt-navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report.pdf", "https://github.com/f0wl/REconfig-linux", "https://home.treasury.gov/news/press-releases/jy0471", "https://ke-la.com/will-the-revils-story-finally-be-over/", "https://krebsonsecurity.com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/", "https://malienist.medium.com/revix-linux-ransomware-d736956150d0", "https://otx.alienvault.com/pulse/60da2c80aa5400db8f1561d5", "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v", "https://russian.rt.com/russia/article/926347-barnaulec-rozysk-fbr-kibermoshennichestvo", "https://storage.courtlistener.com/recap/gov.uscourts.txnd.351760/gov.uscourts.txnd.351760.1.0_3.pdf", "https://storage.courtlistener.com/recap/gov.uscourts.txnd.352371/gov.uscourts.txnd.352371.1.0_1.pdf", "https://therecord.media/us-arrests-and-charges-ukrainian-man-for-kaseya-ransomware-attack/", "https://threatpost.com/linux-variant-ransomware-vmwares-nas/167511/", "https://threatpost.com/ransomware-revil-sites-disappears/167745/", "https://twitter.com/AdamTheAnalyst/status/1409499591452639242?s=20", "https://twitter.com/IntezerLabs/status/1452980772953071619", "https://twitter.com/VK_Intel/status/1409601311092490248", "https://twitter.com/VK_Intel/status/1409601311092490248?s=20", "https://us-cert.cisa.gov/ncas/current-activity/2021/07/04/cisa-fbi-guidance-msps-and-their-customers-affected-kaseya-vsa", "https://www.accenture.com/us-en/blogs/cyber-defense/moving-left-ransomware-boom", "https://www.advintel.io/post/storm-in-safe-haven-takeaways-from-russian-authorities-takedown-of-revil", "https://www.bbc.com/news/technology-59297187", "https://www.bleepingcomputer.com/news/security/revil-ransomware-shuts-down-again-after-tor-sites-were-hijacked/", "https://www.br.de/nachrichten/deutschland-welt/mutmasslicher-ransomware-millionaer-identifiziert,Sn3iHgJ", "https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/", "https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/", "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/", "https://www.darkowl.com/blog-content/page-not-found-revil-darknet-services-offline-after-attack-last-weekend", "https://www.darktrace.com/en/blog/staying-ahead-of-r-evils-ransomware-as-a-service-business-model/", "https://www.digitalshadows.com/blog-and-research/revil-analysis-of-competing-hypotheses/", "https://www.domaintools.com/resources/blog/the-most-prolific-ransomware-families-a-defenders-guide", "https://www.elliptic.co/blog/revil-revealed-tracking-ransomware-negotiation-and-payment", "https://www.fbi.gov/wanted/cyber/yevgyeniy-igoryevich-polyanin", "https://www.fincen.gov/sites/default/files/advisory/2021-11-08/FinCEN%20Ransomware%20Advisory_FINAL_508_.pdf", "https://www.flashpoint-intel.com/blog/interview-with-revil-affiliated-ransomware-contractor/", "https://www.flashpoint-intel.com/blog/revil-disappears-again/", "https://www.justice.gov/opa/pr/ukrainian-arrested-and-charged-ransomware-attack-kaseya", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.reuters.com/technology/exclusive-governments-turn-tables-ransomware-gang-revil-by-pushing-it-offline-2021-10-21/", "https://www.secureworks.com/blog/revil-ransomware-reemerges-after-shutdown-universal-decryptor-released", "https://www.trendmicro.com/en_in/research/21/k/global-operations-lead-to-arrests-of-alleged-members-of-gandcrab.html", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-revil", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://www.youtube.com/watch?v=mDUMpYAOMOo", "https://www.youtube.com/watch?v=ptbNMlWxYnE", "http://www.secureworks.com/research/threat-profiles/gold-southfield", "https://areteir.com/wp-content/uploads/2020/07/Arete_Insight_Sodino-Ransomware_June-2020.pdf", "https://asec.ahnlab.com/ko/19640/", "https://asec.ahnlab.com/ko/19860/", "https://awakesecurity.com/blog/threat-hunting-for-revil-ransomware/", "https://blag.nullteilerfrei.de/2019/11/09/api-hashing-why-and-how/", "https://blag.nullteilerfrei.de/2020/02/02/defeating-sodinokibi-revil-string-obfuscation-in-ghidra/", "https://blog.amossys.fr/sodinokibi-malware-analysis.html", "https://blog.gigamon.com/2021/07/08/observations-and-recommendations-from-the-ongoing-revil-kaseya-incident/", "https://blog.group-ib.com/REvil_RaaS", "https://blog.intel471.com/2020/03/31/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/", "https://blog.malwarebytes.com/threat-analysis/2020/11/german-users-targeted-with-gootkit-banker-or-revil-ransomware/", "https://blog.morphisec.com/real-time-prevention-of-the-kaseya-vsa-supply-chain-revil-ransomware-attack", "https://blog.redteam.pl/2020/05/sodinokibi-revil-ransomware.html", "https://blog.sensecy.com/2020/08/20/global-ransomware-attacks-in-2020-the-top-4-vulnerabilities/", "https://blog.talosintelligence.com/2021/03/ctir-trends-winter-2020-21.html", "https://blog.truesec.com/2021/07/04/kaseya-supply-chain-attack-targeting-msps-to-deliver-revil-ransomware/", "https://blog.truesec.com/2021/07/06/kaseya-vsa-zero-day-exploit", "https://blogs.blackberry.com/en/2021/05/threat-thursday-dr-revil-ransomware-strikes-again-employs-double-extortion-tactics", "https://blogs.blackberry.com/en/2021/11/revil-under-the-microscope", "https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus", "https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://community.riskiq.com/article/3315064b", "https://cti-league.com/wp-content/uploads/2021/02/CTI-League-Darknet-Report-2021.pdf", "https://dissectingmalwa.re/germanwipers-big-brother-gandgrabs-kid-sodinokibi.html", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b", "https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf", "https://drive.google.com/file/d/1ph1E0onZ7TiNyG87k4WjofCKNuCafMLk/view", "https://f.hubspotusercontent10.net/hubfs/5943619/Whitepaper-Downloads/Ransomware_in_ICS_Environments_Whitepaper_10_12_20.pdf", "https://f.hubspotusercontent10.net/hubfs/7095517/FLINT-Kaseya-Another%20Massive%20Heist%20by%20REvil.pdf", "https://gist.githubusercontent.com/fwosar/a63e1249bfccb8395b961d3d780c0354/raw/312b2bbc566cbee2dac7b143dc143c1913ddb729/revil.json", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://hatching.io/blog/ransomware-part2", "https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.pdf", "https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf", "https://ibm.ent.box.com/s/hs5pcayhbbhjvj8di5sqdpbbd88tsh89", "https://ics-cert.kaspersky.com/media/KASPERSKY_H1_2020_ICS_REPORT_EN.pdf", "https://intel471.com/blog/changes-in-revil-ransomware-version-2-2", "https://isc.sans.edu/diary/27012", "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf", "https://kaseya.app.box.com/s/0ysvgss7w48nxh8k1xt7fqhbcjxhas40", "https://ke-la.com/darknet-threat-actors-are-not-playing-games-with-the-gaming-industry/", "https://ke-la.com/easy-way-in-5-ransomware-victims-had-their-pulse-secure-vpn-credentials-leaked/", "https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/", "https://ke-la.com/ransomware-gangs-are-starting-to-look-like-oceans-11/", "https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/", "https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/", "https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/", "https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/", "https://medium.com/@underthebreach/tracking-down-revils-lalartu-by-utilizing-multiple-osint-methods-2bf3a6c65a80", "https://medium.com/s2wlab/deep-analysis-of-revil-ransomware-written-in-korean-d1899c0e9317", "https://medium.com/s2wlab/w4-may-en-story-of-the-week-ransomware-on-the-darkweb-5f5b8d4c3b6f", "https://news.sophos.com/en-us/2021/06/11/relentless-revil-revealed/", "https://news.sophos.com/en-us/2021/06/30/mtr-in-real-time-hand-to-hand-combat-with-revil-ransomware-chasing-a-2-5-million-pay-day/", "https://news.sophos.com/en-us/2021/06/30/what-to-expect-when-youve-been-hit-with-revil-ransomware/", "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/", "https://public.intel471.com/blog/revil-ransomware-interview-russian-osint-100-million/", "https://raw.githubusercontent.com/k-vitali/Malware-Misc-RE/master/2022-05-01-revil-reborn-ransom.vk.cfg.txt", "https://redcanary.com/blog/uncompromised-kaseya/", "https://research.checkpoint.com/2020/graphology-of-an-exploit-playbit/", "https://resources.malwarebytes.com/files/2020/02/2020_State-of-Malware-Report.pdf", "https://searchsecurity.techtarget.com/feature/Ransomware-negotiations-An-inside-look-at-the-process", "https://securelist.com/ransomware-world-in-2021/102169/", "https://securelist.com/revil-ransomware-attack-on-msp-companies/103075/", "https://securelist.com/sodin-ransomware/91473/", "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/", "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/", "https://securityaffairs.co/wordpress/98694/malware/sodinokibi-kenneth-cole-data-breach.html", "https://securityintelligence.com/posts/sodinokibi-ransomware-incident-response-intelligence-together/", "https://securityintelligence.com/posts/sodinokibi-revil-ransomware-disrupt-trade-secrets/", "https://securityscorecard.com/research/a-detailed-analysis-of-the-last-version-of-revil-ransomware", "https://sites.temple.edu/care/ci-rw-attacks/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/kaseya-ransomware-supply-chain", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/sodinokibi-ransomware-cobalt-strike-pos", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://teamt5.org/en/posts/introducing-the-most-profitable-ransomware-revil/", "https://teamt5.org/tw/posts/revil-dll-sideloading-technique-used-by-other-hackers/", "https://tehtris.com/fr/peut-on-neutraliser-un-ransomware-lance-en-tant-que-system-sur-des-milliers-de-machines-en-meme-temps/", "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/", "https://thehackernews.com/2022/03/ukrainian-hacker-linked-to-revil.html", "https://therecord.media/an-interview-with-blackmatter-a-new-ransomware-group-thats-learning-from-the-mistakes-of-darkside-and-revil/", "https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/", "https://therecord.media/darkside-ransomware-gang-says-it-lost-control-of-its-servers-money-a-day-after-biden-threat/", "https://therecord.media/i-scrounged-through-the-trash-heaps-now-im-a-millionaire-an-interview-with-revils-unknown/", "https://therecord.media/ransomwhere-project-wants-to-create-a-database-of-past-ransomware-payments/", "https://therecord.media/revil-ransomware-executes-supply-chain-attack-via-malicious-kaseya-update/", "https://threatintel.blog/OPBlueRaven-Part1/", "https://twitter.com/Jacob_Pimental/status/1391055792774729728", "https://twitter.com/Jacob_Pimental/status/1398356030489251842?s=20", "https://twitter.com/LloydLabs/status/1411098844209819648", "https://twitter.com/R3MRUM/status/1412064882623713283", "https://twitter.com/SophosLabs/status/1412056467201462276", "https://twitter.com/SophosLabs/status/1413616952313004040?s=20", "https://twitter.com/SyscallE/status/1411074271875670022", "https://twitter.com/VK_Intel/status/1374571480370061312?s=20", "https://twitter.com/VK_Intel/status/1411066870350942213", "https://twitter.com/_alex_il_/status/1412403420217159694", "https://twitter.com/fwosar/status/1411281334870368260", "https://twitter.com/fwosar/status/1420119812815138824", "https://twitter.com/resecurity_com/status/1412662343796813827", "https://twitter.com/svch0st/status/1411537562380816384", "https://unit42.paloaltonetworks.com/prometheus-ransomware/", "https://unit42.paloaltonetworks.com/revil-threat-actors/", "https://unit42.paloaltonetworks.com/threat-brief-kaseya-vsa-ransomware-attacks/", "https://us-cert.cisa.gov/ncas/alerts/aa20-345a", "https://velzart.nl/blog/ransomeware/", "https://vimeo.com/449849549", "https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/", "https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion", "https://www.acronis.com/en-sg/articles/sodinokibi-ransomware/", "https://www.advanced-intel.com/post/adversarial-perspective-advintel-breach-avoidance-through-monitoring-initial-vulnerabilities", "https://www.advanced-intel.com/post/from-qbot-with-revil-ransomware-initial-attack-exposure-of-jbs", "https://www.advanced-intel.com/post/inside-revil-extortionist-machine-predictive-insights", "https://www.advanced-intel.com/post/revil-vanishes-from-underground-infrastructure-down-support-staff-adverts-silent", "https://www.advanced-intel.com/post/the-dark-web-of-intrigue-how-revil-used-the-underground-ecosystem-to-form-an-extortion-cartel", "https://www.appgate.com/blog/electric-company-ransomware-attack-calls-for-14-million-in-ransom", "https://www.bankinfosecurity.com/interviews/ransomware-files-episode-6-kaseya-revil-i-5045", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/wp-spark-state-of-ransomware.pdf", "https://www.bleepingcomputer.com/news/security/a-look-inside-the-highly-profitable-sodinokibi-ransomware-business/", "https://www.bleepingcomputer.com/news/security/another-ransomware-will-now-publish-victims-data-if-not-paid/", "https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/", "https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/", "https://www.bleepingcomputer.com/news/security/fbi-revil-cybergang-behind-the-jbs-ransomware-attack/", "https://www.bleepingcomputer.com/news/security/kaseya-obtains-universal-decryptor-for-revil-ransomware-victims/", "https://www.bleepingcomputer.com/news/security/kaseyas-universal-revil-decryption-key-leaked-on-a-hacking-forum/", "https://www.bleepingcomputer.com/news/security/new-jersey-synagogue-suffers-sodinokibi-ransomware-attack/", "https://www.bleepingcomputer.com/news/security/popular-russian-hacking-forum-xss-bans-all-ransomware-topics/", "https://www.bleepingcomputer.com/news/security/ransomware-threatens-to-reveal-companys-dirty-secrets/", "https://www.bleepingcomputer.com/news/security/revil-gang-tries-to-extort-apple-threatens-to-sell-stolen-blueprints/", "https://www.bleepingcomputer.com/news/security/revil-ransomware-devs-added-a-backdoor-to-cheat-affiliates/", "https://www.bleepingcomputer.com/news/security/revil-ransomware-gang-claims-over-100-million-profit-in-a-year/", "https://www.bleepingcomputer.com/news/security/revil-ransomware-gangs-web-sites-mysteriously-shut-down/", "https://www.bleepingcomputer.com/news/security/revil-ransomware-has-a-new-windows-safe-mode-encryption-mode/", "https://www.bleepingcomputer.com/news/security/revil-ransomware-hits-1-000-plus-companies-in-msp-supply-chain-attack/", "https://www.bleepingcomputer.com/news/security/revil-ransomware-hits-managedcom-hosting-provider-500k-ransom/", "https://www.bleepingcomputer.com/news/security/revil-ransomware-returns-new-malware-sample-confirms-gang-is-back/", "https://www.bleepingcomputer.com/news/security/revil-ransomwares-servers-mysteriously-come-back-online/", "https://www.bleepingcomputer.com/news/security/revils-tor-sites-come-alive-to-redirect-to-new-ransomware-operation/", "https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-hits-new-york-airport-systems/", "https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-hits-travelex-demands-3-million/", "https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-may-tip-nasdaq-on-attacks-to-hurt-stock-prices/", "https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-publishes-stolen-data-for-the-first-time/", "https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-says-travelex-will-pay-one-way-or-another/", "https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-threatens-to-publish-data-of-automotive-group/", "https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-to-stop-taking-bitcoin-to-hide-money-trail/", "https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/", "https://www.boll.ch/datasheets/WG_Threat_Report_EN.pdf", "https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2020.pdf?__blob=publicationFile&v=2", "https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-009/", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf", "https://www.certego.net/en/news/malware-tales-sodinokibi/", "https://www.cnbc.com/2021/04/23/axis-of-revil-inside-the-hacker-collective-taunting-apple.html", "https://www.connectwise.com/resources/revil-profile", "https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound", "https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware", "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/", "https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout", "https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/", "https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-2/", "https://www.crowdstrike.com/blog/how-crowdstrike-stops-revil-ransomware-from-kaseya-attack/", "https://www.crowdstrike.com/blog/how-falcon-complete-thwarted-a-revil-ransomware-attack/", "https://www.crowdstrike.com/blog/how-to-defend-against-conti-darkside-revil-and-other-ransomware/", "https://www.crowdstrike.com/blog/the-evolution-of-revil-ransomware-and-pinchy-spider/", "https://www.cybereason.com/blog/cybereason-vs-revil-ransomware-the-kaseya-chronicles", "https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/", "https://www.cyjax.com/2021/07/09/revilevolution/", "https://www.databreaches.net/a-former-darkside-listing-shows-up-on-revils-leak-site/", "https://www.digitalshadows.com/blog-and-research/competitions-on-russian-language-cybercriminal-forums-sharing-expertise-or-threat-actor-showboating/", "https://www.digitalshadows.com/blog-and-research/ransomware-as-a-service-rogue-affiliates-and-whats-next/", "https://www.documentcloud.org/documents/21505031-hgsac-staff-report-americas-data-held-hostage-032422", "https://www.domaintools.com/resources/blog/revealing-revil-ransomware-with-domaintools-and-maltego", "https://www.elastic.co/blog/elastic-security-prevents-100-percent-of-revil-ransomware-samples?utm_content=&utm_medium=social&utm_source=twitter", "https://www.elastic.co/blog/ransomware-interrupted-sodinokibi-and-the-supply-chain", "https://www.europol.europa.eu/newsroom/news/five-affiliates-to-sodinokibi/revil-unplugged", "https://www.flashpoint-intel.com/blog/chatter-indicates-blackmatter-as-revil-successor/", "https://www.flashpoint-intel.com/blog/cl0p-and-revil-escalate-their-ransomware-tactics/", "https://www.flashpoint-intel.com/blog/darkside-ransomware-links-to-revil-difficult-to-dismiss/", "https://www.flashpoint-intel.com/blog/possible-universal-revil-master-key-posted-to-xss/", "https://www.flashpoint-intel.com/blog/revils-cryptobackdoor-con-ransomware-groups-tactics-roil-affiliates-sparking-a-fallout/", "https://www.goggleheadedhacker.com/blog/post/reversing-crypto-functions", "https://www.goggleheadedhacker.com/blog/post/sodinokibi-ransomware-analysis", "https://www.grahamcluley.com/travelex-paid-ransom/", "https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/", "https://www.hsgac.senate.gov/media/minority-media/new-portman-report-demonstrates-threat-ransomware-presents-to-the-united-states", "https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox", "https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling", "https://www.huntress.com/blog/security-researchers-hunt-to-discover-origins-of-the-kaseya-vsa-mass-ransomware-incident", "https://www.ironnet.com/blog/ransomware-graphic-blog", "https://www.justice.gov/opa/pr/sodinokibirevil-ransomware-defendant-extradited-united-states-and-arraigned-texas", "https://www.kaseya.com/potential-attack-on-kaseya-vsa/", "https://www.kpn.com/security-blogs/Tracking-REvil.htm", "https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/", "https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/", "https://www.netskope.com/blog/netskope-threat-coverage-revil", "https://www.nytimes.com/2019/08/22/us/ransomware-attacks-hacking.html", "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf", "https://www.pandasecurity.com/emailhtml/2007-CAM-RANSOMWARE-AD360-WG/2006-Report-Sodinokibi-EN.pdf", "https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware", "https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf", "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf", "https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html", "https://www.recordedfuture.com/blackmatter-ransomware-successor-darkside-revil/", "https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransomware_incident_in_progress/", "https://www.secureworks.com/blog/revil-development-adds-confidence-about-gold-southfield-reemergence?linkId=164334801", "https://www.secureworks.com/blog/revil-the-gandcrab-connection", "https://www.secureworks.com/research/lv-ransomware", "https://www.secureworks.com/research/revil-sodinokibi-ransomware", "https://www.secureworks.com/research/threat-profiles/gold-southfield", "https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html", "https://www.splunk.com/en_us/blog/security/kaseya-sera-what-revil-shall-encrypt-shall-encrypt.html", "https://www.splunk.com/en_us/blog/security/revil-ransomware-threat-research-update-and-detections.html", "https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf", "https://www.tgsoft.it/english/news_archivio_eng.asp?id=1004", "https://www.trendmicro.com/en_us/research/20/l/the-impact-of-modern-ransomware-on-manufacturing-networks.html", "https://www.trendmicro.com/en_us/research/21/a/sodinokibi-ransomware.html", "https://www.trendmicro.com/en_us/research/21/h/supply-chain-attacks-from-a-managed-detection-and-response-persp.html", "https://www.trendmicro.com/en_us/research/22/g/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-double-extortion-and-beyond-revil-clop-and-conti", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deeper-into-the-kaseya-vsa-attack-revil-returns-and-other-hackers-are-riding-their-coattails/", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/undressing-the-revil/", "https://www.washingtonpost.com/national-security/ransomware-fbi-revil-decryption-key/2021/09/21/4a9417d0-f15f-11eb-a452-4da5fe48582d_story.html", "https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf", "https://www.youtube.com/watch?v=LUxOcpIRxmg", "https://www.youtube.com/watch?v=P8o6GItci5w", "https://www.youtube.com/watch?v=QYQQUUpU04s", "https://www.youtube.com/watch?v=l2P5CMH9TE0", "https://www.youtube.com/watch?v=tZVFMVm5GAk", "https://www.zdnet.com/article/revil-ransomware-gang-acquires-kpot-malware/", "https://www.zdnet.com/article/revil-ransomware-gang-launches-auction-site-to-sell-stolen-data/", "https://www.zscaler.com/blogs/security-research/kaseya-supply-chain-ransomware-attack-technical-analysis-revil-payload", "https://www.ransomlook.io/group/revil" ], "synonyms": [ "REvil", "Revil" ] }, "uuid": "24bd9a4b-2b66-428b-8e1c-6b280b056c00", "value": "Sodinokibi" }, { "description": "Phobos exploits open or poorly secured RDP ports to sneak inside networks and execute a ransomware attack, encrypting files and demanding a ransom be paid in bitcoin for returning the files, which in this case are locked with a .phobos extension.", "meta": { "payment-method": "Bitcoin", "refs": [ "https://www.zdnet.com/article/new-phobos-ransomware-exploits-weak-security-to-hit-targets-around-the-world/" ], "synonyms": [ "Java NotDharma" ] }, "uuid": "d2c7fb08-293e-453b-a213-adeb79505767", "value": "Phobos" }, { "description": "A new ransomware is in the dark market which encrypts all the files on the device and redirects victims to the RIG exploit kit.", "meta": { "payment-method": "Bitcoin", "price": "300 $", "refs": [ "https://www.ehackingnews.com/2019/05/getcrypt-ransomware-modus-operandi-and.html" ] }, "uuid": "7c9df1bd-9212-4ce3-b407-636e41bc4eea", "value": "GetCrypt" }, { "description": "A new ransomware family dubbed “Nemty” for the extension it adds to encrypted files has recently surfaced in the wild. According to a report from Bleeping Computer, New York-based reverse engineer Vitali Kremez posits that Nemty is possibly delivered through exposed remote desktop connections.", "meta": { "links": [ "http://zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion" ], "payment-method": "Bitcoin", "price": "1000 $", "refs": [ "https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/nemty-ransomware-possibly-spreads-through-exposed-remote-desktop-connections", "http://www.secureworks.com/research/threat-profiles/gold-mansard", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://github.com/albertzsigovits/malware-notes/blob/master/Nemty.md", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://labs.sentinelone.com/meet-nemty-successor-nefilim-nephilim-ransomware/", "https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145", "https://medium.com/csis-techblog/the-nemty-affiliate-model-13f5cf7ab66b", "https://raw.githubusercontent.com/k-vitali/Malware-Misc-RE/master/2019-08-24-nemty-ransomware-notes.vk.raw", "https://securelist.com/evolution-of-jsworm-ransomware/102428/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nemty-ransomware-trik-botnet", "https://www.bleepingcomputer.com/news/security/fake-paypal-site-spreads-nemty-ransomware/", "https://www.bleepingcomputer.com/news/security/nemty-ransomware-decryptor-released-recover-files-for-free/", "https://www.bleepingcomputer.com/news/security/nemty-ransomware-gets-distribution-from-rig-exploit-kit/", "https://www.bleepingcomputer.com/news/security/new-nemty-ransomware-may-spread-via-compromised-rdp-connections/", "https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/", "https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware", "https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/", "https://www.fortinet.com/blog/threat-research/nemty-ransomware-early-stage-threat.html", "https://www.lastline.com/labsblog/nemty-ransomware-scaling-up-apac-mailboxes-swarmed-dual-downloaders/", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/", "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/", "https://www.sentinelone.com/labs/karma-ransomware-an-emerging-threat-with-a-hint-of-nemty-pedigree/", "https://www.sentinelone.com/labs/nokoyawa-ransomware-new-karma-nemty-variant-wears-thin-disguise/", "https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf", "https://www.tesorion.nl/en/posts/nemty-update-decryptors-for-nemty-1-5-and-1-6/", "https://www.tesorion.nl/nemty-update-decryptors-for-nemty-1-5-and-1-6/", "https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf", "https://www.ransomlook.io/group/nemty" ] }, "related": [ { "dest-uuid": "d12f369c-f776-468a-8abf-8000b1b30642", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "related-to" } ], "uuid": "5fb75933-1ed5-4512-a062-d39865eedab0", "value": "Nemty" }, { "description": "Buran is a new version of the Vega ransomware strain (a.k.a. Jamper, Ghost, Buhtrap) that attacked accountants from February through April 2019. The new Buran ransomware first was discovered by nao_sec in June 2019, delivered by the RIG Exploit Kit, as reported by BleepingComputer.", "meta": { "refs": [ "https://www.acronis.com/en-us/blog/posts/meet-buran-new-delphi-ransomware-delivered-rig-exploit-kit" ] }, "uuid": "a92b2165-29e7-463a-b3d5-c8b7d8a25f65", "value": "Buran" }, { "description": "The Hildacrypt ransomware encrypts the victim’s files with a strong encryption algorithm and the filename extension .hilda until the victim pays a fee to get them back.", "meta": { "refs": [ "https://securitynews.sonicwall.com/xmlpost/hildacrypt-ransomware-actively-spreading-in-the-wild/" ] }, "uuid": "25fcb177-7219-4414-b5de-8aeb2e6d146f", "value": "Hildacrypt" }, { "description": "Mr. Dec ransomware is cryptovirus that was first spotted in mid-May 2018, and since then was updated multiple times. The ransomware encrypts all personal data on the device with the help of AES encryption algorithm and appends .[ID]random 16 characters[ID] file extension, preventing from their further usage.", "meta": { "encryption": "AES", "refs": [ "https://www.2-spyware.com/remove-mr-dec-ransomware.html", "https://id-ransomware.blogspot.com/2018/05/mrdec-ransomware.html" ], "synonyms": [ "MrDec", "Sherminator" ] }, "uuid": "2e8aa6da-00b1-4222-b212-c48a7348893c", "value": "Mr.Dec" }, { "description": "Freezing crypto ransomware encrypts user data using AES, and then requires a ransom in # BTC to return the files. Original title: not indicated in the note. The file says: FreeMe.exe", "meta": { "encryption": "AES", "refs": [ "http://id-ransomware.blogspot.com/2019/06/freeme-freezing-ransomware.html" ], "synonyms": [ "Freezing" ] }, "uuid": "9b074569-b90c-44e6-b9b2-e6e19a48118d", "value": "Freeme" }, { "description": "We have dubbed this new ransomware DoppelPaymer because it shares most of its code with the BitPaymer ransomware operated by INDRIK SPIDER. However, there are a number of differences between DoppelPaymer and BitPaymer, which may signify that one or more members of INDRIK SPIDER have split from the group and forked the source code of both Dridex and BitPaymer to start their own Big Game Hunting ransomware operation.", "meta": { "encryption": "AES", "links": [ "http://hpoo4dosa3x4ognfxpqcrjwnsigvslm7kv6hvmhh2yqczaxy3j6qnwad.onion/" ], "refs": [ "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/", "https://malpedia.caad.fkie.fraunhofer.de/details/win.doppelpaymer", "https://aithority.com/security/doppelpaymer-ransomware-attack-sinks-a-global-motor-companys-20-million", "https://www.zscaler.com/blogs/security-research/doppelpaymer-continues-cause-grief-through-rebranding", "http://www.secureworks.com/research/threat-profiles/gold-heron", "https://apnews.com/article/virus-outbreak-elections-georgia-voting-2020-voting-c191f128b36d1c0334c9d0b173daa18c", "https://blog.chainalysis.com/reports/ransomware-connections-maze-egregor-suncrypt-doppelpaymer", "https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.pdf", "https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf", "https://intel471.com/blog/ransomware-attack-access-merchants-infostealer-escrow-service/", "https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/", "https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/", "https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/", "https://killingthebear.jorgetesta.tech/actors/evil-corp", "https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/", "https://lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf", "https://medium.com/s2wlab/operation-synctrek-e5013df8d167", "https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/", "https://redcanary.com/blog/grief-ransomware/", "https://sites.temple.edu/care/ci-rw-attacks/", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://techcrunch.com/2020/03/01/visser-breach/", "https://twitter.com/AltShiftPrtScn/status/1385103712918642688", "https://twitter.com/BrettCallow/status/1453557686830727177?s=20", "https://twitter.com/vikas891/status/1385306823662587905", "https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/", "https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://www.armor.com/resources/threat-intelligence/the-evolution-of-doppel-spider-from-bitpaymer-to-grief-ransomware/", "https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-launches-site-to-post-victims-data/", "https://www.bleepingcomputer.com/news/security/fake-microsoft-teams-updates-lead-to-cobalt-strike-deployment/", "https://www.bleepingcomputer.com/news/security/foxconn-electronics-giant-hit-by-ransomware-34-million-ransom/", "https://www.bleepingcomputer.com/news/security/laptop-maker-compal-hit-by-ransomware-17-million-demanded/", "https://www.bleepingcomputer.com/news/security/ransomware-attackers-use-your-cloud-backups-against-you/", "https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/", "https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-009/", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf", "https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1", "https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/", "https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/", "https://www.crowdstrike.com/blog/how-doppelpaymer-hunts-and-kills-windows-processes/", "https://www.fireeye.com/blog/threat-research/2020/07/financially-motivated-actors-are-expanding-access-into-ot.html", "https://www.heise.de/news/Uniklinik-Duesseldorf-Ransomware-DoppelPaymer-soll-hinter-dem-Angriff-stecken-4908608.html", "https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/", "https://www.ic3.gov/Media/News/2020/201215-1.pdf", "https://www.mandiant.com/resources/financially-motivated-actors-are-expanding-access-into-ot", "https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions", "https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/", "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf", "https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html", "https://www.secureworks.com/research/threat-profiles/gold-heron", "https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf", "https://www.trendmicro.com/en_us/research/21/a/an-overview-of-the-doppelpaymer-ransomware.html", "https://www.zdnet.com/article/ransomware-gang-says-it-breached-one-of-nasas-it-contractors/", "https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/", "http://www.secureworks.com/research/threat-profiles/gold-drake", "https://assets.sentinelone.com/sentinellabs/sentinellabs_EvilCorp", "https://blog.trendmicro.com/trendlabs-security-intelligence/account-with-admin-privileges-abused-to-install-bitpaymer-ransomware-via-psexec", "https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader/", "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf", "https://nakedsecurity.sophos.com/2018/09/11/the-rise-of-targeted-ransomware/", "https://www.bleepingcomputer.com/news/security/new-evil-corp-ransomware-mimics-payloadbin-gang-to-evade-us-sanctions/", "https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/research/everis-bitpaymer-ransomware-attack-analysis-dridex/", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf", "https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware", "https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/", "https://www.crowdstrike.com/blog/hades-ransomware-successor-to-indrik-spiders-wastedlocker/", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/csi-evidence-indicators-for-targeted-ransomware-attacks/", "https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf", "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf", "https://www.secureworks.com/research/threat-profiles/gold-drake", "https://www.sentinelone.com/wp-content/uploads/2022/02/S1_-SentinelLabs_SanctionsBeDamned_final_02.pdf", "https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/", "https://www.youtube.com/watch?v=LUxOcpIRxmg", "https://www.ransomlook.io/group/doppelpaymer" ], "synonyms": [ "Pay OR Grief", "BitPaymer", "IEncrypt", "FriedEx" ] }, "uuid": "3d8989dc-9a10-4cae-ab24-ff0abed487f4", "value": "DoppelPaymer" }, { "description": "This crypto ransomware encrypts enterprise LAN data with AES (ECB mode), and then requires a ransom in # BTC to return the files.", "meta": { "encryption": "AES", "refs": [ "https://id-ransomware.blogspot.com/2019/01/unnamed-desync-ransomware.html" ] }, "uuid": "e5288fc1-ff2a-4992-a1fb-6a8ef612de51", "value": "Desync" }, { "description": "Maze Ransomware encrypts files and makes them inaccessible while adding a custom extension containing part of the ID of the victim. The ransom note is placed inside a text file and an htm file. There are a few different extensions appended to files which are randomly generated.", "meta": { "encryption": "ChaCha20 and RSA", "links": [ "http://xfr3txoorcyy7tikjgj5dk3rvo3vsrpyaxnclyohkbfp3h277ap4tiad.onion" ], "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.maze", "https://www.bleepingcomputer.com/news/security/maze-ransomware-now-delivered-by-spelevo-exploit-kit/", "https://www.proofpoint.com/us/threat-insight/post/ta2101-plays-government-imposter-distribute-malware-german-italian-and-us", "https://techcrunch.com/2020/11/02/maze-ransomware-group-shutting-down", "https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html", "http://www.secureworks.com/research/threat-profiles/gold-village", "https://adversary.crowdstrike.com/adversary/twisted-spider/", "https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel", "https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf", "https://blog.chainalysis.com/reports/ransomware-connections-maze-egregor-suncrypt-doppelpaymer", "https://blog.minerva-labs.com/egregor-ransomware-an-in-depth-analysis", "https://blog.redteam.pl/2020/05/sodinokibi-revil-ransomware.html", "https://blog.sensecy.com/2020/08/20/global-ransomware-attacks-in-2020-the-top-4-vulnerabilities/", "https://blog.talosintelligence.com/2019/12/IR-Lessons-Maze.html", "https://blog.talosintelligence.com/2020/09/CTIR-quarterly-trends-Q4-2020.html", "https://blog.talosintelligence.com/2020/12/quarterly-ir-report-fall-2020-q4.html", "https://blogs.quickheal.com/maze-ransomware-continues-threat-consumers/", "https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://cti-league.com/wp-content/uploads/2021/02/CTI-League-Darknet-Report-2021.pdf", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://download.bitdefender.com/resources/files/News/CaseStudies/study/318/Bitdefender-TRR-Whitepaper-Maze-creat4351-en-EN-GenericUse.pdf", "https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf", "https://github.com/albertzsigovits/malware-notes/blob/master/Maze.md", "https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Maze.md", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://id-ransomware.blogspot.com/2019/05/chacha-ransomware.html", "https://intel471.com/blog/conti-ransomware-cooperation-maze-lockbit-ragnar-locker", "https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/", "https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/", "https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/", "https://killbit.medium.com/applying-the-diamond-model-to-cognizant-msp-and-maze-ransomware-and-a-policy-assessment-498f01bd723f", "https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/", "https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/", "https://labs.sentinelone.com/case-study-catching-a-human-operated-maze-ransomware-attack-in-action/", "https://labs.sentinelone.com/enter-the-maze-demystifying-an-affiliate-involved-in-maze-snow/", "https://media-exp1.licdn.com/dms/document/C4E1FAQHyhJYCWxq5eg/feedshare-document-pdf-analyzed/0?e=1584129600&v=beta&t=9wTDR-mZPDF4ET7ABNgE2ab9g8e9wxQrhXsxI1cSX8U", "https://nakedsecurity.sophos.com/2020/06/04/nuclear-missile-contractor-hacked-in-maze-ransomware-attack/", "https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/", "https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/", "https://news.sophos.com/en-us/2020/09/22/mtr-casebook-blocking-a-15-million-maze-ransomware-attack/", "https://news.sophos.com/en-us/2020/12/08/egregor-ransomware-mazes-heir-apparent/", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://oag.ca.gov/system/files/Letter%204.pdf", "https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/", "https://research.checkpoint.com/2020/graphology-of-an-exploit-playbit/", "https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/543/original/CTIR_casestudy_1.pdf", "https://securelist.com/maze-ransomware/99137/", "https://securelist.com/targeted-ransomware-encrypting-data/99255/", "https://securityaffairs.co/wordpress/127826/malware/egregor-sekhmet-decryption-keys.html", "https://sites.temple.edu/care/ci-rw-attacks/", "https://statescoop.com/baltimore-ransomware-crowdstrike-extortion/", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://techcrunch.com/2020/03/26/chubb-insurance-breach-ransomware/", "https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/", "https://therecord.media/ransomwhere-project-wants-to-create-a-database-of-past-ransomware-payments/", "https://twitter.com/certbund/status/1192756294307995655", "https://us-cert.cisa.gov/ncas/alerts/aa20-345a", "https://web.archive.org/save/https://news.cognizant.com/2020-04-18-cognizant-security-update", "https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion", "https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/wp-spark-state-of-ransomware.pdf", "https://www.bleepingcomputer.com/news/security/allied-universal-breached-by-maze-ransomware-stolen-data-leaked/", "https://www.bleepingcomputer.com/news/security/chipmaker-maxlinear-reports-data-breach-after-maze-ransomware-attack/", "https://www.bleepingcomputer.com/news/security/crytek-confirms-egregor-ransomware-attack-customer-data-theft/", "https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/", "https://www.bleepingcomputer.com/news/security/data-leak-marketplaces-aim-to-take-over-the-extortion-economy/", "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/", "https://www.bleepingcomputer.com/news/security/maze-ransomware-behind-pensacola-cyberattack-1m-ransom-demand/", "https://www.bleepingcomputer.com/news/security/maze-ransomware-is-shutting-down-its-cybercrime-operation/", "https://www.bleepingcomputer.com/news/security/maze-ransomware-now-encrypts-via-virtual-machines-to-evade-detection/", "https://www.bleepingcomputer.com/news/security/maze-ransomware-releases-files-stolen-from-city-of-pensacola/", "https://www.bleepingcomputer.com/news/security/ransomware-attackers-use-your-cloud-backups-against-you/", "https://www.bleepingcomputer.com/news/security/ransomware-dev-releases-egregor-maze-master-decryption-keys/", "https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/", "https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/escape-from-the-maze/", "https://www.brighttalk.com/webcast/7451/408167/navigating-maze-analysis-of-a-rising-ransomware-threat", "https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-007/", "https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-009/", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf", "https://www.cityofpensacola.com/DocumentCenter/View/18879/Deloitte-Executive-Summary-PDF", "https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1", "https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/", "https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-2/", "https://www.crowdstrike.com/blog/maze-ransomware-deobfuscation/", "https://www.crowdstrike.com/blog/ransomware-preparedness-a-call-to-action/", "https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/", "https://www.docdroid.net/dUpPY5s/maze.pdf", "https://www.domaintools.com/resources/blog/the-most-prolific-ransomware-families-a-defenders-guide", "https://www.fireeye.com/blog/threat-research/2020/07/financially-motivated-actors-are-expanding-access-into-ot.html", "https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html", "https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/", "https://www.mandiant.com/resources/financially-motivated-actors-are-expanding-access-into-ot", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/csi-evidence-indicators-for-targeted-ransomware-attacks-part-ii/", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/", "https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf", "https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware", "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf", "https://www.secureworks.com/research/threat-profiles/gold-village", "https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html", "https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf", "https://www.telsy.com/wp-content/uploads/Maze_Vaccine.pdf", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html", "https://www.trendmicro.com/en_us/research/20/l/the-impact-of-modern-ransomware-on-manufacturing-networks.html", "https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf", "https://www.zataz.com/cyber-attaque-a-lencontre-des-serveurs-de-bouygues-construction/", "https://www.zdnet.com/article/ransomware-gang-publishes-tens-of-gbs-of-internal-data-from-lg-and-xerox/", "https://www.ransomlook.io/group/maze" ] }, "related": [ { "dest-uuid": "e69f9836-873a-43d3-92a8-97ab783a4171", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "related-to" } ], "uuid": "c60776a6-91dd-499b-8b4c-7940479e71fc", "value": "Maze" }, { "description": "Ransomware delivered using fake Windows Update spam", "meta": { "extensions": [ ".777" ], "ransomnotes-filenames": [ "Cyborg_DECRYPT.txt" ], "ransomnotes-refs": [ "https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a4ebff1b200b-pi" ], "refs": [ "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/" ] }, "uuid": "0a0b9311-8cbc-4d97-b337-42c9a018ebe0", "value": "Cyborg Ransomware" }, { "description": "A targeted email campaign has been spotted distributing the JasperLoader to victims. While the JasperLoader was originally used to then install Gootkit, Certego has observed it now being used to infect victims with a new ransomware dubbed FTCODE. Using an invoice-themed email appearing to target Italian users, the attackers attempt to convince users to allow macros in a Word document. The macro is used to run PowerShell to retrieve additional PowerShell code.", "meta": { "payment-method": "Bitcoin", "price": "0.06", "refs": [ "https://www.certego.net/en/news/malware-tales-ftcode/", "https://exchange.xforce.ibmcloud.com/collection/FTCODE-Ransomware-45dacdc2d5cf30722ced20b9d37988c2", "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.ftcode" ] }, "uuid": "6f9b7c54-45fa-422c-97f0-0f0c015e3c4e", "value": "FTCode" }, { "description": "Observed for the first time in Febuary 2019, variant from CryptoMix Family, itself a variation from CryptXXX and CryptoWall family", "meta": { "extensions": [ ".CIop", ".Clop", ".Ciop", ".Clop2" ], "links": [ "http://ekbgzchl6x2ias37.onion", "http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/" ], "refs": [ "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf", "https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/", "https://blog.malwarebytes.com/malwarebytes-news/2021/02/clop-targets-execs-ransomware-tactics-get-another-new-twist", "https://unit42.paloaltonetworks.com/clop-ransomware", "https://actu.fr/normandie/rouen_76540/une-rancon-apres-cyberattaque-chu-rouen-ce-reclament-pirates_29475649.html", "https://asec.ahnlab.com/en/19542/", "https://asec.ahnlab.com/wp-content/uploads/2021/01/Analysis_ReportCLOP_Ransomware.pdf", "https://blog.fox-it.com/2020/11/16/ta505-a-brief-history-of-their-time/", "https://blog.sensecy.com/2020/08/20/global-ransomware-attacks-in-2020-the-top-4-vulnerabilities/", "https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://github.com/Tera0017/TAFOF-Unpacker", "https://github.com/albertzsigovits/malware-notes/blob/master/Clop.md", "https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Clop.md", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/", "https://krebsonsecurity.com/2021/06/ukrainian-police-nab-six-tied-to-clop-ransomware/", "https://labs.sentinelone.com/breaking-ta505s-crypter-with-an-smt-solver/", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf", "https://medium.com/@Sebdraven/unpacking-clop-416b83718e0f", "https://medium.com/s2wlab/operation-synctrek-e5013df8d167", "https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/", "https://securelist.com/modern-ransomware-groups-ttps/106824/", "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/clop-ransomware/", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://therecord.media/ukrainian-police-arrest-clop-ransomware-members-seize-server-infrastructure/", "https://twitter.com/darb0ng/status/1338692764121251840", "https://unit42.paloaltonetworks.com/clop-ransomware/", "https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/", "https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://www.advanced-intel.com/post/adversarial-perspective-advintel-breach-avoidance-through-monitoring-initial-vulnerabilities", "https://www.binance.com/en/blog/421499824684902240/Binance-Helps-Take-Down-Cybercriminal-Ring-Laundering-%24500M-in-Ransomware-Attacks", "https://www.bleepingcomputer.com/news/security/clop-ransomware-gang-is-back-hits-21-victims-in-a-single-month/", "https://www.bleepingcomputer.com/news/security/cryptomix-clop-ransomware-says-its-targeting-networks-not-computers/", "https://www.bleepingcomputer.com/news/security/indiabulls-group-hit-by-clop-ransomware-gets-24h-leak-deadline/", "https://www.bleepingcomputer.com/news/security/ransomware-gang-says-they-stole-2-million-credit-cards-from-e-land/", "https://www.bleepingcomputer.com/news/security/ransomware-gang-urges-victims-customers-to-demand-a-ransom-payment/", "https://www.bleepingcomputer.com/news/security/ta505-hackers-behind-maastricht-university-ransomware-attack/", "https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/", "https://www.boho.or.kr/filedownload.do?attach_file_seq=2808&attach_file_id=EpF2808.pdf", "https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2020.pdf?__blob=publicationFile&v=2", "https://www.carbonblack.com/blog/cb-tau-threat-intelligence-notification-cryptomix-clop-ransomware-disables-startup-repair-removes-edits-shadow-volume-copies/", "https://www.cert.ssi.gouv.fr/cti/CERTFR-2019-CTI-009/", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-006.pdf", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-009.pdf", "https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound", "https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware", "https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/", "https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html", "https://www.flashpoint-intel.com/blog/cl0p-and-revil-escalate-their-ransomware-tactics/", "https://www.fsec.or.kr/common/proc/fsec/bbs/163/fileDownLoad/2297.do", "https://www.hornetsecurity.com/en/security-information/clop-clop-ta505-html-malspam-analysis/", "https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/", "https://www.mandiant.com/resources/financially-motivated-actors-are-expanding-access-into-ot", "https://www.notion.so/S2W-LAB-Analysis-of-Clop-Ransomware-suspiciously-related-to-the-Recent-Incident-English-088056baf01242409a6e9f844f0c5f2e", "https://www.notion.so/S2W-LAB-Analysis-of-Clop-Ransomware-suspiciously-related-to-the-Recent-Incident-c26daec604da4db6b3c93e26e6c7aa26", "https://www.npu.gov.ua/news/kiberzlochini/kiberpolicziya-vikrila-xakerske-ugrupovannya-u-rozpovsyudzhenni-virusu-shifruvalnika-ta-nanesenni-inozemnim-kompaniyam-piv-milyarda-dolariv-zbitkiv/", "https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html", "https://www.secureworks.com/research/threat-profiles/gold-tahoe", "https://www.splunk.com/en_us/blog/security/clop-ransomware-detection-threat-research-release-april-2021.html", "https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html", "https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-returns-with-a-new-bag-of-tricks-602104", "https://www.telekom.com/en/blog/group/article/cybersecurity-ta505-s-box-of-chocolate-597672", "https://www.telekom.com/en/blog/group/article/eager-beaver-a-short-overview-of-the-restless-threat-actor-ta505-609546", "https://www.telekom.com/en/blog/group/article/inside-of-cl0p-s-ransomware-operation-615824", "https://www.trendmicro.com/en_in/research/21/k/global-operations-lead-to-arrests-of-alleged-members-of-gandcrab.html", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-double-extortion-and-beyond-revil-clop-and-conti", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-clop", "https://www.vice.com/en/article/wx5eyx/meet-the-ransomware-gang-behind-one-of-the-biggest-supply-chain-hacks-ever", "https://www.youtube.com/watch?v=PqGaZgepNTE", "https://www.zdnet.com/article/croatias-largest-petrol-station-chain-impacted-by-cyber-attack/", "https://www.zdnet.com/article/german-tech-giant-software-ag-down-after-ransomware-attack/", "https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/", "https://www.ransomlook.io/group/clop" ] }, "uuid": "21b349c3-ede2-4e11-abda-1444eb272eff", "value": "Clop" }, { "description": "A new infection is being distributed by porn sites that tries to blackmail a victim into paying a ransom by stating they will tell law enforcement that the victim is spreading child porn. This is done by collecting information about the user, including screen shots of their active desktop, in order to catch them in compromising situations.", "meta": { "ransomnotes": [ "https://www.bleepstatic.com/images/news/malware/b/blackmailware/pornblackmailer/ransom-note.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/blackmailware-found-on-porn-site-threatens-to-report-users-are-spreading-child-porn/" ] }, "uuid": "a1a730e2-f1a4-4d7b-9930-80529cd97f3c", "value": "PornBlackmailer" }, { "description": "This crypto-extortioner encrypts user data using AES, and then requires a $ 30- $ 50- $ 80 buy- back to BTC to return the files. The name is original. Written on AutoIt.", "meta": { "ransomnotes": [ "Your files has been safely encrypted\n---\nEncrypted files: 276\n**********\n---\n[Buy Bitcoins] [Decrypt Files] (Decryptionkey)\n---\nThe only way you can recover your files is to buy a decryption key\nThe payment method is: Bitcoin. The price is: $50 = Bitcoins\nAfter buying the amount of bitcoins send an email\nto king.ouroboros@protonmail.com Your ID: *****\nWe will provide you with payment address and your decryption key.\nYou have 72 Hours to complete the payment otherwise your key will be deleted." ], "refs": [ "https://id-ransomware.blogspot.com/2018/06/kingouroboros-ransomware.html" ] }, "uuid": "303a07bf-c990-4fbe-ac7d-57b8c3cb29b6", "value": "KingOuroboros" }, { "description": "The ransomware appears to target users in Korea, and may have been developed with at least knowledge of the Korean language.", "meta": { "refs": [ "https://bartblaze.blogspot.com/2018/08/mafia-ransomware-targeting-users-in.html" ], "synonyms": [ "Mafia" ] }, "uuid": "9ea6333f-1437-4a57-8acc-d73019378ef2", "value": "MAFIA Ransomware" }, { "description": "The cybercrime group that brought us Satan, DBGer and Lucky ransomware and perhaps Iron ransomware, has now come up with a new version or rebranding named 5ss5c. [...] It will however only encrypt files with the following extensions: 7z, bak, cer, csv, db, dbf, dmp, docx, eps, ldf, mdb, mdf, myd, myi, ora, pdf, pem, pfx, ppt, pptx, psd, rar, rtf, sql, tar, txt, vdi, vmdk, vmx, xls, xlsx, zip", "meta": { "ransomnotes-filenames": [ "_如何解密我的文件_.txt" ], "ransomnotes-refs": [ "https://1.bp.blogspot.com/-T0B4txHlNHs/Xh4-raVFVtI/AAAAAAAACTE/R-YoW8QHFLsuD140AF9vD-_rOifULExUgCLcBGAsYHQ/s1600/note.PNG" ], "refs": [ "https://bartblaze.blogspot.com/2020/01/satan-ransomware-rebrands-as-5ss5c.html" ] }, "uuid": "8ac9fc73-05db-4be8-8f46-33bbd6b3502b", "value": "5ss5c Ransomware" }, { "description": "Nodera is a ransomware family that uses the Node.js framework and was discovered by Quick Heal researchers. The infection chain starts with a VBS script embedded with multiple JavaScript files. Upon execution, a directory is created and both the main node.exe program and several required NodeJS files are downloaded into the directory. Additionally, a malicious JavaScript payload that performs the encryption process is saved in this directory. After checking that it has admin privileges and setting applicable variables, the malicious JavaScript file enumerates the drives to create a list of targets. Processes associated with common user file types are stopped and volume shadow copies are deleted. Finally, all user-specific files on the C: drive and all files on other drives are encrypted and are appended with a .encrypted extension. The ransom note containing instructions on paying the Bitcoin ransom are provided along with a batch script to be used for decryption after obtaining the private key. Some mistakes in the ransom note identified by the researchers include the fact that it mentions a 2048-bit RSA public key instead of 4096-bit (the size that was actually used), a hard-coded private key destruction time dating back almost 2 years ago, and a lack of instructions for how the private key will be obtained after the ransom is paid. These are signs that the ransomware may be in the development phase and was likely written by an amateur. For more information, see the QuickHeal blog post in the Reference section below.", "meta": { "extensions": [ ".encrypted" ], "refs": [ "https://exchange.xforce.ibmcloud.com/collection/6f18908ce6d9cf4efb551911e00d9ec4", "https://blogs.quickheal.com/first-node-js-based-ransomware-nodera/" ], "synonyms": [ "Nodera" ] }, "uuid": "0529c53a-afe7-4549-899e-3f8735467f96", "value": "Nodera Ransomware" }, { "description": "Discovered in May 2019. dropped throught networks compromised by trojan like Emotet or TrickBot. Tools and methods used are similar to LockerGoga", "meta": { "refs": [ "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf" ] }, "related": [ { "dest-uuid": "1e19dae5-80c3-4358-abcd-2bf0ba4c76fe", "tags": [ "estimative-language:likelihood-probability=\"roughly-even-chance\"" ], "type": "similar" } ], "uuid": "f1041289-f42b-416f-b649-7bb8e543011f", "value": "MegaCortex" }, { "description": "Detected in April 2019. Known for paralyzing the cities of Baltimore and Greenville. Probably also exfiltrate data", "meta": { "links": [ "https://robinhoodleaks.tumblr.com" ], "refs": [ "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-001.pdf", "https://arstechnica.com/information-technology/2019/05/baltimore-city-government-hit-by-robbinhood-ransomware/", "https://blogs.quickheal.com/a-new-ransomware-goodwill-hacks-the-victims-for-charity-read-more-to-know-more-about-this-ransomware-and-how-it-affects-its-victims/", "https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf", "https://goggleheadedhacker.com/blog/post/12", "https://krebsonsecurity.com/2019/06/report-no-eternal-blue-exploit-found-in-baltimore-city-ransomware/", "https://news.sophos.com/en-us/2020/02/06/living-off-another-land-ransomware-borrows-vulnerable-driver-to-remove-security-software/", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://statescoop.com/baltimore-ransomware-crowdstrike-extortion/", "https://twitter.com/VK_Intel/status/1121440931759128576", "https://www.bleepingcomputer.com/news/security/a-closer-look-at-the-robbinhood-ransomware/", "https://www.bleepingcomputer.com/news/security/ransomware-exploits-gigabyte-driver-to-kill-av-processes/", "https://www.boll.ch/datasheets/WG_Threat_Report_EN.pdf", "https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/", "https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/", "https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/", "https://www.sentinelone.com/blog/robinhood-ransomware-coolmaker-function-not-cool/", "https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/", "https://www.ransomlook.io/group/robinhood" ], "synonyms": [ "HelpYemen" ] }, "uuid": "000fb0bf-8be3-4ff1-8bbd-cc0513bcdd89", "value": "RobinHood" }, { "description": "Bart ransomware is distributed by the same Russian Cyber Mafia behind Dridex 220 and Locky. Bart doesn't communicate with a command and control (C&C) server, so it can encrypt files without being connected to a computer.\nBart is spread to end users via phishing emails containing .zip attachments with JavaScript Code and use social engineering to trick users into opening the 'photo' attachments. The zipped files are obfuscated to make it more hard to tell what actions they are performing. See screenshot above for an example of what they look like. If opened, these attachments download and install the intermediary loader RockLoader which downloads Bart onto the machine over HTTPS.\nOnce executed, it will first check the language on the infected computer. If the malware detects Russian, Belorussian, or Ukrainian, the ransomware will terminate and will not proceed with the infection. If it's any other language, it will start scanning the computer for certain file extensions to encrypt.\nBecause Bart does not require communication with C&C infrastructure prior to encrypting files, Bart could possibly encrypt machines sitting behind corporate firewalls that would otherwise block such traffic. Thus, organizations need to ensure that Bart is blocked at the email gateway using rules that block zipped executables.", "meta": { "refs": [ "https://www.knowbe4.com/bart-ransomware" ], "synonyms": [ "Locky Bart" ] }, "uuid": "05d5263f-ec23-4279-bb98-55fc233d7e89", "value": "Bart ransomware" }, { "description": "Razor was discovered by dnwls0719, it is a part of Garrantydecrypt ransomware family. Like many other programs of this type, Razor is designed to encrypt files (make them unusable/inaccessible), change their filenames, create a ransom note and change victim's desktop wallpaper. Razor renames files by appending the \".razor\" extension to their filenames. For example, it renames \"1.jpg\" to \"1.jpg.razor\", and so on. It creates a ransom note which is a text file named \"#RECOVERY#.txt\", this file contains instructions on how to contact Razor's developers (cyber criminals) and other details.\nAs stated in the \"#RECOVERY#.txt\" file, this ransomware encrypts all files and information about how to purchase a decryption tool can be received by contacting Razor's developers. Victims supposed to contact them via razor2020@protonmail.ch, Jabber client (razor2020@jxmpp.jp) or ICQ client (@razor2020) and wait for further instructions. It is very likely that they will name a price of a decryption tool and/or key and provide cryptocurrency wallet's address that should be used to make a transaction. However, it is never a good idea to trust (pay) any cyber criminals/ransomware developers. It is common that they do not provide decryption tools even after a payment. Another problem is that ransomware-type programs encrypt files with strong encryption algorithms and their developers are the only ones who have tools that can decrypt files encrypted by their ransomware. In most cases victims have the only free and safe option: to restore files from a backup. Also, it is worth mentioning that files remain encrypted even after uninstallation of ransomware, its removal only prevents it from causing further encryptions.", "meta": { "extensions": [ ".razor" ], "ransomnotes": [ "All your files have been ENCRYPTED!!!\nWrite to our email: \n razor2020@protonmail.ch\n ICQ:\n @razor2020\n Or contact us via jabber:\n razor2020@jxmpp.jp\nJabber (Pidgin) client installation instructions, you can find on youtube - hxxps://www.youtube.com/results?search_query=pidgin+jabber+install\nAttention!\nDo not rename encrypted files.\nDo not try to decrypt your data using third party software, it may cause permanent data loss.\ntell your unique ID" ], "ransomnotes-filenames": [ "#RECOVERY#.txt" ], "ransomnotes-refs": [ "https://www.pcrisk.com/images/stories/screenshots202002/razor-ransom-note.jpg" ], "refs": [ "https://www.pcrisk.com/removal-guides/17016-razor-ransomware" ] }, "uuid": "ea35282c-0686-4115-a001-bc4203549418", "value": "Razor" }, { "meta": { "refs": [ "https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=ransom:win32/wadhrama.c&ThreatID=2147730655" ] }, "related": [ { "dest-uuid": "00edb40d-2fed-4d36-98b1-c85fc2bb1168", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "used-by" }, { "dest-uuid": "4245e4cd-a57a-4e0b-9853-acaa549d495d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "used-by" } ], "uuid": "42148074-196b-4f8c-b149-12163fc385fa", "value": "Wadhrama" }, { "description": "Mespinoza ransomware is used at least since october 2018. First versions used the common extension \".locked\". SInce december 2019 a new version in open sourced and documented, this new version uses the \".pyza\" extension.", "meta": { "colt-average": "70d", "colt-median": "66d", "extensions": [ ".pyza", ".locked", ".pysa" ], "links": [ "http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion/partners.html" ], "ransomnotes-filenames": [ "RECOVER_YOUR_DATA.txt" ], "refs": [ "https://www.cert.ssi.gouv.fr/cti/CERTFR-2020-CTI-002/", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-002.pdf", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf", "https://www.ic3.gov/Media/News/2021/210316.pdf", "https://blog.malwarebytes.com/threat-spotlight/2021/03/pysa-the-ransomware-attacking-schools", "http://www.secureworks.com/research/threat-profiles/gold-burlap", "https://blog.cyble.com/2021/11/29/pysa-ransomware-under-the-lens-a-deep-dive-analysis/", "https://blogs.blackberry.com/en/2021/06/pysa-loves-chachi-a-new-golang-rat", "https://dissectingmalwa.re/another-one-for-the-collection-mespinoza-pysa-ransomware.html", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://id-ransomware.blogspot.com/2019/10/mespinoza-ransomware.html", "https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf", "https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/", "https://securelist.com/modern-ransomware-groups-ttps/106824/", "https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/", "https://twitter.com/campuscodi/status/1347223969984897026", "https://twitter.com/inversecos/status/1456486725664993287", "https://unit42.paloaltonetworks.com/gasket-and-magicsocks-tools-install-mespinoza-ransomware/", "https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/", "https://www.bleepingcomputer.com/news/security/ransomware-gangs-script-shows-exactly-the-files-theyre-after/", "https://www.cybereason.com/blog/threat-analysis-report-inside-the-destructive-pysa-ransomware", "https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/", "https://www.hhs.gov/sites/default/files/mespinoza-goldburlap-cyborgspider-analystnote-tlpwhite.pdf", "https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/", "https://www.lacework.com/blog/pysa-ransomware-gang-adds-linux-support/", "https://www.prodaft.com/m/reports/PYSA_TLPWHITE_3.0.pdf", "https://www.prodaft.com/resource/detail/pysa-ransomware-group-depth-analysis", "https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack/", "https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html", "https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf", "https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf", "https://www.zdnet.com/article/france-warns-of-new-ransomware-gang-targeting-local-governments/", "https://www.ransomlook.io/group/pysa" ], "synonyms": [ "Pyza", "Pysa" ] }, "uuid": "deed3c10-93b6-41b9-b150-f4dd1b665d87", "value": "Mespinoza" }, { "description": "A new ransomware called CoronaVirus has been distributed through a fake web site pretending to promote the system optimization software and utilities from WiseCleaner.\nWith the increasing fears and anxiety of the Coronavirus (COVID-19) outbreak, an attacker has started to build a campaign to distribute a malware cocktail consisting of the CoronaVirus Ransomware and the Kpot information-stealing Trojan.\nThis new ransomware was discovered by MalwareHunterTeam and after further digging into the source of the file, we have been able to determine how the threat actor plans on distributing the ransomware and possible clues suggesting that it may actually be a wiper.", "meta": { "ransomnotes-filenames": [ "CoronaVirus.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/ransom-note.jpg", "https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/mbr-locker.jpg", "https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/changed-mbrlocker-screen.jpg" ], "refs": [ "https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/" ] }, "uuid": "575b2b3c-d762-4ba6-acbd-51ecdb57249f", "value": "CoronaVirus" }, { "description": "Snake ransomware first attracted the attention of malware analysts in January 2020 when they observed the crypto-malware family targeting entire corporate networks.\nShortly after this discovery, the threat quieted down. It produced few new detected infections in the wild for the next few months. That was until May 4, when ID Ransomware registered a sudden spike in submissions for the ransomware.", "meta": { "ransomnotes-filenames": [ "Decrypt-Your-Files.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/s/SNAKE/may-2020-campaign/snake-ransom-note.jpg" ], "refs": [ "https://www.cybersecurity-insiders.com/meet-the-snake-ransomware-which-encrypts-all-connected-devices/", "https://www.tripwire.com/state-of-security/security-data-protection/massive-spike-in-snake-ransomware-activity-attributed-to-new-campaign/", "https://www.bleepingcomputer.com/news/security/large-scale-snake-ransomware-campaign-targets-healthcare-more/" ] }, "uuid": "e390e1bb-2af1-4139-8e61-6e534d707dfb", "value": "Snake Ransomware" }, { "description": "Anomali researchers have observed a new ransomware family, dubbed eCh0raix, targeting QNAP Network Attached Storage (NAS) devices. QNAP devices are created by the Taiwanese company QNAP Systems, Inc., and contain device storage and media player functionality, amongst others. The devices appear to be compromised by brute forcing weak credentials and exploiting known vulnerabilities in targeted attacks. The malicious payload encrypts the targeted file extensions on the NAS using AES encryption and appends .encrypt extension to the encrypted files. The ransom note created by the ransomware has the form shown below.\neCh0raix was first seen in June 2019, after victims began reporting ransomware attacks in a forum topic on BleepingComputer.\nOn June 1st, 2020, there has been a sudden surge of eCh0raix victims seeking help in our forums and submissions to the ransomware identification site ID-Ransomware.", "meta": { "extensions": [ ".encrypt" ], "links": [ "http://veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id.onion" ], "ransomnotes": [ "All your data has been locked(crypted).\n​How to unclock(decrypt) instruction located in this TOR website:\nhttp://sg3dwqfpnr4sl5hh.onion/order/[Bitcoin address]\nUse TOR browser for access .onion websites.\nhttps://duckduckgo.com/html?q=tor+browser+how+to\n\nDo NOT remove this file and NOT remove last line in this file!\n[base64 encoded encrypted data]" ], "ransomnotes-filenames": [ "README_FOR_DECRYPT.txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/ongoing-ech0raix-ransomware-campaign-targets-qnap-nas-devices/", "https://www.anomali.com/blog/the-ech0raix-ransomware", "https://blog.netlab.360.com/qnap-nas-users-make-sure-you-check-your-system/", "https://documents.trendmicro.com/assets/pdf/wp-backing-your-backup-defending-nas-devices-against-evolving-threats.pdf", "https://intezer.com/blog/linux/elf-malware-analysis-101-linux-threats-no-longer-an-afterthought", "https://unit42.paloaltonetworks.com/ech0raix-ransomware-soho/", "https://www.bleepingcomputer.com/news/security/qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day/", "https://www.ibm.com/downloads/cas/Z81AVOY7", "https://www.intezer.com/blog-russian-cybercrime-group-fullofdeep-behind-qnapcrypt-ransomware-campaigns/", "https://www.intezer.com/blog-seizing-15-active-ransomware-campaigns-targeting-linux-file-storage-servers/", "https://www.intezer.com/blog/malware-analysis/when-viruses-mutate-did-suncrypt-ransomware-evolve-from-qnapcrypt", "https://www.qnap.com/en/security-advisory/QSA-20-02", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://www.ransomlook.io/group/ech0raix" ] }, "uuid": "f3ded787-783e-4c6b-909a-8da01254380c", "value": "eCh0raix" }, { "description": "The threat group behind this malware seems to operate by hacking into companies, stealing sensitive data, and then running Egregor to encrypt all the files. According to the ransom note, if the ransom is not paid by the company within 3 days, and aside from leaking part of the stolen data, they will distribute via mass media where the company's partners and clients will know that the company was attacked.", "meta": { "ransomnotes-filenames": [ "RECOVER-FILES.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2020/september/25/egregor.jpg", "https://2kjpox12cnap3zv36440iue7-wpengine.netdna-ssl.com/wp-content/uploads/2020/10/egregor-ransom-demanding-message.png" ], "refs": [ "https://www.appgate.com/news-press/appgate-labs-analyzes-new-family-of-ransomware-egregor", "https://www.bleepingcomputer.com/news/security/crytek-hit-by-egregor-ransomware-ubisoft-data-leaked/", "https://cybersecuritynews.com/egregor-ransomware/", "https://securityboulevard.com/2020/10/egregor-sekhmets-cousin/" ] }, "related": [ { "dest-uuid": "6fb1ea9e-5389-4932-8b22-c691b74b75a8", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "variant-of" }, { "dest-uuid": "5d999c23-11cf-4dee-84bb-f447a4f70dc8", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "successor-of" } ], "uuid": "8bd094a7-103f-465f-8640-18dcc53042e5", "value": "Egregor" }, { "description": "SunCrypt ransomware was discovered in October 2019 and in August 2020 it was added to Maze ransomware’s cartel. It also follows some of Maze’s tactics, techniques, and procedures. SunCrypt is launched and installed using an obfuscated PowerShell script. Infected email attachments (macros), torrent websites, malicious ads act as carriers for this ransomware.", "meta": { "links": [ "http://x2miyuiwpib2imjr5ykyjngdu7v6vprkkhjltrk4qafymtawey4qzwid.onion/", "http://nbzzb6sa6xuura2z.onion" ], "ransomnotes-filenames": [ "YOUR_FILES_ARE_ENCRYPTED.HTML" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/s/suncrypt/maze-cartel/ransom-note.jpg" ], "refs": [ "https://www.acronis.com/en-us/blog/posts/suncrypt-adopts-attacking-techniques-netwalker-and-maze-ransomware", "https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-sheds-light-on-the-maze-ransomware-cartel/", "https://securityboulevard.com/2020/09/the-curious-case-of-suncrypt/", "https://www.tetradefense.com/incident-response-services/cause-and-effect-suncrypt-ransomware-analysis", "https://www.intezer.com/blog/malware-analysis/when-viruses-mutate-did-suncrypt-ransomware-evolve-from-qnapcrypt", "https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel", "https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf", "https://blog.chainalysis.com/reports/ransomware-connections-maze-egregor-suncrypt-doppelpaymer", "https://blog.minerva-labs.com/suncrypt-ransomware-gains-new-abilities-in-2022", "https://cdn.pathfactory.com/assets/10555/contents/394789/0dd521f8-aa64-4517-834e-bc852e9ab95d.pdf", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/", "https://medium.com/@sapphirex00/diving-into-the-sun-suncrypt-a-new-neighbour-in-the-ransomware-mafia-d89010c9df83", "https://medium.com/s2wlab/case-analysis-of-suncrypt-ransomware-negotiation-and-bitcoin-transaction-43a2194ac0bc", "https://medium.com/s2wlab/w4-july-en-story-of-the-week-ransomware-on-the-darkweb-c61965d0386a", "https://pcsxcetrasupport3.wordpress.com/2021/03/28/suncrypt-powershell-obfuscation-shellcode-and-more-yara/", "https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/", "https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion", "https://www.bleepingcomputer.com/news/security/suncrypt-ransomware-is-still-alive-and-kicking-in-2022/", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-1st-2022-i-can-fight-with-a-keyboard/", "https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound", "https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/", "https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html", "https://www.tesorion.nl/en/posts/shining-a-light-on-suncrypts-curious-file-encryption-mechanism/", "https://www.trendmicro.com/en_us/research/22/g/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html", "https://www.ransomlook.io/group/suncrypt" ], "synonyms": [ "Sun", "Suncrypt" ] }, "uuid": "4fa25527-99f6-42ee-aaf2-7ca395e5fabc", "value": "SunCrypt" }, { "description": "LockBit operators tend to be very indiscriminate and opportunistic in their targeting. Actors behind this attack will use a variety of methods to gain initial access, up to and including basic methods such as brute force.\nAfter gaining initial access the actor follows a fairly typical escalation, lateral movement and ransomware execution playbook. LockBit operators tend to have a very brief dwell time, executing the final ransomware payload as quickly as they are able to. LockBit ransomware has the built-in lateral movement features; given adequate permissions throughout the targeted environment.", "meta": { "extensions": [ ".abcd", ".LockBit" ], "links": [ "http://lockbitkodidilol.onion" ], "ransomnotes-filenames": [ "Restore-My-Files.txt" ], "ransomnotes-refs": [ "https://www.mcafee.com/wp-content/uploads/2020/04/content-in-restore-my-files.png" ], "refs": [ "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/tales-from-the-trenches-a-lockbit-ransomware-story/", "https://usa.kaspersky.com/resource-center/threats/lockbit-ransomware", "https://blog.compass-security.com/2022/03/vpn-appliance-forensics/", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://lifars.com/wp-content/uploads/2022/02/LockBitRansomware_Whitepaper.pdf", "https://security.packt.com/understanding-lockbit/", "https://socradar.io/lockbit-3-another-upgrade-to-worlds-most-active-ransomware/", "https://www.bleepingcomputer.com/news/security/lockbit-victim-estimates-cost-of-ransomware-attack-to-be-42-million/", "https://www.crowdstrike.com/blog/better-together-global-attitude-survey-takeaways-2021/", "https://www.dragos.com/blog/industry-news/dragos-ics-ot-ransomware-analysis-q4-2021/", "https://www.fortinet.com/blog/threat-research/ransomware-roundup-new-variants", "https://www.ic3.gov/Media/News/2022/220204.pdf", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html", "https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html", "https://amgedwageh.medium.com/lockbit-ransomware-analysis-notes-93a542fc8511", "https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel", "https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf", "https://asec.ahnlab.com/en/35822/", "https://asec.ahnlab.com/ko/39682/", "https://blog.cyble.com/2021/08/16/a-deep-dive-analysis-of-lockbit-2-0/", "https://blog.cyble.com/2022/07/05/lockbit-3-0-ransomware-group-launches-new-version/", "https://blog.lexfo.fr/lockbit-malware.html", "https://blog.minerva-labs.com/lockbit-3.0-aka-lockbit-black-is-here-with-a-new-icon-new-ransom-note-new-wallpaper-but-less-evasiveness", "https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities", "https://blog.talosintelligence.com/2020/09/CTIR-quarterly-trends-Q4-2020.html", "https://chuongdong.com/reverse%20engineering/2022/03/19/LockbitRansomware/", "https://cluster25.io/2022/07/06/lockbit-3-0-making-the-ransomware-great-again/", "https://cybergeeks.tech/a-technical-analysis-of-the-leaked-lockbit-3-0-builder/", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://documents.trendmicro.com/assets/pdf/datasheet-ransomware-in-Q1-2022.pdf", "https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Lockbit.md", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://id-ransomware.blogspot.com/search?q=lockbit", "https://intel471.com/blog/conti-ransomware-cooperation-maze-lockbit-ragnar-locker", "https://intel471.com/blog/privateloader-malware", "https://ke-la.com/lockbit-2-0-interview-with-russian-osint/", "https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf", "https://medium.com/@amgedwageh/lockbit-ransomware-analysis-notes-93a542fc8511", "https://medium.com/s2wlab/w4-jan-en-story-of-the-week-ransomware-on-the-darkweb-7595544363b1", "https://medium.com/s2wlab/w4-july-en-story-of-the-week-ransomware-on-the-darkweb-c61965d0386a", "https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/", "https://news.sophos.com/en-us/2020/10/21/lockbit-attackers-uses-automated-attack-tools-to-identify-tasty-targets", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://news.sophos.com/en-us/2022/04/12/attackers-linger-on-government-agency-computers-before-deploying-lockbit-ransomware/", "https://redcanary.com/blog/intelligence-insights-november-2021/", "https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack", "https://securelist.com/modern-ransomware-groups-ttps/106824/", "https://securelist.com/new-ransomware-trends-in-2022/106457/", "https://securityintelligence.com/posts/lockbit-ransomware-attacks-surge-affiliate-recruitment/", "https://securityscorecard.com/research/the-increase-in-ransomware-attacks-on-local-governments", "https://seguranca-informatica.pt/malware-analysis-details-on-lockbit-ransomware/", "https://skyblue.team/posts/hive-recovery-from-lockbit-2.0/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockbit-targets-servers", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/481/original/010421_LockBit_Interview.pdf", "https://techcommunity.microsoft.com/t5/security-compliance-and-identity/part-1-lockbit-2-0-ransomware-bugs-and-database-recovery/ba-p/3254354", "https://techcommunity.microsoft.com/t5/security-compliance-and-identity/part-2-lockbit-2-0-ransomware-bugs-and-database-recovery/ba-p/3254421", "https://therecord.media/an-interview-with-blackmatter-a-new-ransomware-group-thats-learning-from-the-mistakes-of-darkside-and-revil/", "https://therecord.media/australian-cybersecurity-agency-warns-of-spike-in-lockbit-ransomware-attacks/", "https://therecord.media/conti-ransomware-gang-chats-leaked-by-pro-ukraine-member/", "https://therecord.media/missed-opportunity-bug-in-lockbit-ransomware-allowed-free-decryptions/", "https://twitter.com/MsftSecIntel/status/1522690116979855360", "https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-blackmatter-lockbit-thor", "https://unit42.paloaltonetworks.com/emerging-ransomware-groups/", "https://unit42.paloaltonetworks.com/lockbit-2-ransomware/", "https://www.advanced-intel.com/post/from-russia-with-lockbit-ransomware-inside-look-preventive-solutions", "https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-moves-victims-to-lockbit-after-shutdown/", "https://www.bleepingcomputer.com/news/security/energy-group-erg-reports-minor-disruptions-after-ransomware-attack/", "https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-claims-attack-on-bridgestone-americas/", "https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-gets-aggressive-with-triple-extortion-tactic/", "https://www.bleepingcomputer.com/news/security/lockbit-ransomware-now-encrypts-windows-domains-using-group-policies/", "https://www.bleepingcomputer.com/news/security/lockbit-ransomware-recruiting-insiders-to-breach-corporate-networks/", "https://www.bleepingcomputer.com/news/security/popular-russian-hacking-forum-xss-bans-all-ransomware-topics/", "https://www.bleepingcomputer.com/news/security/ransomware-attack-hits-italys-lazio-region-affects-covid-19-site/", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-1st-2022-i-can-fight-with-a-keyboard/", "https://www.bleepingcomputer.com/news/security/uk-rail-network-merseyrail-likely-hit-by-lockbit-ransomware/", "https://www.connectwise.com/resources/lockbit-profile", "https://www.coveware.com/blog/2022/1/26/ransomware-as-a-service-innovation-curve", "https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound", "https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/", "https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1", "https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/", "https://www.crowdstrike.com/blog/how-crowdstrike-prevents-volume-shadow-tampering-by-lockbit-ransomware/", "https://www.crypsisgroup.com/insights/ransomwares-new-trend-exfiltration-and-extortion", "https://www.cybereason.com/blog/rising-threat-from-lockbit-ransomware", "https://www.cybereason.com/blog/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool", "https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom", "https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/", "https://www.dr.dk/nyheder/viden/teknologi/frygtede-skulle-lukke-alle-vindmoeller-nu-aabner-vestas-op-om-hacking-angreb", "https://www.glimps.fr/lockbit3-0/", "https://www.intrinsec.com/alphv-ransomware-gang-analysis", "https://www.lemagit.fr/actualites/252516821/Ransomware-LockBit-30-commence-a-etre-utilise-dans-des-cyberattaques", "https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions", "https://www.mbsd.jp/2021/10/27/assets/images/MBSD_WhitePaper_A-deep-dive-analysis-of-LockBit2.0_Ransomware.pdf", "https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/", "https://www.netskope.com/blog/netskope-threat-coverage-lockbit", "https://www.prodaft.com/m/reports/LockBit_Case_Report___TLPWHITE.pdf", "https://www.recordedfuture.com/blackmatter-ransomware-successor-darkside-revil/", "https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/", "https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques/", "https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility", "https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/", "https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html", "https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/d/thwarting-loaders-from-socgholish-to-blisters-lockbit-payload/iocs-thwarting-loaders-socgholish-blister.txt", "https://www.trendmicro.com/en_no/research/22/d/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html", "https://www.trendmicro.com/en_us/research/21/h/lockbit-resurfaces-with-version-2-0-ransomware-detections-in-chi.html", "https://www.trendmicro.com/en_us/research/22/d/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html", "https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant--lockbit-3-.html", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-by-the-numbers/lockbit-conti-and-blackcat-lead-pack-amid-rise-in-active-raas-and-extortion-groups-ransomware-in-q1-2022", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-lockbit", "https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf", "https://www.youtube.com/watch?v=C733AyPzkoc", "https://www.zdnet.com/article/ransomware-hits-helicopter-maker-kopter/", "https://yoroi.company/research/hunting-the-lockbit-gangs-exfiltration-infrastructures/", "https://www.ransomlook.io/group/lockbit" ], "synonyms": [ "ABCD ransomware" ] }, "related": [ { "dest-uuid": "c09f73fd-c3c3-42b1-b355-b03ca4941110", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "8eda8bf1-db5a-412d-8511-45e2f7621d51", "value": "LockBit" }, { "description": "WastedLocker primarily targets corporate networks. Upon initial compromise, often using a fake browser update containing SocGholish, the actor then takes advantage of dual-use and LoLBin tools in an attempt to evade detection.\n Key observations include lateral movement and privilege escalation. The WastedLocker ransomware has been tied back to EvilCorp.", "meta": { "ransomnotes-filenames": [ "_info" ], "ransomnotes-refs": [ "https://blog.malwarebytes.com/wp-content/uploads/2020/06/ransomnote.png" ], "refs": [ "https://blogs.cisco.com/security/talos/wastedlocker-goes-big-game-hunting-in-2020", "https://blog.malwarebytes.com/threat-spotlight/2020/07/threat-spotlight-wastedlocker-customized-ransomware/", "https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/" ] }, "uuid": "6955c28e-e698-4bb2-8c70-ccc6d11ba1ee", "value": "WastedLocker" }, { "description": "Since this is the first detection of this malware in the wild, it’s not surprising that Babuk is not obsfuscated at all. Overall, it’s a pretty standard ransomware that utilizes some of the new techniques we see such as multi-threading encryption as well as abusing the Windows Restart Manager similar to Conti and REvil. For encrypting scheme, Babuk uses its own implementation of SHA256 hashing, ChaCha8 encryption, and Elliptic-curve Diffie–Hellman (ECDH) key generation and exchange algorithm to protect its keys and encrypt files. Like many ransomware that came before, it also has the ability to spread its encryption through enumerating the available network resources.", "meta": { "date": "January 2021", "refs": [ "http://chuongdong.com//reverse%20engineering/2021/01/03/BabukRansomware/" ] }, "uuid": "c52a65d5-9bea-4a09-a81b-7f789ab48ce0", "value": "Babuk Ransomsware" }, { "description": "Darkside, the latest ransomware operation to emerge has been attacking organizations beginning earlier this month. Darkside’s customized attacks on companies have already garnered them million-dollar payouts.\nThrough their “press release”, these threat actors have claimed to be affiliated with prior ransomware operations making millions of dollars. They stated that they created this new product to match their needs, as prior products didn’t.\n Darkside explains that they only target companies they know that can pay the specified ransom. They have allegedly promised that they will not attack the following sectors. They include medicine, education, non-profit organizations, and the government sector.", "meta": { "colt-average": "11d", "colt-median": "7d", "links": [ "http://blackmax7su6mbwtcyo3xwtpfxpm356jjqrs34y4crcytpw7mifuedyd.onion/", "http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion" ], "refs": [ "https://www.digitalshadows.com/blog-and-research/darkside-the-new-ransomware-group-behind-highly-targeted-attacks/", "https://www.wired.com/story/ransomware-gone-corporate-darkside-where-will-it-end/", "https://darksidedxcftmqa.onion.foundation/", "https://www.tripwire.com/state-of-security/featured/blackmatter-pose-new-ransomware-threat", "https://venturebeat.com/2021/08/23/sophoslabs-research-shows-blackmatter-ransomware-is-closely-acquainted-with-darkside", "https://blog.group-ib.com/blackmatter#", "https://blog.group-ib.com/blackmatter2", "https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html", "https://blogs.blackberry.com/en/2021/09/threat-thursday-blackmatter-ransomware-as-a-service", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://medium.com/s2wlab/blackmatter-x-babuk-using-the-same-web-server-for-sharing-leaked-files-d01c20a74751", "https://medium.com/s2wlab/groove-x-ramp-the-relation-between-groove-babuk-ramp-and-blackmatter-f75644f8f92d", "https://medium.com/s2wlab/grooves-thoughts-on-blackmatter-babuk-and-interruption-in-the-supply-of-cheese-in-the-b5328bc764f2", "https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://thehackernews.com/2022/04/researchers-connect-blackcat-ransomware.html", "https://therecord.media/darkside-ransomware-gang-moves-some-of-its-bitcoin-after-revil-got-hit-by-law-enforcement/", "https://twitter.com/GelosSnake/status/1451465959894667275", "https://twitter.com/VK_Intel/status/1423188690126266370", "https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-blackmatter-lockbit-thor", "https://us-cert.cisa.gov/ncas/alerts/aa21-291a", "https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-moves-victims-to-lockbit-after-shutdown/", "https://www.bleepingcomputer.com/news/security/darkside-ransomware-rushes-to-cash-out-7-million-in-bitcoin/", "https://www.bleepingcomputer.com/news/security/linux-version-of-blackmatter-ransomware-targets-vmware-esxi-servers/", "https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/", "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-2/", "https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/", "https://www.elliptic.co/blog/darkside-bitcoins-on-the-move-following-government-cyberattack-against-revil-ransomware-group", "https://www.hhs.gov/sites/default/files/demystifying-blackmatter.pdf", "https://www.mandiant.com/resources/chasing-avaddon-ransomware", "https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates/", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://www.youtube.com/watch?v=NIiEcOryLpI", "https://assets.virustotal.com/reports/2021trends.pdf", "https://blog.digital-investigations.info/2021-08-05-understanding-blackmatters-api-hashing.html", "https://blog.minerva-labs.com/blackmatter", "https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus", "https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf", "https://chuongdong.com/reverse%20engineering/2021/09/05/BlackMatterRansomware/", "https://go.recordedfuture.com/hubfs/reports/MTP-2021-0804.pdf", "https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf", "https://ke-la.com/the-ideal-ransomware-victim-what-attackers-are-looking-for/", "https://medium.com/s2wblog/blackcat-new-rust-based-ransomware-borrowing-blackmatters-configuration-31c8d330a809", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://raw.githubusercontent.com/antonioCoco/infosec-talks/main/InsomniHack_2022_Ransomware_Encryption_Internals.pdf", "https://services.google.com/fh/files/misc/gcat_threathorizons_full_nov2021.pdf", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackmatter-data-exfiltration", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-ransomware-ttps", "https://therecord.media/blackmatter-ransomware-says-its-shutting-down-due-to-pressure-from-local-authorities/", "https://www.ciphertechsolutions.com/rapidly-evolving-blackmatter-ransomware-tactics/", "https://www.glimps.fr/lockbit3-0/", "https://www.mandiant.com/resources/cryptography-blackmatter-ransomware", "https://www.mcafee.com/blogs/enterprise/blackmatter-ransomware-analysis-the-dark-side-returns/", "https://www.microsoft.com/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/", "https://www.netskope.com/blog/netskope-threat-coverage-blackmatter", "https://www.nozominetworks.com/blog/blackmatter-ransomware-technical-analysis-and-tools-from-nozomi-networks-labs/", "https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html", "https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf", "https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf", "https://www.tesorion.nl/en/posts/analysis-of-the-blackmatter-ransomware/", "https://www.theregister.com/2022/03/22/talos-ransomware-blackcat/", "https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant--lockbit-3-.html", "https://www.varonis.com/blog/blackmatter-ransomware/", "http://chuongdong.com/reverse%20engineering/2021/05/06/DarksideRansomware/", "http://ti.dbappsecurity.com.cn/blog/index.php/2021/05/10/darkside/", "https://asec.ahnlab.com/en/34549/", "https://blog.360totalsecurity.com/en/darksides-targeted-ransomware-analysis-report-for-critical-u-s-infrastructure-2/", "https://blog.cyble.com/2021/08/05/blackmatter-under-the-lens-an-emerging-ransomware-group-looking-for-affiliates/", "https://blog.gigamon.com/2021/05/17/tracking-darkside-and-ransomware-the-network-view/", "https://blogs.keysight.com/blogs/tech/nwvs.entry.html/2021/05/18/darkside_ransomware-QfsV.html", "https://blueteamblog.com/darkside-ransomware-operations-preventions-and-detections", "https://brandefense.io/darkside-ransomware-analysis-report/", "https://chuongdong.com/reverse%20engineering/2021/05/06/DarksideRansomware/", "https://community.riskiq.com/article/fdf74f23", "https://cybergeeks.tech/a-step-by-step-analysis-of-a-new-version-of-darkside-ransomware/", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://ghoulsec.medium.com/mal-series-13-darkside-ransomware-c13d893c36a6", "https://github.com/Haxrein/Malware-Analysis-Reports/blob/main/darkside_ransomware_technical_analysis_report.pdf", "https://github.com/sisoma2/malware_analysis/tree/master/blackmatter", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://id-ransomware.blogspot.com/2020/08/darkside-ransomware.html", "https://id-ransomware.blogspot.com/2021/07/blackmatter-ransomware.html", "https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/", "https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/", "https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/", "https://labs.bitdefender.com/2021/01/darkside-ransomware-decryption-tool/", "https://medium.com/s2wlab/w1-jun-en-story-of-the-week-ransomware-on-the-darkweb-af491d33868b", "https://news.sophos.com/en-us/2021/05/11/a-defenders-view-inside-a-darkside-ransomware-attack/", "https://securityintelligence.com/posts/darkside-oil-pipeline-ransomware-attack/", "https://securityscorecard.com/blog/new-evidence-supports-assessment-that-darkside-likely-responsible-for-colonial-pipeline-ransomware-attack-others-targeted", "https://socprime.com/blog/affiliates-vs-hunters-fighting-the-darkside/", "https://symantec.broadcom.com/hubfs/Attacks-Against-Critical_Infrastructrure.pdf", "https://therecord.media/an-interview-with-blackmatter-a-new-ransomware-group-thats-learning-from-the-mistakes-of-darkside-and-revil/", "https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/", "https://therecord.media/popular-hacking-forum-bans-ransomware-ads/", "https://therecord.media/ransomware-gang-wants-to-short-the-stock-price-of-their-victims/", "https://threatpost.com/guess-fashion-data-loss-ransomware/167754/", "https://twitter.com/JAMESWT_MHT/status/1388301138437578757", "https://twitter.com/ValthekOn/status/1422385890467491841?s=20", "https://twitter.com/sysopfb/status/1422280887274639375", "https://unit42.paloaltonetworks.com/darkside-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa21-131a", "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-189a", "https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/", "https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion", "https://www.acronis.com/en-us/articles/darkside-ransomware/", "https://www.advanced-intel.com/post/from-dawn-to-silent-night-darkside-ransomware-initial-attack-vector-evolution", "https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/", "https://www.bleepingcomputer.com/news/security/chemical-distributor-pays-44-million-to-darkside-ransomware/", "https://www.bleepingcomputer.com/news/security/darkside-affiliates-claim-gangs-bitcoins-in-deposit-on-hacker-forum/", "https://www.bleepingcomputer.com/news/security/darkside-ransomware-gang-returns-as-new-blackmatter-operation/", "https://www.bleepingcomputer.com/news/security/darkside-ransomware-is-creating-a-secure-data-leak-service-in-iran/", "https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/", "https://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/", "https://www.bleepingcomputer.com/news/security/popular-russian-hacking-forum-xss-bans-all-ransomware-topics/", "https://www.bleepingcomputer.com/news/security/us-chemical-distributor-shares-info-on-darkside-ransomware-data-theft/", "https://www.bloomberg.com/news/articles/2021-05-13/colonial-pipeline-paid-hackers-nearly-5-million-in-ransom", "https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound", "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/", "https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/", "https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout", "https://www.crowdstrike.com/blog/falcon-protects-from-darkside-ransomware/", "https://www.crowdstrike.com/blog/how-ransomware-adversaries-reacted-to-the-darkside-pipeline-attack/", "https://www.crowdstrike.com/blog/how-to-defend-against-conti-darkside-revil-and-other-ransomware/", "https://www.cybereason.com/blog/cybereason-vs-darkside-ransomware", "https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/", "https://www.databreaches.net/a-chat-with-darkside/", "https://www.databreachtoday.com/blogs/darkside-ransomware-gang-launches-affiliate-program-p-2968", "https://www.deepinstinct.com/2021/06/04/the-ransomware-conundrum-a-look-into-darkside/", "https://www.digitalshadows.com/blog-and-research/ransomware-as-a-service-rogue-affiliates-and-whats-next/", "https://www.dragos.com/blog/industry-news/recommendations-following-the-colonial-pipeline-cyber-attack/", "https://www.elliptic.co/blog/darkside-ransomware-has-netted-over-90-million-in-bitcoin", "https://www.elliptic.co/blog/elliptic-follows-bitcoin-ransoms-paid-by-darkside-ransomware-victims", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html", "https://www.flashpoint-intel.com/blog/darkside-ransomware-links-to-revil-difficult-to-dismiss/", "https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions", "https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/", "https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox", "https://www.ic3.gov/Media/News/2021/211101.pdf", "https://www.intel471.com/blog/darkside-ransomware-colonial-pipeline-attack", "https://www.intel471.com/blog/darkside-ransomware-shut-down-revil-avaddon-cybercrime", "https://www.maltego.com/blog/chasing-darkside-affiliates-identifying-threat-actors-connected-to-darkside-ransomware-using-maltego-intel-471-1/", "https://www.mandiant.com/resources/burrowing-your-way-into-vpns", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/are-virtual-machines-the-new-gold-for-cyber-criminals/", "https://www.metabaseq.com/recursos/inside-darkside-the-ransomware-that-attacked-colonial-pipeline#", "https://www.nozominetworks.com/blog/colonial-pipeline-ransomware-attack-revealing-how-darkside-works/", "https://www.nozominetworks.com/blog/how-to-analyze-malware-for-technical-writing/", "https://www.recordedfuture.com/blackmatter-ransomware-successor-darkside-revil/", "https://www.repubblica.it/economia/finanza/2021/04/28/news/un_sospetto_attacco_telematico_blocca_le_filiali_della_bcc_di_roma-298485827/", "https://www.reuters.com/technology/colonial-pipeline-halts-all-pipeline-operations-after-cybersecurity-attack-2021-05-08/", "https://www.secjuice.com/blue-team-detection-darkside-ransomware/", "https://www.secureworks.com/research/threat-profiles/gold-waterfall", "https://www.sentinelone.com/blog/meet-darkside-and-their-ransomware-sentinelone-customers-protected/", "https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html", "https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.html", "https://www.technologyreview.com/2021/05/24/1025195/colonial-pipeline-ransomware-bitdefender/", "https://www.trendmicro.com/en_us/research/21/e/what-we-know-about-darkside-ransomware-and-the-us-pipeline-attac.html", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks", "https://www.varonis.com/blog/darkside-ransomware/", "https://www.wsj.com/articles/colonial-pipeline-ceo-tells-why-he-paid-hackers-a-4-4-million-ransom-11621435636", "https://www.youtube.com/watch?v=qxPXxWMI2i4", "https://zawadidone.nl/2020/10/05/darkside-ransomware-analysis.html", "https://zawadidone.nl/darkside-ransomware-analysis/", "https://zetter.substack.com/p/anatomy-of-one-of-the-first-darkside", "https://www.ransomlook.io/group/blackmatter", "https://blog.qualys.com/vulnerabilities-threat-research/2021/06/09/darkside-ransomware", "https://www.varonis.com/blog/darkside-ransomware", "https://abcnews.go.com/Politics/biden-speak-colonial-pipeline-attack-americans-face-gasoline/story?id=77666212", "https://cybersecurity.att.com/blogs/labs-research/darkside-raas-in-linux-version", "https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/", "https://otx.alienvault.com/pulse/60d0afbc395c24edefb33bb9", "https://pylos.co/2021/05/13/mind-the-air-gap/", "https://therecord.media/darkside-ransomware-gang-says-it-lost-control-of-its-servers-money-a-day-after-biden-threat/", "https://www.databreaches.net/a-former-darkside-listing-shows-up-on-revils-leak-site/", "https://www.guidepointsecurity.com/from-zloader-to-darkside-a-ransomware-story/", "https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/darkside-ransomware-victims-sold-short/", "https://www.nytimes.com/2021/05/29/world/europe/ransomware-russia-darkside.html", "https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html", "https://www.secureworks.com/blog/ransomware-groups-use-tor-based-backdoor-for-persistent-access", "https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html", "https://www.ransomlook.io/group/darkside" ], "synonyms": [ "BlackMatter" ] }, "uuid": "f514a46e-53ff-4f07-b75a-aed289cf221f", "value": "Darkside" }, { "description": "We recently discovered a new file-encrypting Trojan built as an ELF executable and intended to encrypt data on machines controlled by Linux-based operating systems.\nAfter the initial analysis we noticed similarities in the code of the Trojan, the text of the ransom notes and the general approach to extortion, which suggested that we had in fact encountered a Linux build of the previously known ransomware family RansomEXX. This malware is notorious for attacking large organizations and was most active earlier this year.\nRansomEXX is a highly targeted Trojan. Each sample of the malware contains a hardcoded name of the victim organization. Moreover, both the encrypted file extension and the email address for contacting the extortionists make use of the victim’s name.", "meta": { "extensions": [ "", ".", ".", ".txd0t", ".dbe", ".0s" ], "links": [ "http://rnsm777cdsjrsdlbs4v5qoeppu3px6sb2igmh53jzrx7ipcrbjz5b2ad.onion/", "http://zubllg7o774lgc4rdxmfcfpjewfkqa7ml7gxwl5fetogc7hbkvaprhid.onion/" ], "ransomnotes": [ "Greetings, Texas Department of Transportation!\nRead this message CAREFULLY and contact someone from IT department..\nYour files are securely ENCRYPTED.\nNo third party decryption software EXISTS.\nMODIFICATION or RENAMING encrypted files may cause decryption failure.\nYou can send us an encrypted file (not greater than 400KB) and we will decrypt it FOR FREE, so you have no doubts in possibility to restore all Files\nFrom all aFFected systems ANY TIME.\nEncrypted File SHOULD NOT contain sensitive inFormation (technical, backups, databases, large documents).\nThe rest oF data will be available aFter the PAYMENT.\ninfrastructure rebuild will cost you MUCH more.\nContact us ONLY if you officially represent the whole affected network.\nThe ONLY attachments we accept are non archived encrypted files For test decryption.\nSpeak ENGLISH when contacting us.\nMail us: ***@protonmail.com\nWe kindly ask you not to use GMAIL, YAHOO or LIVE to contact us.\nThe PRICE depends on how quickly you do it. " ], "ransomnotes-filenames": [ "TXDOT_READ_ME! .Txt", " _READ_ME! .txt" ], "ransomnotes-refs": [ "https://1.bp.blogspot.com/-hbdqo4g6OaE/XvpFV4qbjrI/AAAAAAAAT1I/RtASzBEd_VEZIhDCCCdaxrN0iGCnnocFwCLcBGAsYHQ/s1600/note-original.png", "https://1.bp.blogspot.com/-A0tAbQoei_Y/X1UxQkema_I/AAAAAAAAVV8/QuJY6v3n6943ZFax3ztDt9FXwkpAKMPPACLcBGAsYHQ/s1600/note2-9-20.png", "https://1.bp.blogspot.com/-RIwIgb6n0n4/X8-l2HIf88I/AAAAAAAAXRI/oyET6d1XSnwJXDIaJlwItyTFLcp4tz5mQCLcBGAsYHQ/s882/note-8-12-20.png" ], "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomexx", "https://id-ransomware.blogspot.com/2020/06/ransomexx-ransomware.html", "https://github.com/Bleeping/Ransom.exx", "https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/", "https://www.bleepingcomputer.com/news/security/brazils-court-system-under-massive-ransomexx-ransomware-attack/", "https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/4/", "https://securelist.com/ransomexx-trojan-attacks-linux-systems/99279/", "https://www.bleepingcomputer.com/news/security/computer-hardware-giant-gigabyte-hit-by-ransomexx-ransomware", "https://www.cybereason.com/blog/cybereason-vs.-ransomexx-ransomware", "https://www.infosecurity-magazine.com/news/aerospace-giant-embraer-hit", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://gustavopalazolo.medium.com/ransomexx-an%C3%A1lise-do-ransomware-utilizado-no-ataque-ao-stj-918001ec8195", "https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/", "https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://www.bleepingcomputer.com/news/security/ecuadors-state-run-cnt-telco-hit-by-ransomexx-ransomware/", "https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/", "https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout", "https://www.ctir.gov.br/arquivos/alertas/2020/alerta_2020_03_ataques_de_ransomware.pdf", "https://www.ic3.gov/Media/News/2021/211101.pdf", "https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/", "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://www.youtube.com/watch?v=qxPXxWMI2i4", "https://blog.talosintelligence.com/2020/12/quarterly-ir-report-fall-2020-q4.html", "https://medium.com/proferosec-osm/ransomexx-fixing-corrupted-ransom-8e379bcaf701", "https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/", "https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3", "https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/4", "https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/5/", "https://www.bleepingcomputer.com/news/security/ransomware-attack-hits-italys-lazio-region-affects-covid-19-site/", "https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware", "https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/", "https://www.trendmicro.com/en_us/research/21/a/expanding-range-and-improving-speed-a-ransomexx-approach.html", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-ransomexx", "https://www.ransomlook.io/group/ransomexx" ], "synonyms": [ "Ransom X", "Defray777", "Defray-777", "Defray 2018" ] }, "uuid": "dff71334-c173-45b6-8647-af66be0605d7", "value": "RansomEXX" }, { "description": "Mobile ransomware. The Zscaler ThreatLabZ team recently came across a URL named hxxp://coronavirusapp[.]site/mobile.html, which portrays itself as a download site for an Android app that tracks the coronavirus spread across the globe. In reality, the app is Android ransomware, which locks out the victim and asks for ransom to unlock the device.\nThe app portrays itself as a Coronavirus Tracker. As soon as it starts running, it asks the user for several authorizations, including admin rights.\n In fact, this ransomware does not encrypt nor steal anything and only lock the device with an hard coded code.", "meta": { "ransomnotes-refs": [ "https://www.zscaler.com/sites/default/files/images/blogs/covid/covid_lock_screen_edited_4.png", "https://www.zscaler.com/sites/default/files/images/blogs/covid/covid_pastebin_5.png" ], "refs": [ "https://www.zscaler.com/blogs/security-research/covidlock-android-ransomware-walkthrough-and-unlocking-routine" ] }, "uuid": "b5fe83e9-c5d7-4b0e-99ab-4f1d356d1749", "value": "CovidLock" }, { "description": "This malware is written in Java and is named after references in the code. Tycoon has been in the wild since December 2019 and has targeted organizations in the education, SMBs, and software industries.\nTycoon is a multi-platform Java ransomware that targets Windows and Linux systems. This ransomware denies access to the system administrator following an attack on the domain controller and file servers. The initial intrusion occurs through an internet-facing remote desktop protocol (RDP) jump-server.", "meta": { "date": "december 2019", "refs": [ "https://cyberflorida.org/threat-advisory/tycoon-ransomware/", "https://usf.app.box.com/s/83xh0t5w99klrsoisorir7kgs14o972s" ] }, "uuid": "39781a7a-cd3a-4e24-aeb8-94a767a2551b", "value": "Tycoon" }, { "description": "Ragnar Locker is a ransomware identified in December 2019 that targetscorporate networks inBig Game Huntingtargeted attacks. This reportpresents recent elements regarding this ransomware.", "meta": { "links": [ "http://rgleak7op734elep.onion", "http://rgleaktxuey67yrgspmhvtnrqtgogur35lwdrup4d3igtbm3pupc4lyd.onion/", "http://p6o7m73ujalhgkiv.onion" ], "refs": [ "https://www.bleepingcomputer.com/news/security/ragnar-locker-ransomware-targets-msp-enterprise-support-tools/", "https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/", "https://www.cybersecurity-insiders.com/ransomware-attack-makes-cwt-pay-4-5-million-in-bitcoins-to-hackers/", "https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security", "https://www.bleepingcomputer.com/news/security/ransomware-gang-threatens-to-leak-data-if-victim-contacts-fbi-police", "https://twitter.com/malwrhunterteam/status/1475568201673105409", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/analysis-and-protections-for-ragnarlocker-ransomware.html", "http://reversing.fun/posts/2021/04/15/unpacking_ragnarlocker_via_emulation.html", "http://reversing.fun/reversing/2021/04/15/unpacking_ragnarlocker_via_emulation.html", "https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel", "https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf", "https://blog.blazeinfosec.com/dissecting-ragnar-locker-the-case-of-edp/", "https://blog.bushidotoken.net/2022/05/gamer-cheater-hacker-spy.html", "https://blog.cyble.com/2022/01/20/deep-dive-into-ragnar-locker-ransomware-gang/", "https://blog.reversing.xyz/docs/posts/unpacking_ragnarlocker_via_emulation/", "https://blog.reversing.xyz/reversing/2021/04/15/unpacking_ragnarlocker_via_emulation.html", "https://cyware.com/news/ragnar-locker-breached-52-organizations-and-counting-fbi-warns-0588d220/", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://ics-cert.kaspersky.com/media/KASPERSKY_H1_2020_ICS_REPORT_EN.pdf", "https://id-ransomware.blogspot.com/2020/02/ragnarlocker-ransomware.html", "https://intel471.com/blog/conti-ransomware-cooperation-maze-lockbit-ragnar-locker", "https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/", "https://krebsonsecurity.com/2020/11/ransomware-group-turns-to-facebook-ads/", "https://news.sophos.com/en-us/2021/02/03/mtr-casebook-uncovering-a-backdoor-implant-in-a-solarwinds-orion-server/", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/", "https://securelist.com/modern-ransomware-groups-ttps/106824/", "https://securelist.com/targeted-ransomware-encrypting-data/99255/", "https://seguranca-informatica.pt/ragnar-locker-malware-analysis/", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://twitter.com/AltShiftPrtScn/status/1403707430765273095", "https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion", "https://www.accenture.com/us-en/blogs/cyber-defense/moving-left-ransomware-boom", "https://www.acronis.com/en-sg/articles/ragnar-locker/", "https://www.bleepingcomputer.com/news/security/capcom-hit-by-ragnar-locker-ransomware-1tb-allegedly-stolen/", "https://www.bleepingcomputer.com/news/security/fbi-ransomware-gang-breached-52-us-critical-infrastructure-orgs/", "https://www.bleepingcomputer.com/news/security/japanese-game-dev-capcom-hit-by-cyberattack-business-impacted/", "https://www.bleepingcomputer.com/news/security/ragnarlocker-ransomware-hits-edp-energy-giant-asks-for-10m/", "https://www.capcom.co.jp/ir/english/news/pdf/e210413.pdf", "https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1", "https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/", "https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/", "https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/", "https://www.ic3.gov/Media/News/2022/220307.pdf", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ragnarlocker-ransomware-threatens-to-release-confidential-information", "https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/", "https://www.theregister.com/2022/03/09/fbi_says_ragnar_locker_ransomware/", "https://www.waterisac.org/system/files/articles/FLASH-MU-000140-MW.pdf", "https://www.zdnet.com/article/capcom-quietly-discloses-cyberattack-impacting-email-file-servers/", "https://www.ransomlook.io/group/ragnarlocker" ], "synonyms": [ "RagnarLocker" ] }, "related": [ { "dest-uuid": "54895630-efd2-4608-9c24-319de972a9eb", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "5d999c23-11cf-4dee-84bb-f447a4f70dc8", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "related-to" } ], "uuid": "e69f9836-873a-43d3-92a8-97ab783a4171", "value": "Ragnar Locker" }, { "description": "Ransom.Sekhmet not only encrypts a victims files, but also threatens to publish them.", "meta": { "ransomnotes-filenames": [ "RECOVER-FILES.txt" ], "ransomnotes-refs": [ "https://blog.malwarebytes.com/wp-content/uploads/2020/11/Sekhmet_ransom_note.png" ], "refs": [ "https://www.bleepingcomputer.com/news/security/maze-ransomware-is-shutting-down-its-cybercrime-operation/", "https://www.zdnet.com/article/as-maze-ransomware-group-retires-clients-turn-to-sekhmet-ransomware-spin-off-egregor/", "https://blog.malwarebytes.com/detections/ransom-sekhmet/", "https://securityboulevard.com/2020/10/egregor-sekhmets-cousin/" ] }, "related": [ { "dest-uuid": "8bd094a7-103f-465f-8640-18dcc53042e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "5d999c23-11cf-4dee-84bb-f447a4f70dc8", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "successor-of" } ], "uuid": "6fb1ea9e-5389-4932-8b22-c691b74b75a8", "value": "Sekhmet" }, { "description": "Ransomware", "uuid": "79bc13e7-6e96-4974-8110-ffd8e0d12e3e", "value": "$$$" }, { "description": "Ransomware", "uuid": "b93d2b67-aabd-4e36-a3ca-2fdfc8f0ae3b", "value": "$ucyLocker" }, { "description": "Ransomware", "uuid": "f90db14d-e3fd-4f34-b8f8-ba82534732aa", "value": "10001" }, { "description": "Ransomware", "uuid": "cdcf2ad5-afc3-4b7c-8d03-839e54538858", "value": "05250lock" }, { "description": "Ransomware", "uuid": "b4c4f949-2537-47cb-8ccd-653cc37b9309", "value": "0kilobypt" }, { "description": "Ransomware", "uuid": "a663f830-5722-4798-abcf-6c02cb5ba515", "value": "1337-Locker" }, { "description": "Ransomware", "uuid": "0ec8cfbc-7f5b-45c6-9fc1-1bef0d8df161", "value": "24H" }, { "description": "Ransomware", "uuid": "d76b9b9e-a265-4253-a586-3121612d5f9d", "value": "3nCRY" }, { "description": "Ransomware", "uuid": "c36a66c0-1d52-4a2e-ad9c-1965cd18d8f8", "value": "4rw5w" }, { "description": "Ransomware", "uuid": "a617852d-480c-4e16-8983-1ea7c2543eea", "value": "5ss5c(5ss5cCrypt)" }, { "description": "Ransomware", "uuid": "a355ec31-a100-40f2-807b-27f3f0b71067", "value": "777(Legion)" }, { "description": "Ransomware", "uuid": "8f63b8d3-085d-4272-88ea-bf5334f845b1", "value": "7h9r" }, { "description": "Ransomware", "uuid": "66f8ad61-5959-4888-bafe-9f9d4868b3a9", "value": "7z Portuguese" }, { "description": "Ransomware", "uuid": "37479546-7993-4232-9766-de19b0755bc3", "value": "AAC" }, { "description": "Ransomware", "uuid": "461327b8-c465-4d39-8987-dbeb9e296b08", "value": "ABCLocker" }, { "description": "Ransomware", "uuid": "4f7f33e7-ab6a-4643-aa51-da59732a6932", "value": "Adonis" }, { "description": "Ransomware", "uuid": "4d4c478d-2349-4d1c-8693-233517d226ec", "value": "AepCrypt" }, { "description": "Ransomware", "uuid": "c0590d85-d30d-4bf6-b245-4baeab6e6cae", "value": "AES-Matrix" }, { "description": "Ransomware", "uuid": "adbd5acc-27d5-4483-8b9d-73cbda7498fa", "value": "AES-NI: April Edition" }, { "description": "Ransomware", "uuid": "0c1587c6-ac37-48b5-8056-53f4fd454288", "value": "Afrodita" }, { "description": "Ransomware", "uuid": "417027d0-15bc-497e-98a2-a1aaa328fe44", "value": "Alco" }, { "description": "Ransomware", "uuid": "ef762a95-cb95-4a94-84df-2c083cbcf5a6", "value": "AllCry" }, { "description": "Ransomware", "uuid": "74101521-d42c-498a-9c1c-ee31672aaba5", "value": "AlldataLocker" }, { "description": "Ransomware", "uuid": "f8194c43-d40b-47b5-966c-99ffbafa3934", "value": "Amnesia" }, { "description": "Ransomware", "uuid": "0372f2e5-9585-43b7-b171-d765edeedfa0", "value": "Amnesia-2" }, { "description": "Ransomware", "uuid": "cbbf82f2-f614-4cd2-87ea-65262caa79c3", "value": "Anatova" }, { "description": "Ransomware", "uuid": "342ab9d1-70d5-460f-8870-dc6c89037d6d", "value": "AnDROid" }, { "description": "Ransomware", "uuid": "3d519e27-01e8-4038-9eb5-8a3155cf20a7", "value": "AngryKite" }, { "description": "Ransomware", "uuid": "41de97ab-964c-46af-a003-b8158add1658", "value": "AnimusLocker" }, { "description": "Ransomware", "uuid": "9659d9ea-7110-46ef-befe-a1f3c2d1ade2", "value": "Annabelle" }, { "description": "Ransomware", "uuid": "dc5e13f7-ab37-4a4f-a3e3-65a9347e3313", "value": "Annabelle 2.1" }, { "description": "Ransomware", "uuid": "40c30d33-3808-4b9e-a721-21cc967f7ab7", "value": "AnonCrack" }, { "description": "Ransomware", "uuid": "5ca1e51d-4f75-471c-b6d6-0f3ab84c5945", "value": "AnonPop" }, { "description": "Ransomware", "uuid": "2b5904c0-37f1-4e62-bdc4-2e3bdf9f8796", "value": "AnteFrigus" }, { "description": "Ransomware", "uuid": "8d435ed6-1e4e-4082-8407-de85c715a465", "value": "Anti-DDos" }, { "description": "Ransomware", "uuid": "2d9071ae-3e29-452a-8335-3525a5fa749e", "value": "Antihacker2017" }, { "description": "Ransomware", "uuid": "4a03bd26-20b0-4233-b021-8e6496fc42da", "value": "Anubi NotBTCWare" }, { "description": "Ransomware", "uuid": "cba27bf4-1275-407f-ad81-9849ba3a6f45", "value": "Apocalypse-Missing" }, { "description": "Ransomware", "uuid": "63057077-494f-46af-b94d-902f5f526b76", "value": "ApolloLocker" }, { "description": "Ransomware", "uuid": "c7f5c709-5624-4665-ac56-154b0e4eb594", "value": "Argus" }, { "description": "Ransomware", "uuid": "8686cf61-5612-4e7a-8a12-cc31ee5c4daf", "value": "Armage" }, { "description": "Ransomware", "uuid": "d2ff3b81-3d0c-471d-8f57-cfa7eaf75e7e", "value": "Armageddon" }, { "description": "Ransomware", "uuid": "c83ea76e-b34b-47f3-a7c3-9ac4239a6d46", "value": "ArmaLocky" }, { "description": "Ransomware", "uuid": "6219e7b3-31e6-41b7-a519-9897ebc531b6", "value": "Arsium" }, { "description": "Ransomware", "uuid": "0065470b-3cbd-45b9-a2ea-daa688a21521", "value": "Assembly" }, { "description": "Ransomware", "uuid": "d39b8edb-9607-4089-82f3-3a14a05cb372", "value": "Ataware" }, { "description": "Ransomware", "uuid": "3e5f91c2-96ca-4056-9043-39fe4327828a", "value": "Atchbo" }, { "description": "Ransomware", "uuid": "cb2d9643-46af-4512-be90-359bef60359f", "value": "ATLAS" }, { "description": "Ransomware", "uuid": "cfba4795-cd22-4c8e-8067-9600e3cc56f4", "value": "Australian-AES" }, { "description": "Ransomware", "uuid": "a54e8231-6665-41b4-991c-1140a5fd8d00", "value": "AutoEncryptor" }, { "description": "Ransomware", "uuid": "57970f54-2957-444d-a60d-5c10f129064c", "value": "AutoWannaCryV2" }, { "description": "Ransomware", "uuid": "5225f660-288c-4e30-829c-a61d732ff10a", "value": "Auuahk-Ouuohk" }, { "description": "Ransomware", "uuid": "61fc0258-6fd5-481c-b044-2b5e22185049", "value": "AVCrypt" }, { "description": "Ransomware", "uuid": "1ee82db5-c1f6-4b2c-96d0-e2f9519e5406", "value": "AxCrypter" }, { "description": "Ransomware", "uuid": "71eef963-71ad-4641-9e73-3f78a5e2891c", "value": "aZaZeL" }, { "description": "Ransomware", "uuid": "281091db-9517-4ac0-9315-6846f85c567f", "value": "BadEncript" }, { "description": "Ransomware", "uuid": "76d8ccdb-37cf-4eb7-bb64-d3b48b0dfc89", "value": "Balbaz" }, { "description": "Ransomware", "uuid": "3d0b5aa1-3164-4db8-8c87-ced896784ab5", "value": "Baliluware" }, { "description": "Ransomware", "uuid": "dfce034f-30b2-4761-b55e-e88cafb4526a", "value": "Bam!" }, { "description": "Ransomware", "uuid": "7f156e6d-7612-4e74-a5af-a53ea6d19b01", "value": "BananaCrypt" }, { "description": "Ransomware", "uuid": "ac962a32-e2d2-4e64-ab29-524d570a0dcd", "value": "BancoCrypt HT" }, { "description": "Ransomware", "uuid": "e65f4496-0560-49ba-b52a-30df8f1a0d44", "value": "Barack Obama's EBBV" }, { "description": "Ransomware", "uuid": "834bd641-fb8e-40b7-a310-da6aa3f67399", "value": "Basilisque Locker" }, { "description": "Ransomware", "uuid": "736f68d4-9a7f-488d-a8ff-7fd4988c6399", "value": "BASS-FES" }, { "description": "Ransomware", "uuid": "d1846b2a-6017-4c18-8e7d-edcf831ada71", "value": "BB" }, { "description": "Ransomware", "uuid": "0854242f-a664-43bf-b13f-d0e4b718c7b4", "value": "BeethoveN" }, { "description": "Ransomware", "uuid": "aecde5c7-0d8b-41a3-9772-0aba95d87fac", "value": "BestChangeRu" }, { "description": "Ransomware", "uuid": "dda4fb07-113a-4feb-81e5-c04c35addcd3", "value": "BigBossHorse" }, { "description": "Ransomware", "uuid": "abc0f12a-0414-4049-8ee7-90bc1d5d98d9", "value": "Birbware" }, { "description": "Ransomware", "uuid": "4be6c6d2-3417-41ce-8334-c31811c161db", "value": "BitCrypt" }, { "description": "Ransomware", "uuid": "06d438c7-81fa-4c2e-8a48-bd8e3d63a946", "value": "BitCrypt 2.0" }, { "description": "Ransomware", "uuid": "5b45c3e8-7d91-41d4-a7d3-a7bbb0ebdd83", "value": "BitKangoroo" }, { "description": "Ransomware", "uuid": "f66ac6a3-e71c-4cf8-ac5b-02ca80749252", "value": "BitPyLock" }, { "description": "Ransomware", "uuid": "e92e4a0e-7fdb-482a-8ff9-3fa36eb0ca95", "value": "Bitshifter" }, { "description": "Ransomware", "uuid": "b7f51df4-138c-47fb-8c74-419478cc8cba", "value": "BKRansomware" }, { "description": "Ransomware", "uuid": "47fcb57a-4d58-46df-a3f1-3c621c9c5508", "value": "Black Feather" }, { "description": "Ransomware", "uuid": "353e2676-d8c0-4e2b-bf7b-b12aaada96cf", "value": "BlackFireEye" }, { "description": "Ransomware", "uuid": "85fcfa86-65bc-4c35-8584-1f0515a61df3", "value": "BlackHat-Mehtihack" }, { "description": "Ransomware", "uuid": "6dccf9ae-d58d-4a45-baaf-cd873a2fd7bc", "value": "BlackKingdom" }, { "description": "Ransomware", "uuid": "a57d5a37-c3fc-4c26-aac0-0803d4ef8adb", "value": "BlackMist" }, { "description": "Ransomware", "meta": { "links": [ "http://black3gnkizshuynieigw6ejgpblb53mpasftzd6pydqpmq2vn2xf6yd.onion" ], "refs": [ "https://www.ransomlook.io/group/blackout" ] }, "uuid": "b05ae01a-bcc4-4642-a165-40b503ad260f", "value": "Blackout" }, { "description": "Ransomware", "uuid": "3485d93d-c6cd-4a45-85c9-6e3cda016ae6", "value": "BlackPink" }, { "description": "Ransomware", "uuid": "01fcca8a-a5b7-4683-b457-66a720f6e569", "value": "BlackRose" }, { "description": "Ransomware", "uuid": "8fba79e8-a902-4fbe-8c84-67e2b266ddb6", "value": "BlackSheep" }, { "description": "Ransomware", "uuid": "14e57527-58cc-4e0a-8e14-9f00a0167610", "value": "Black Worm" }, { "description": "Ransomware", "uuid": "0ac4a0b6-c4db-408d-8b0d-7bd4fa7d9c5d", "value": "Blank" }, { "description": "Ransomware", "uuid": "1edc8d40-837b-4ec2-9be4-15c63d5dd266", "value": "Blind" }, { "description": "Ransomware", "uuid": "11a5a5ac-91f6-41b0-a4c9-010d7754f938", "value": "Blitzkrieg" }, { "description": "Ransomware", "uuid": "cda890bf-1d9e-4566-9bc7-3bb4cd3ee571", "value": "BlockFile12" }, { "description": "Ransomware", "uuid": "a79b56a9-50e7-42c4-b8b6-fda1fa2dc097", "value": "BloodJaws" }, { "description": "Ransomware", "uuid": "01ef6f02-22e4-478f-b02f-6515caf078e3", "value": "Blooper" }, { "description": "Ransomware", "uuid": "147e865d-90f6-4332-bdad-967ea69a4b11", "value": "BlueCheeser" }, { "description": "Ransomware", "uuid": "3c40df84-ef3b-4f59-86ed-a7a6acd0d902", "value": "Bluerose" }, { "description": "Ransomware", "uuid": "13f3e911-757c-401f-b2c9-fedf7f089d3f", "value": "BOK" }, { "description": "Ransomware", "uuid": "0c9f224c-2649-4aa7-bdce-fd8655b1fe92", "value": "BoooamCrypt" }, { "description": "Ransomware", "uuid": "88533a36-b417-4a90-888e-a4a70dab39fe", "value": "BooM" }, { "description": "Ransomware", "uuid": "12007b9f-af6b-4dcd-ac50-99154b1045be", "value": "Boris HT" }, { "description": "Ransomware", "uuid": "c316df34-8f12-49ef-9534-b28b640047cc", "value": "BrainLag" }, { "description": "Ransomware", "uuid": "3e83ee9d-bfc7-49bf-9ecf-6185d887b51e", "value": "BRansomware" }, { "description": "Ransomware", "uuid": "b1298047-13af-4241-b491-305ceb5af7e7", "value": "Brick" }, { "description": "Ransomware", "uuid": "74284a53-0078-4819-817a-2283ff04e9d8", "value": "BrickR" }, { "description": "Ransomware", "uuid": "8903296a-2ebb-4ec6-97e4-2379348906ff", "value": "BtcKING" }, { "description": "Ransomware", "uuid": "52ce04e8-c764-4ded-8df6-f3df15a5b117", "value": "BTCWare-Aleta" }, { "description": "Ransomware", "uuid": "d11b8d25-7731-43e6-8880-4ed6bc4d66cd", "value": "BTCWare-Gryphon" }, { "description": "Ransomware", "uuid": "6416e35d-8507-4144-b1ad-323161f25217", "value": "BTCWare-Master" }, { "description": "Ransomware", "uuid": "a8bd5e60-954c-463d-94b6-a76c45310f6b", "value": "BTCWare-Nuclear" }, { "description": "Ransomware", "uuid": "670eec47-c2ae-491d-b102-328866b8a312", "value": "BTCWare-Onyon" }, { "description": "Ransomware", "uuid": "7c37c90b-7750-4f5f-ba64-3f058ac83788", "value": "BTCWare-PayDay" }, { "description": "Ransomware", "uuid": "f6246bb2-bb04-43ef-acbf-f88b5bc78440", "value": "BTCWare-Wyvern" }, { "description": "Ransomware", "uuid": "4f0ddce5-6f85-4f76-b93a-48e15d45f211", "value": "Bud" }, { "description": "Ransomware", "uuid": "80b3b6cd-9cc7-4a98-b342-c83d7a167abf", "value": "BugWare" }, { "description": "Ransomware", "uuid": "d3fdd556-cfb4-4aba-b4a9-6698a95cd17c", "value": "BulbaCrypt HT" }, { "description": "Ransomware", "uuid": "ce6c2b29-8195-4754-ae24-2e1321764afe", "value": "BWall" }, { "description": "Ransomware", "uuid": "cafacee4-da55-4ec0-ae5c-f7b9d80d0ebf", "value": "C0hen Locker" }, { "description": "Ransomware", "uuid": "d56bd7ad-8620-407f-9429-0ff3a0b106b9", "value": "CA$HOUT" }, { "description": "Ransomware", "uuid": "708623d0-bbc7-4a8c-9ef8-0266fbf44196", "value": "CainXPii" }, { "description": "Ransomware", "uuid": "5261a5d0-a1b0-46f4-b5ae-f32e2728b1cb", "value": "Cephalo" }, { "description": "Ransomware", "uuid": "cabe1175-a46b-47e4-9d25-655af0411208", "value": "Cerberos" }, { "description": "Ransomware", "uuid": "1fc9a816-ba8d-4811-b930-e2b3c732566f", "value": "Charmant" }, { "description": "Ransomware", "uuid": "c9bc4999-a62e-46d5-b0a2-56de5fcde9d5", "value": "Chekyshka" }, { "description": "Ransomware", "uuid": "cabdc3c6-17cc-43f1-b469-2372be8d9474", "value": "ChernoLocker" }, { "description": "Ransomware", "uuid": "cfd553d0-385b-459a-bc24-dee116249614", "value": "ChinaYunLong" }, { "description": "Ransomware", "uuid": "8b644615-af51-4f46-ad09-68274e48ce2b", "value": "Christmas" }, { "description": "Ransomware", "uuid": "b87bf395-3e4f-4b2b-bad5-ac88a6c19741", "value": "ClicoCrypter" }, { "description": "Ransomware", "uuid": "5a4c04f0-0d05-4068-ba64-bd4979b58d5c", "value": "ClicoCrypter-2" }, { "description": "Ransomware", "uuid": "81b6aafe-7b16-4d86-94d7-23fc172d0b81", "value": "Clouded" }, { "description": "Ransomware", "uuid": "5f784db9-36e0-4763-aebc-474b53558cef", "value": "Cmd" }, { "description": "Ransomware", "uuid": "9bb10b99-a440-4dea-905c-87e95e13e1ae", "value": "Codemanager" }, { "description": "Ransomware", "uuid": "905eb47a-0494-402b-ac95-ad201627ff20", "value": "Coin Locker" }, { "description": "Ransomware", "uuid": "d3b9dd33-3928-4999-8934-aff1ec1fc1a8", "value": "Comrade HT" }, { "description": "Ransomware", "uuid": "e0d382e1-0ad3-476e-a953-e7f53c42a703", "value": "CoNFicker" }, { "description": "Ransomware", "uuid": "3f3bdf79-67c9-41f5-bc26-398b11cc9551", "value": "Coom" }, { "description": "Ransomware", "uuid": "66f35862-3f0c-4328-a792-12e90b6baca8", "value": "CorruptCrypt" }, { "description": "Ransomware", "uuid": "5dc6d20f-db0c-44e9-95a3-ee4adb1aa3ad", "value": "Creeper" }, { "description": "Ransomware", "uuid": "a3ff8fe7-54b5-4404-b7b7-cf823027e647", "value": "Creepy" }, { "description": "Ransomware", "uuid": "8d927c7b-2526-4cf4-a3e6-093f929fa264", "value": "Cripton" }, { "description": "Ransomware", "uuid": "5470834d-dc90-492f-8ed8-666c40911515", "value": "Cripton7zp" }, { "description": "Ransomware", "uuid": "d4a347c9-6f9b-4578-b7d2-fdcbc0c04d1d", "value": "Cry36" }, { "description": "Ransomware", "uuid": "67543823-e4d9-4321-82a0-06820f6cc3e0", "value": "Cry9" }, { "description": "Ransomware", "meta": { "synonyms": [ "PayPalGenerator2019" ] }, "uuid": "92ca663a-347a-47d7-b7da-1208b84a7217", "value": "CryCipher" }, { "description": "Ransomware", "uuid": "381ef192-e5ee-4d58-86a3-de853837cb9e", "value": "CryForMe" }, { "description": "Ransomware", "uuid": "654fdcba-0432-42e4-9ca9-8b89dd9f0d98", "value": "Crying" }, { "description": "Ransomware", "uuid": "4b7d257a-db3a-418a-a295-56ead7fa573c", "value": "CryMore" }, { "description": "Ransomware", "uuid": "b08ca08b-7561-4425-95c7-aa01589022cf", "value": "Cryp70n1c" }, { "description": "Ransomware", "uuid": "56cdf22e-2c02-4413-9d5f-e30d458c995c", "value": "Crypt0 HT" }, { "description": "Ransomware", "uuid": "be108e7d-d3d8-4e21-88d7-093d4674eb88", "value": "Crypt0" }, { "description": "Ransomware", "uuid": "e4f33b48-653a-4d11-94fd-16d81360e2af", "value": "Crypt0L0cker" }, { "description": "Ransomware", "uuid": "b4841b77-1f57-4d7a-8801-1808ca291cfc", "value": "Crypt0r" }, { "description": "Ransomware", "uuid": "291daba8-62d3-4bd0-bcfa-68dcba4425c5", "value": "Crypt12" }, { "description": "Ransomware", "uuid": "5a23ab82-e373-4429-99e9-743119000dea", "value": "CryptFuck" }, { "description": "Ransomware", "uuid": "d07b4335-f967-4e82-80dd-861cd3864c28", "value": "CryptGh0st" }, { "description": "Ransomware", "uuid": "6181604f-86e3-4aca-acd1-e715092a5f0f", "value": "Crypto_Lab" }, { "description": "Ransomware", "uuid": "7864b740-8f71-43f0-afa8-585a12dd7a8b", "value": "CryptoApp" }, { "description": "Ransomware", "uuid": "bb0e8fd4-e737-4781-860c-9f97fc7724b6", "value": "Crypto-Blocker" }, { "description": "Ransomware", "uuid": "5ba61618-2e80-4330-88ef-101c5c1d8432", "value": "CryptoBoss" }, { "description": "Ransomware", "uuid": "72be1360-a686-4f32-8179-a2a466d0898e", "value": "CryptoCat" }, { "description": "Ransomware", "uuid": "876c1bbb-0723-46b2-92a2-1fe0917e432a", "value": "CryptoClone" }, { "description": "Ransomware", "uuid": "be33ab7d-d272-4430-8e8c-7fdbd379e188", "value": "CryptoDark" }, { "description": "Ransomware", "uuid": "4a9a48f2-5aa9-4a3c-9c7a-928ee513abf2", "value": "CryptoGod 2017" }, { "description": "Ransomware", "uuid": "5360787b-68b8-4827-a38e-af04ae150943", "value": "CryptoGod 2018" }, { "description": "Ransomware", "uuid": "0cb45ddc-d7c7-42b8-b006-3aecff1d5ebc", "value": "CryptoLite" }, { "description": "Ransomware", "uuid": "97320061-1478-486c-ba54-62018fe31fdb", "value": "CryptolockerEmulator" }, { "description": "Ransomware", "uuid": "ca054485-d14d-45df-92ae-47b9b4dbc4c7", "value": "CryptoLockerEU 2016" }, { "description": "Ransomware", "uuid": "8538f7d6-9fcb-4070-bb0c-aff7bb7874f1", "value": "CryptoManiac" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "value": "CryptoMix-0000" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "value": "CryptoMix-Arena" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "value": "CryptoMix-Azer" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "value": "CryptoMix-Backup" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "value": "CryptoMix-CK" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "value": "CryptoMix-Coban" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "value": "CryptoMix-DLL" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "value": "CryptoMix-Empty" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "value": "CryptoMix-Error" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "value": "CryptoMix-Exte" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "value": "Cryptomix-FILE" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "value": "CryptoMix-MOLE66" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "value": "CryptoMix-Noob" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "value": "CryptoMix-Ogonia" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "value": "CryptoMix-Pirate" }, { "description": "Ransomware", "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "value": "CryptoMix-Revenge" }, { "description": "Ransomware", "meta": { "synonyms": [ "SERVER Cryptomix" ] }, "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "value": "Cryptomix-SERVER" }, { "description": "Ransomware", "meta": { "synonyms": [ "Shark CryptoMix" ] }, "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "value": "CryptoMix-Shark" }, { "description": "Ransomware", "meta": { "synonyms": [ "System CryptoMix" ] }, "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "value": "CryptoMix-System" }, { "description": "Ransomware", "meta": { "synonyms": [ "Tastylock CryptoMix" ] }, "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "value": "CryptoMix-Tastylock" }, { "description": "Ransomware", "meta": { "synonyms": [ "Test CryptoMix" ] }, "related": [ { "dest-uuid": "c76110ea-15f1-4adf-a28d-c707374dbb3a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "value": "CryptoMix-Test" }, { "description": "Ransomware", "related": [ { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "value": "CryptoMix-Wallet" }, { "description": "Ransomware", "meta": { "synonyms": [ "WORK CryptoMix" ] }, "related": [ { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "value": "Cryptomix-WORK" }, { "description": "Ransomware", "meta": { "synonyms": [ "x1881 CryptoMix" ] }, "related": [ { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "value": "CryptoMix-x1881" }, { "description": "Ransomware", "meta": { "synonyms": [ "XZZX CryptoMix" ] }, "related": [ { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "value": "CryptoMix-XZZX" }, { "description": "Ransomware", "meta": { "synonyms": [ "Zayka CryptoMix" ] }, "related": [ { "dest-uuid": "20b848d1-3f21-403b-a4c8-c5d2a89faeb9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "771706fa-1015-4bcd-9a74-293285fcd051", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ecaef53f-a4a2-4360-b8e1-cca7b606596a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "2fec3512-9782-4b3b-a880-30fda4641858", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "8c484784-308a-498f-948b-bc5df8ba4725", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "aabd25a5-021a-49db-bda8-a922f41c678c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c1092c4f-91a1-469a-a144-c5d10a94fed6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "86d45c08-bb85-4d0f-a5d5-3d73d65bd2e5", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "41d393ee-a8ee-4a9d-b510-e1b6a59054f9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ea68b5a8-6f9e-441a-a308-5e4fda8dbab6", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "26fa33ba-528c-49f8-94c2-db4047a37bd0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d61b7ace-ba80-4d79-9ff2-b6f80af5770b", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "ef2f721b-0bc0-4f2a-8803-263368fa467d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "3c3b5442-f81f-4011-a176-f0f63e6fcd3f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "312c93ae-9405-445b-be11-2d0e4aec4f84", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "6a8ed1dd-34f1-42a3-9d9a-f81d91f53f7c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "460e3f42-15dc-4e73-ad39-76af8d272379", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "fc5ee56f-3cd1-4120-9b33-48993987d98d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "00ca9891-c7dd-44db-a374-14b92169741a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "d8fcab2d-f80c-4165-88f5-db29f7aa1087", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a4bac628-162c-4487-9bb5-c34e42dec72a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "51b0559d-547f-40c0-850a-df9f67c08baf", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "99c5cbdd-9c04-4c18-bcdd-9ee9b4dba862", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "b55c38f8-b369-4f91-904c-b0758927bd99", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "e1eea458-c466-48d8-a121-f5fe14a1cc75", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "548e3dcd-8448-4318-830a-b8fa46f34fd3", "value": "CryptoMix-Zayka" }, { "description": "Ransomware", "uuid": "19d80d86-1f3d-47b5-82f1-5c2b3ab279d8", "value": "Crypton" }, { "description": "Ransomware", "uuid": "02fef633-e89f-43f5-bf52-a4e18f670a2d", "value": "CryptoPatronum" }, { "description": "Ransomware", "uuid": "334525f2-9e02-4d7e-b866-6a950341b848", "value": "CryptoPokemon" }, { "description": "Ransomware", "uuid": "d5ccf284-90c3-44b6-9b90-ddc4717defac", "value": "CryptorBit" }, { "description": "Ransomware", "uuid": "b1a948b2-d072-47d3-9512-e22fe8fb9fb1", "value": "CryptoShield 2.0" }, { "description": "Ransomware", "uuid": "e28ac7f9-cb1e-4e28-aace-27162529e96c", "value": "CryptoSpider" }, { "description": "Ransomware", "uuid": "84a6d707-6163-4c05-a3a2-d5c605cb6267", "value": "CryptoViki" }, { "description": "Ransomware", "uuid": "6260f9a3-b4c6-4f0b-910f-c98c3a13a2de", "value": "Cryptre" }, { "description": "Ransomware", "uuid": "39f15885-0ef0-4f04-a837-f1da4b4813bc", "value": "CrypTron" }, { "description": "Ransomware", "uuid": "d757c892-1d05-41f7-9aec-cb9f72316432", "value": "Crysis XTBL" }, { "description": "Ransomware", "uuid": "bfd0bcdc-3cc6-4d4b-bf5c-e1467e985610", "value": "Crystal" }, { "description": "Ransomware", "uuid": "e64a7cc3-2454-4e77-8fd9-ed12d854e2dd", "value": "CrystalCrypt" }, { "description": "Ransomware", "uuid": "e429df1e-ee56-48ff-801f-5648ce9b47cb", "value": "CryTekk" }, { "description": "Ransomware", "uuid": "76b33701-ac6e-4ef1-95b8-b7e18204b901", "value": "CSP" }, { "description": "Ransomware", "uuid": "1fda05ea-74c7-4942-ac5d-0d9b6adc4eed", "value": "CTB-Locker Original" }, { "description": "Ransomware", "uuid": "ce5eb940-5fd6-4d2f-bfa8-2191ae3e4239", "value": "CTF" }, { "description": "Ransomware", "uuid": "ed087a5a-41f7-4997-9701-ef46c984d89d", "value": "Curumim" }, { "description": "Ransomware", "uuid": "6cd337d7-b073-4950-afe9-8979151137ae", "value": "CVLocker" }, { "description": "Ransomware", "uuid": "a255f8e2-5ffa-4b4e-91b7-f5620cf8a2ea", "value": "Cyber Police HT" }, { "description": "Ransomware", "uuid": "6b6d567b-dcaf-4ebd-b3c7-d81ecaf6e820", "value": "CyberDrill2" }, { "description": "Ransomware", "uuid": "59dc87a1-e66f-48a3-8eb9-9591b3c8339b", "value": "CyberResearcher" }, { "description": "Ransomware", "uuid": "b9a0558f-b975-4406-8381-7e93e2d96394", "value": "CyberSCCP" }, { "description": "Ransomware", "uuid": "3a69e0f9-ef7e-418e-87f5-821b5f7c7d3d", "value": "CyberSoldier" }, { "description": "Ransomware", "uuid": "67e652fe-2689-41f1-b7fe-1550ec3031ab", "value": "Cyclone" }, { "description": "Ransomware", "uuid": "d1ed0b02-020f-467f-9b4b-4c1c910257a2", "value": "CypherPy" }, { "description": "Ransomware", "uuid": "bb8b3841-4e99-4114-b640-00dfef8206cf", "value": "Cyspt" }, { "description": "Ransomware", "uuid": "b536d9b6-f3b6-446d-94d7-a6ac36f2ecf8", "value": "Czech" }, { "description": "Ransomware", "uuid": "8971edef-7b24-4682-8a6e-9aff32778ebf", "value": "D00mEd" }, { "description": "Ransomware", "uuid": "fcf7240e-7d1b-4b0d-84b8-7ab0919b5444", "value": "D2+D" }, { "description": "Ransomware", "uuid": "15d3732d-5ca8-4dc4-bf9b-8f7791706d17", "value": "DarkKomet" }, { "description": "Ransomware", "uuid": "a3e8d4f9-d24d-40de-9ba9-256774da6d17", "value": "DarkLocker" }, { "description": "Ransomware", "uuid": "27d38148-e9d4-4b4b-8b7b-514060493a40", "value": "DarkoderCryptor" }, { "description": "Ransomware", "uuid": "4c90d525-b24f-43b5-941e-2bc3038669ff", "value": "DataKeeper" }, { "description": "Ransomware", "uuid": "0f22483f-8227-4977-8097-55d5f3971a32", "value": "Datebatut" }, { "description": "Ransomware", "uuid": "3f550aa8-f9ec-4040-be24-1182c0f6637f", "value": "DCRTR" }, { "description": "Ransomware", "uuid": "3b0aa35a-b0f7-4263-b7a6-50efdb5b4c42", "value": "DCRTR-WDM" }, { "description": "Ransomware", "uuid": "25d55a0a-7a5c-4ce2-be3e-7fda4be4cfe6", "value": "DCry" }, { "description": "Ransomware", "uuid": "6bc76688-d22f-414b-8019-a4e22d76a662", "value": "DDE" }, { "description": "Ransomware", "uuid": "7af4bdcb-bfeb-4ad1-8b6c-eae6df8f81b0", "value": "DeadSec-Crypto" }, { "description": "Ransomware", "uuid": "ee027575-6c9e-4803-80fa-6ff4f4d0af68", "value": "DeathHiddenTear (Large&Small HT) > " }, { "description": "Ransomware", "uuid": "101c648e-8c7a-4082-902f-37a536c38063", "value": "DeathNote" }, { "description": "Ransomware", "uuid": "b4ad80c6-1a90-4f20-a3e2-8e127a295861", "value": "DeathRansom" }, { "description": "Ransomware", "uuid": "8c7cd622-c0cb-4d4a-991b-99de948baf8d", "value": "DecryptIomega" }, { "description": "Ransomware", "uuid": "b298b00f-1cc9-4b08-b2a2-8b16cafdee73", "value": "Decryption Assistant" }, { "description": "Ransomware", "uuid": "54a0441c-c25d-4a7a-b572-2a8fb1d91a61", "value": "DecService" }, { "description": "Ransomware", "uuid": "89f73121-682a-4675-815e-af3b3183c000", "value": "DecYourData" }, { "description": "Ransomware", "uuid": "d14aacd7-dea9-44ea-8160-ffee220fb572", "value": "Defender" }, { "description": "Ransomware", "uuid": "ca4b65f9-b49e-4531-90a9-4448e0a1fbce", "value": "Defray (Glushkov)" }, { "description": "Ransomware", "uuid": "fac72d3c-e12e-4ec0-8006-176d2f10df56", "value": "Deos" }, { "description": "Ransomware", "uuid": "8fab2ebc-526e-46ce-9f32-4ae06337acd4", "value": "Desktop" }, { "description": "Ransomware", "uuid": "e2a2169c-73ac-4ee3-aa0d-05c00fffd9f2", "value": "Diamond" }, { "description": "Ransomware", "uuid": "1435b9b7-2c3d-4f0d-b651-617b67877273", "value": "DilmaLocker" }, { "description": "Ransomware", "uuid": "a3ea2517-9e89-4088-9433-6091f29b8a22", "value": "Dishwasher" }, { "description": "Ransomware", "uuid": "b28aa31f-32cf-44eb-ae6f-2d952b1e9a01", "value": "District" }, { "description": "Ransomware", "uuid": "517622cc-b402-4791-b5cd-b793f7bcf232", "value": "DMA Locker 1.0-2.0-3.0" }, { "description": "Ransomware", "uuid": "0a852768-faaa-4e9f-88b4-cdc8887a4518", "value": "DMA Locker 4.0" }, { "description": "Ransomware", "uuid": "b7a27265-4300-401b-b8e4-82ec20cea5f9", "value": "DMALocker Imposter" }, { "description": "Ransomware", "uuid": "0416d649-c1e1-4e52-9b02-dd78dc4829ba", "value": "Dodger" }, { "description": "Ransomware", "uuid": "29d2e73b-dda0-4206-9c45-597dd2fd2c81", "value": "DolphinTear" }, { "description": "Ransomware", "uuid": "dec37a2c-1f82-4a42-9ac4-1cbadcec28a7", "value": "Donald Trump" }, { "description": "Ransomware", "uuid": "abb380f4-1237-421f-8b34-5616acdabdfb", "value": "Donation1" }, { "description": "Ransomware", "uuid": "2e8f75c9-5122-4f5d-a32d-c6b500f7cd28", "value": "Done" }, { "description": "Ransomware", "uuid": "177d029a-4414-4300-8ef3-2dd476f006e9", "value": "Dont_Worry" }, { "description": "Ransomware", "uuid": "d029f838-1bf1-4a35-bd7c-43bd0a513693", "value": "DotNoData" }, { "description": "Ransomware", "uuid": "bbb53d99-09e9-42a9-812e-96539da0ed4b", "value": "DotZeroCMD" }, { "description": "Ransomware", "uuid": "b544ea57-deee-4e66-91c4-b4d02a9e283e", "value": "Dr. Fucker" }, { "description": "Ransomware", "uuid": "10731cae-b25b-49a7-b821-c4b655e99a38", "value": "Dr. Jimbo" }, { "description": "Ransomware", "uuid": "099c3512-a86b-40dc-94f9-7f2052991212", "value": "Drakos" }, { "description": "Ransomware", "uuid": "68b0ba66-0c9e-4ae2-856d-d43c024c5e0c", "value": "DriedSister" }, { "description": "Ransomware", "uuid": "c14d0a23-5394-4a51-b3d6-7602b4b8d6ac", "value": "Dviide" }, { "description": "Ransomware", "uuid": "bfd3bb40-5057-4774-983f-1d61ab5fd38d", "value": "eBayWall" }, { "description": "Ransomware", "uuid": "1222a73b-6ae7-4e21-9fd0-df2ddc2d9ef3", "value": "EbolaRnsmwr" }, { "description": "Ransomware", "uuid": "19638b5e-cfc9-4bbd-9f21-0efc7cd1929a", "value": "ECLR" }, { "description": "Ransomware", "uuid": "b166020d-baac-4424-ab13-fbdfcd52dee5", "value": "EggLocker" }, { "description": "Ransomware", "uuid": "1c8c31ef-0d95-4e70-baf2-7d85fa46f1fd", "value": "Ekati demo tool" }, { "description": "Ransomware", "uuid": "5f47e7f6-b872-443c-83d5-5993dca85e0b", "value": "Enc1" }, { "description": "Ransomware", "uuid": "a24aee63-5e3c-4aec-a79d-6cb3cf2ee7a5", "value": "EncoderCSL" }, { "description": "Ransomware", "uuid": "8856e9e4-4774-44af-a89c-00ee64af95b3", "value": "EnCrypt" }, { "description": "Ransomware", "uuid": "7f2f2f1c-43ec-40a4-92f3-e6b27a86fd66", "value": "EncryptedBatch" }, { "description": "Ransomware", "uuid": "cb1db616-8c54-46c9-9a54-c59b0f34203e", "value": "EncryptServer2018" }, { "description": "Ransomware", "uuid": "049a556e-143c-4ed4-a1d5-b32a5818e3f5", "value": "EnybenyCrypt" }, { "description": "Ransomware", "uuid": "44816458-fbf1-46f5-9189-031a4f5a9494", "value": "EOEO" }, { "description": "Ransomware", "uuid": "34b549c2-e28f-475c-916e-d164b7d984bf", "value": "Epoblockl" }, { "description": "Ransomware", "uuid": "50a03182-fb83-4d2d-a33b-13bbab4f9c94", "value": "Erica2020" }, { "description": "Ransomware", "uuid": "1d48b852-ddb9-4294-9502-244b2664fe0c", "value": "Eris" }, { "description": "Ransomware", "uuid": "35275d91-8878-45fd-aa11-d5932a4a3707", "value": "Estemani" }, { "description": "Ransomware", "uuid": "b1fe23d0-e3f3-4164-ab96-4e859a25e639", "value": "Eternal" }, { "description": "Ransomware", "uuid": "97c7c06d-e2b6-459c-92ec-bde5a4dd54ff", "value": "Eternity" }, { "description": "Ransomware", "uuid": "4b7906b7-1e17-4c5d-a56f-abf238e42dcf", "value": "Euclid" }, { "description": "Ransomware", "uuid": "6287e47b-7919-4be1-9ee8-c3a9a7f0feab", "value": "Evasive HT" }, { "description": "Ransomware", "uuid": "47554d81-a6d9-4017-ad8c-cab653e6a1b3", "value": "Evolution" }, { "description": "Ransomware", "uuid": "803671d5-8d84-45c9-aef0-13dbaedd2b4c", "value": "Executioner" }, { "description": "Ransomware", "uuid": "ed1bebe5-6bad-448c-8b92-ca7fd8563a2b", "value": "ExecutionerPlus" }, { "description": "Ransomware", "uuid": "23fe7df3-ad1b-4270-b519-3d7db4d62d0b", "value": "Exocrypt XTC" }, { "description": "Ransomware", "uuid": "89aed7ce-b8db-4d66-91b3-cae5def39255", "value": "ExoLock" }, { "description": "Ransomware", "uuid": "80304c6b-de78-4db0-a0b9-7e3164f818d2", "value": "ExpBoot" }, { "description": "Ransomware", "uuid": "7b9fa522-8db4-4b29-adcf-7c01c21c39b4", "value": "Explorer" }, { "description": "Ransomware", "meta": { "synonyms": [ "Sextortion Scam" ] }, "uuid": "08890a08-8ffc-49f5-b5b9-6a89002327f3", "value": "Extortion Scam" }, { "description": "Ransomware", "uuid": "59c28ba7-d42a-42d8-afaa-69fcbe9eaadb", "value": "Extractor" }, { "description": "Ransomware", "uuid": "a6ef13a1-5429-47eb-8d8b-5ffde2ebdff0", "value": "EyLamo" }, { "description": "Ransomware", "uuid": "919cadc1-9089-4fd4-a8d9-c83089f78391", "value": "EZDZ" }, { "description": "Ransomware", "uuid": "0c22c2e4-f83e-4f16-841c-534d569a1b30", "value": "Fabiansomware" }, { "description": "Ransomware", "uuid": "7ccbce77-7251-451f-ba92-da1439a916d0", "value": "Facebook HT" }, { "description": "Ransomware", "uuid": "f656c54f-d252-4441-af31-f88a9fcc6ee4", "value": "Faizal" }, { "description": "Ransomware", "uuid": "27e5da0f-5f6c-460c-b1b7-03e78724ab07", "value": "Fake Cerber" }, { "description": "ransomware", "uuid": "bc7a4be2-1997-40ba-beb7-553120b1411b", "value": "Fake DMA" }, { "description": "ransomware", "uuid": "29cd31bb-819f-4d01-9805-ba9656a2d215", "value": "FartPlz" }, { "description": "ransomware", "uuid": "6d97efca-8d12-45d3-93c3-93a4d3839110", "value": "FBLocker" }, { "description": "ransomware", "uuid": "3a05c407-80bc-491d-9065-97b53137694c", "value": "FCP" }, { "description": "ransomware", "uuid": "42aea797-8789-43ed-aca5-0c492a3a8970", "value": "FCrypt" }, { "description": "ransomware", "uuid": "010a5c7b-ec43-4540-9c67-4b4f73c82c06", "value": "FCT" }, { "description": "ransomware", "uuid": "4e344305-4a3b-43b5-a2a6-5cf669e416e7", "value": "Fenrir" }, { "description": "ransomware", "uuid": "7c698732-90bb-4a72-a8ac-f6194761c546", "value": "File Ripper" }, { "description": "ransomware", "uuid": "35c968af-cee9-40bf-9d62-b8ba5d6dbc8f", "value": "FileFuck" }, { "description": "ransomware", "uuid": "39a197ff-be4b-45a7-bdc8-fc17af421d63", "value": "FilesL0cker" }, { "description": "ransomware", "uuid": "06db1c0f-5dcd-4dad-8fb5-cdf8afdf2ab6", "value": "Final" }, { "description": "ransomware", "uuid": "02c5bf92-23e8-404c-9fe9-5e50f587d0c4", "value": "FindZip" }, { "description": "ransomware", "uuid": "b9f1d220-2ef0-4b1d-84ed-ae6843e5828e", "value": "Flatcher3" }, { "description": "ransomware", "uuid": "51f42a21-1963-40c5-b644-d4c1c5c3f9eb", "value": "Fluffy-TAR" }, { "description": "ransomware", "uuid": "10254366-b6d0-4266-a277-6ef4eee460b3", "value": "Foxy" }, { "description": "ransomware", "uuid": "a5e54d82-cb41-420e-a03d-89b762560dcc", "value": "Freshdesk" }, { "description": "ransomware", "uuid": "5df125ae-9362-415d-a915-f478447eece5", "value": "Frog" }, { "description": "ransomware", "uuid": "61c215e0-835b-488a-8e82-94da05871b80", "value": "FrozrLock" }, { "description": "ransomware", "uuid": "8467b6f2-7132-4695-87a6-6a7400c3a7d8", "value": "FRS" }, { "description": "ransomware", "uuid": "d81208be-6715-4ef5-b354-9283d7eed531", "value": "FScrypt" }, { "description": "ransomware", "uuid": "db9571dc-7ebc-4f2b-a31b-944851c16346", "value": "FuckTheSystem" }, { "description": "ransomware", "uuid": "6247ab38-e6dd-4020-8771-f1fdfc9e86bd", "value": "FuxSocy Encryptor" }, { "description": "ransomware", "uuid": "1ef5a7de-9fe2-4cfb-a6ff-7f63bc31bf94", "value": "Galacti-Crypter" }, { "description": "ransomware", "uuid": "9734c2bc-d638-4b69-9189-c6141f66bcab", "value": "GameOver" }, { "description": "ransomware", "uuid": "dd9dd6b6-97c6-4cd1-bd3a-f7e95526b090", "value": "Geminis3" }, { "description": "ransomware", "uuid": "0a59664f-b447-4c5e-b8e4-8842e381390b", "value": "Gendarmerie" }, { "description": "ransomware", "uuid": "317eee8b-2a8b-4d2a-a17c-9fa651de2f06", "value": "Genobot" }, { "description": "ransomware", "uuid": "7f94ad48-3321-4fbb-850d-a0e6cb300815", "value": "GermanWiper" }, { "description": "ransomware", "uuid": "857a6d87-3fe7-426a-8679-7029134800af", "value": "GhosTEncryptor" }, { "description": "ransomware", "uuid": "66c1ee94-a302-4f25-a54a-fdc2e2c3d164", "value": "GhostHammer" }, { "description": "ransomware", "uuid": "abf2485a-8fc6-46a5-9400-d188711a3cb2", "value": "Gibberish" }, { "description": "ransomware", "uuid": "5845d539-8c80-4957-92ea-7aa968ec784c", "value": "Gibon" }, { "description": "ransomware", "uuid": "f03fb4bc-7762-4529-bce1-d851619fb0d4", "value": "Giyotin" }, { "description": "ransomware", "uuid": "c18fb798-f2f8-4119-aee3-5888241d129f", "value": "GoCryptoLocker" }, { "description": "ransomware", "uuid": "287f5d11-c1da-4409-8404-543c68cc968e", "value": "Godra" }, { "description": "ransomware", "uuid": "df998c50-52d0-462d-9bbb-5b93a5adc7b0", "value": "GoGoogle" }, { "description": "ransomware", "uuid": "e88b85ed-d20d-416a-bde9-2a2ba60f9c70", "value": "GoHack" }, { "description": "ransomware", "uuid": "c51e8939-8b5d-4b5e-a73e-92944e1392c0", "value": "Golden Axe" }, { "description": "ransomware", "uuid": "61fbe157-557a-40c4-919f-d61f6f7b5f2f", "value": "Gomme" }, { "description": "ransomware", "uuid": "269bae29-5955-4723-8f33-b81767f44c82", "value": "GonnaCry Ransmware" }, { "description": "ransomware", "uuid": "9325868e-bc3a-43d7-ba18-cd5d372eea06", "value": "Goofed HT" }, { "description": "ransomware", "uuid": "7b8f0dea-b63a-4b70-ae4b-2a06afd9d438", "value": "GoRansom POC" }, { "description": "ransomware", "uuid": "99cf422f-785c-4459-86a0-15f4204f17d2", "value": "Gorgon" }, { "description": "ransomware", "uuid": "a7c78489-4545-4d5f-a280-0b919ee23c3f", "value": "Gotcha" }, { "description": "ransomware", "uuid": "c694aab7-1c1c-4a36-9fa1-da8860f75ab3", "value": "GottaCry" }, { "description": "ransomware", "uuid": "11684b37-3bc6-4d74-b72e-8689f5340bc2", "value": "GPAA" }, { "description": "ransomware", "uuid": "c479cd06-3935-4673-abc2-fb2a69b04c23", "value": "GPGQwerty" }, { "description": "ransomware", "uuid": "ae7dcbb6-044a-427a-8392-7697c4e1bef7", "value": "Craftul" }, { "description": "ransomware", "uuid": "9f7c8936-96ee-4f99-a61c-8c51b4c93c9d", "value": "Greystars" }, { "description": "ransomware", "uuid": "e7c56607-ad06-4b6c-881d-5076e083d5d4", "value": "GrodexCrypt" }, { "description": "ransomware", "uuid": "b7025c7b-e650-4e8e-83b8-1311bd684b65", "value": "GrujaRSorium" }, { "description": "ransomware", "uuid": "d980b021-485e-4515-a629-11a42a67b36c", "value": "Gruxer" }, { "description": "ransomware", "uuid": "b0d5f511-7542-46e5-b95a-53c2c56a2683", "value": "GusCrypter" }, { "description": "ransomware", "uuid": "e9269244-a119-4c0a-92fd-a3b3617670d8", "value": "GX40" }, { "description": "ransomware", "uuid": "9cfe0adf-72e8-44c8-bdce-4c2c2a7749bf", "value": "H34rtBl33d" }, { "description": "ransomware", "uuid": "1d689032-cca4-4c40-86db-1eabd2a7cd29", "value": "HackdoorCrypt3r" }, { "description": "ransomware", "meta": { "date": "December 2020", "links": [ "http://ixltdyumdlthrtgx.onion" ], "refs": [ "http://www.secureworks.com/research/threat-profiles/gold-winter", "https://assets.sentinelone.com/sentinellabs/sentinellabs_EvilCorp", "https://awakesecurity.com/blog/incident-response-hades-ransomware-gang-or-hafnium/", "https://blog.truesec.com/2021/05/05/are-the-notorious-cyber-criminals-evil-corp-actually-russian-spies/", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://killingthebear.jorgetesta.tech/actors/evil-corp", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://twitter.com/inversecos/status/1381477874046169089?s=20", "https://www.accenture.com/us-en/blogs/cyber-defense/unknown-threat-group-using-hades-ransomware", "https://www.accenture.com/us-en/blogs/security/ransomware-hades", "https://www.advanced-intel.com/post/adversarial-perspective-advintel-breach-avoidance-through-monitoring-initial-vulnerabilities", "https://www.bleepingcomputer.com/news/security/evil-corp-switches-to-hades-ransomware-to-evade-sanctions/", "https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/", "https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox", "https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions", "https://www.secureworks.com/blog/hades-ransomware-operators-use-distinctive-tactics-and-infrastructure", "https://www.sentinelone.com/wp-content/uploads/2022/02/S1_-SentinelLabs_SanctionsBeDamned_final_02.pdf", "https://www.ransomlook.io/group/hades" ] }, "related": [ { "dest-uuid": "31945e7b-a734-4333-9ea2-e52051ca015a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "c0091a62-b1cd-495d-898b-d2f3b5af601e", "value": "Hades" }, { "description": "ransomware", "uuid": "49e5c755-510d-4eca-a45d-8561a53f6bfa", "value": "Hakbit" }, { "description": "ransomware", "uuid": "a5c17b66-ee15-4a08-9eb6-348bb6adeb33", "value": "HappyCrypter" }, { "description": "ransomware", "uuid": "8d551d9e-f14c-473e-a896-7cee4fc09e82", "value": "Haze" }, { "description": "ransomware", "uuid": "e9863c6d-d081-4f8b-bffd-de2004f93897", "value": "HCrypto" }, { "description": "ransomware", "uuid": "3347541a-772d-4b83-a7fd-b9a98569eb8e", "value": "HELP@AUSI" }, { "description": "ransomware", "uuid": "526166b7-59a5-4946-9d50-d95788e4d28f", "value": "HelpDCFile" }, { "description": "ransomware", "uuid": "5ad18348-acb0-430c-8439-ea2b7c6438e6", "value": "HelpMe" }, { "description": "ransomware", "uuid": "718b274e-b547-42dc-ada4-b47e213cd625", "value": "Hermes837" }, { "description": "ransomware", "uuid": "2b2379e5-098e-4c62-be82-79ee4e3cc61c", "value": "HermesVirus HT" }, { "description": "ransomware", "uuid": "c7e0650f-efbe-4c2e-bef7-ff824fb5a152", "value": "Heropoint" }, { "description": "ransomware", "uuid": "7c2a199e-1ed6-4820-a3e2-80c45ff6f709", "value": "HiddenBeer" }, { "description": "ransomware", "uuid": "38b8fb07-8545-4f79-8094-fed524e263c4", "value": "Honor" }, { "description": "ransomware", "uuid": "bdd46a71-888d-4091-b55e-2fb9ff11a770", "value": "Horros" }, { "description": "ransomware", "related": [ { "dest-uuid": "2019d150-6073-4e3f-b6a5-64b919a87ce9", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "2e4f26d6-f220-4877-be0e-45059b0f8eeb", "value": "Hydra" }, { "description": "ransomware", "uuid": "496e3fb8-666c-4dd0-a06f-af1358320f6e", "value": "IGotYou" }, { "description": "ransomware", "uuid": "17e7cef2-74fb-4abc-9d83-a65a50654381", "value": "iGZa4C" }, { "description": "ransomware", "uuid": "f7947cfd-dfac-437d-bc9d-3b71470d222a", "value": "ILElection2020" }, { "description": "ransomware", "uuid": "03429647-cc47-49ee-b336-4fa866abf510", "value": "Ims00ry" }, { "description": "ransomware", "uuid": "9c8eadbf-c1d0-4726-85ac-3d595efadf9d", "value": "ImSorry" }, { "description": "ransomware", "uuid": "719a97ab-4324-433f-aee0-f42712feb00b", "value": "Incanto" }, { "description": "ransomware", "uuid": "ddb76772-bfc9-4896-92ee-b7baf6f1a07e", "value": "Indrik" }, { "description": "ransomware", "uuid": "de63a115-7a2b-4b0a-8898-8f3fa6768414", "value": "InducVirus" }, { "description": "ransomware", "uuid": "40215dc5-5d28-4770-a85f-b6a71f1db5d9", "value": "InfinityLock" }, { "description": "ransomware", "uuid": "5ec2d8cd-090d-4184-b865-53d71cbbc235", "value": "InfoDot" }, { "description": "ransomware", "uuid": "6a4ac521-4731-4bc1-abf4-639b451018bc", "value": "INPIVX" }, { "description": "ransomware", "uuid": "2a1ab564-52e1-4575-8184-20b68c1f23c6", "value": "InsaneCrypt" }, { "description": "ransomware", "uuid": "82f52546-ed68-468d-96a1-d7064478d0de", "value": "IPA" }, { "description": "ransomware", "uuid": "54c9604e-ba28-4fa7-9a39-125fe0fbf0cb", "value": "IT.Books" }, { "description": "ransomware", "uuid": "159953eb-01f1-4325-9467-54a4c7bdeebb", "value": "J-" }, { "description": "ransomware", "uuid": "7770c955-5d04-42c2-8421-3a38c7bebf90", "value": "JabaCrypter" }, { "description": "ransomware", "uuid": "d712d488-e189-4fc1-82ce-ef6bb0ecad4e", "value": "Jaffe" }, { "description": "ransomware", "uuid": "72e2f10d-9c6a-407d-9e7d-f76c1c8248f2", "value": "James" }, { "description": "ransomware", "uuid": "5b8990a3-0e8c-4b81-8d3c-cc8e6b5024eb", "value": "Java NotDharma" }, { "description": "ransomware", "uuid": "f1486237-a5da-48aa-8681-45b389ef2fa2", "value": "jCandy" }, { "description": "ransomware", "uuid": "d2f5c189-5707-4bec-88d9-0d0bd864cfae", "value": "JeepersCrypt" }, { "description": "ransomware", "uuid": "cd334e6e-893b-4dc1-beeb-484f542d0d50", "value": "Jemd" }, { "description": "ransomware", "uuid": "07b4eda8-d346-4218-8c4d-a553ae4f684a", "value": "JesusCrypt" }, { "description": "ransomware", "uuid": "93b502df-b300-4ea6-af49-85901d9bfc6d", "value": "JNEC.a" }, { "description": "ransomware", "uuid": "4bbe43a3-ca75-4f93-973b-2179770ad606", "value": "JoeGo" }, { "description": "ransomware", "uuid": "2e8763e0-5584-4f9a-ac60-d111a30a887c", "value": "Jolly Roger" }, { "description": "ransomware", "uuid": "2e63db1d-5ce9-4cb4-a75a-86afd2d450ec", "value": "JosepCrypt" }, { "description": "ransomware", "uuid": "41ae4021-d6a6-4f19-9414-ff4d78ae2f21", "value": "Juwon" }, { "description": "ransomware", "uuid": "b484ef6b-ac11-4fe2-a87c-5731c280b4aa", "value": "Kali" }, { "description": "ransomware", "uuid": "6352d423-003a-4545-91d6-bb66425a3edd", "value": "Kamil" }, { "description": "ransomware", "uuid": "8f8e32fe-05a1-4125-a287-27ff372b9f56", "value": "Kampret" }, { "description": "ransomware", "uuid": "e04a4847-38df-4f14-8b16-6b6da7d5e222", "value": "Karo" }, { "description": "ransomware", "uuid": "739c4582-7471-43f3-aa21-3c181fe6713c", "value": "Katafrank" }, { "description": "ransomware", "uuid": "3744333c-49b7-45cb-9059-6933725fa725", "value": "Katyusha" }, { "description": "ransomware", "uuid": "b17ec2bc-bcc7-4f75-9338-ee7ec64a7a49", "value": "KCTF Locker" }, { "description": "ransomware", "uuid": "47e97378-20da-40d4-b6bc-99dd2aba84d2", "value": "KCW" }, { "description": "ransomware", "uuid": "a307a755-a243-4b00-b1ef-11b08049ca29", "value": "Kee" }, { "description": "ransomware", "uuid": "ccb50fe4-dbcf-4773-933b-0cd27b08e81b", "value": "KEKW" }, { "description": "ransomware", "uuid": "389ad313-aceb-4ee1-8554-8aec78a2f7b6", "value": "Kerkoporta" }, { "description": "ransomware", "uuid": "55cebdaf-adfb-4943-b169-4652af84e0da", "value": "KeyMaker" }, { "description": "ransomware", "uuid": "fc59e09e-49a2-4751-a3c8-0def51fbbd61", "value": "KillBot_Virus" }, { "description": "ransomware", "uuid": "d6d91cbd-4ad9-4cf4-b5fa-a468da62b421", "value": "KillDisk-Dimens" }, { "description": "ransomware", "uuid": "01dc9bbb-b888-4aa5-b6a2-d216eaa95f84", "value": "KillRabbit" }, { "description": "ransomware", "uuid": "f4d370e2-7d91-4bd0-9b1f-33160d4b989f", "value": "KillSwitch" }, { "description": "ransomware", "uuid": "74a66fc7-bd18-4f43-a9c1-c22cfe98d101", "value": "Kindest" }, { "description": "ransomware", "uuid": "7a502648-9097-41ae-a686-8f9365923daa", "value": "KKK" }, { "description": "ransomware", "uuid": "c099771d-82dd-45b6-9a1b-e5590eac897a", "value": "Kovter" }, { "description": "ransomware", "uuid": "6ba8bc69-bd70-4672-a167-123bfb260ecb", "value": "Kriptovor" }, { "description": "ransomware", "uuid": "d93b5179-d747-4845-b4cd-61b9566aa823", "value": "Krypte" }, { "description": "ransomware", "uuid": "822b3254-d715-46bc-8011-c5b647d314dc", "value": "Krypton" }, { "description": "ransomware", "uuid": "377a0893-a5f0-4b78-a410-ef814083ae27", "value": "Kryptonite RBY" }, { "description": "ransomware", "uuid": "4a3ce744-3468-4ddf-95f9-7095bdd0d65e", "value": "Kryptonite Snake" }, { "description": "ransomware", "uuid": "de0bf4df-c578-41f1-b7db-20a1ae481844", "value": "Kupidon" }, { "description": "ransomware", "uuid": "a613ff2c-d23c-468b-b53f-c140be5d6457", "value": "Ladon" }, { "description": "ransomware", "uuid": "a4a865b8-9b7c-4ec4-b448-ad8b1524f928", "value": "Lalabitch_ransomware" }, { "description": "ransomware", "uuid": "a026f575-384f-4a5a-b76d-7baa223661b2", "value": "LazagneCrypt" }, { "description": "ransomware", "uuid": "a7c9904b-758f-4107-bffb-12d190e08687", "value": "Light" }, { "description": "ransomware", "uuid": "cfbc0527-0301-49f5-a38b-d9d2d73c4256", "value": "LightningCrypt" }, { "description": "ransomware", "uuid": "2d3d3c5e-fc6b-4afb-a81b-9b0de8e78446", "value": "LIGMA" }, { "description": "ransomware", "uuid": "dd518ffc-8f62-44f0-9eba-b565137ee4c2", "value": "Lime" }, { "description": "ransomware", "uuid": "c96c1d9c-9f7d-47ac-9849-6a9e4c049f55", "value": "Litra" }, { "description": "ransomware", "uuid": "0ea3f9fd-9f2a-4491-9492-e655344fd5ec", "value": "LittleFinger" }, { "description": "ransomware", "uuid": "f3dfd38d-9795-4c2f-92f8-683f252c7935", "value": "LMAOxUS" }, { "description": "ransomware", "uuid": "eed8bf9a-cbb6-4096-9511-7a3cf47d10c4", "value": "LockBox" }, { "description": "ransomware", "uuid": "07b6bb3b-e738-466e-9267-78587c3dea6b", "value": "Locked_File" }, { "description": "ransomware", "uuid": "3a29a37a-528a-4fd5-b6c8-a5be64c88c15", "value": "LockedByte" }, { "description": "ransomware", "uuid": "d62a826b-9d74-4e04-8e12-9cb918c0ee80", "value": "Locker-Pay" }, { "description": "ransomware", "uuid": "8622375e-47c3-4542-be21-cc76969cdaa1", "value": "Lockify" }, { "description": "ransomware", "uuid": "c493f2e3-7fdc-41f5-8450-1e01dd92c339", "value": "LockMe" }, { "description": "ransomware", "uuid": "229959ff-de0f-46d5-9ded-5026944adc13", "value": "LockOn" }, { "description": "ransomware", "uuid": "70fa1062-fdb1-424b-b29e-c4497c4f9df4", "value": "Lockout" }, { "description": "ransomware", "uuid": "23ccf1d7-4f68-4c95-a8a4-eeff5720be63", "value": "LongTermMemoryLoss" }, { "description": "ransomware", "uuid": "1609a28b-9da4-419f-8df9-0589d842f231", "value": "LonleyCrypt" }, { "description": "ransomware", "uuid": "706d91b7-990b-486f-bf6b-33ffdc704039", "value": "LooCipher" }, { "description": "ransomware", "uuid": "de60a270-8ed2-4b39-b90c-ebbd7821962d", "value": "LordOfShadow" }, { "description": "ransomware", "uuid": "98c9333d-9c94-436d-9f37-3ba4354cad32", "value": "Losers" }, { "description": "ransomware", "uuid": "29a65541-4638-4acc-9627-f5cfd5d719d0", "value": "Losers-Dangerous" }, { "description": "ransomware", "uuid": "2c5d28fa-1ca9-45ff-9ea6-943a1fd375af", "value": "Lost_Files" }, { "description": "ransomware", "uuid": "92312287-ab2b-4246-a46b-c9b41714571b", "value": "LuckyJoe" }, { "description": "ransomware", "uuid": "0e372055-134e-4360-b62e-ad65ee20a2c4", "value": "Luxnut" }, { "description": "ransomware", "uuid": "d44c76ea-ab96-4f95-aa51-471c779de3d1", "value": "Madafakah" }, { "description": "ransomware", "uuid": "27e23341-bbcd-4eae-992e-f0a0c87e3b40", "value": "MadBit" }, { "description": "ransomware", "uuid": "7fe890f7-db7f-4cef-ad9f-9e44d445ef8a", "value": "Magician" }, { "description": "ransomware", "uuid": "8ee63c4b-eb0d-47f1-b867-41afb64a5686", "value": "Malabu" }, { "description": "ransomware", "uuid": "bd2800dc-62b8-4e77-bde5-1a1b0c4d2502", "value": "MalwareTech's CTF" }, { "description": "ransomware", "uuid": "c430f580-6ba9-44fa-a8c5-9ccfff339940", "value": "Mancros+AI4939" }, { "description": "ransomware", "uuid": "e1b124d6-6a92-4d0a-a116-ae8f448e5dc3", "value": "Maoloa" }, { "description": "ransomware", "uuid": "cf316be5-f76f-4c9a-8cc1-52214bb18896", "value": "Marozka" }, { "description": "ransomware", "uuid": "3121238f-0982-4a10-92fc-047fbd658784", "value": "MarraCrypt" }, { "description": "ransomware", "uuid": "20f3f441-7285-4b83-a2a1-fad2d23b1048", "value": "Matroska" }, { "description": "ransomware", "uuid": "9b9f3cc7-7cb8-4431-8187-d7494703d618", "value": "MauriGo" }, { "description": "ransomware", "uuid": "b219c747-81da-45c5-88a6-50a1a4642ba0", "value": "MaxiCrypt" }, { "description": "ransomware", "uuid": "d5c3b64f-c9b4-4f48-9391-6f0d5ac8f5e4", "value": "Maykolin" }, { "description": "ransomware", "uuid": "82b3dd0f-eb99-4866-aaa2-af4f4182d612", "value": "Maysomware" }, { "description": "ransomware", "uuid": "2a803db3-8962-4d2f-8397-e3301b57cef7", "value": "MBR-ONI" }, { "description": "Observed as recently as May 2022, MedusaLocker actors predominantly rely on vulnerabilities in Remote Desktop Protocol (RDP) to access victims’ networks. The MedusaLocker actors encrypt the victim's data and leave a ransom note with communication instructions in every folder containing an encrypted file. The note directs victims to provide ransomware payments to a specific Bitcoin wallet address. MedusaLocker appears to operate as a Ransomware-as-a-Service (RaaS) model based on the observed split of ransom payments. Typical RaaS models involve the ransomware developer and various affiliates that deploy the ransomware on victim systems. MedusaLocker ransomware payments appear to be consistently split between the affiliate, who receives 55 to 60 percent of the ransom; and the developer, who receives the remainder.", "meta": { "extensions": [ ".1btc", ".matlock20", ".marlock02", ".readinstructions", ".bec", ".mylock", ".jpz.nz", ".marlock11", ".cn", ".NET1", ".key1", ".fileslocked", ".datalock", ".NZ", ".lock", ".lockfilesUS", ".deadfilesgr", ".tyco", ".lockdata7", ".rs", ".faratak", ".uslockhh", ".lockfiles", ".fileslock", ".zoomzoom", ".perfection", ".marlock13", "n.exe", ".Readinstruction", ".marlock08", ".marlock25", "nt_lock20", ".READINSTRUCTION", ".marlock6", ".marlock01", ".ReadInstructions" ], "links": [ "https://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion", "http://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion/", "http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion" ], "ransomnotes-filenames": [ "how_to_ recover_data.html", "how_to_recover_data.html.marlock01", "instructions.html", "READINSTRUCTION.html", "!!!HOW_TO_DECRYPT!!!", "How_to_recovery.txt", "readinstructions.html", "readme_to_recover_files", "recovery_instructions.html", "HOW_TO_RECOVER_DATA.html", "recovery_instruction.html" ], "refs": [ "https://www.cisa.gov/uscert/ncas/alerts/aa22-181a", "https://www.cisa.gov/uscert/sites/default/files/publications/AA22-181A_stopransomware_medusalocker.pdf" ] }, "uuid": "627d603a-906f-4fbf-b922-f03eea4578fe", "value": "MedusaLocker" }, { "description": "ransomware", "uuid": "6a985c3b-8ad9-4005-b363-854f6f6f4dcd", "value": "Meduza" }, { "description": "ransomware", "uuid": "60ec39c9-25d2-4d04-ad2e-4f9293159e84", "value": "MegaLocker" }, { "description": "ransomware", "uuid": "1d274b68-a9c9-4418-a430-df9e4f0d4f4a", "value": "Mew767" }, { "description": "ransomware", "uuid": "08e17d21-6f58-4eef-aee5-0dd842ca6eee", "value": "Mike NotSTOP" }, { "description": "ransomware", "uuid": "dce3f8d4-9381-4b91-8cf5-e33e55a1e199", "value": "Mikoyan" }, { "description": "ransomware", "uuid": "ae96d561-5f2e-43ce-9b82-7a81e825758a", "value": "MindLost" }, { "description": "ransomware", "uuid": "8051a21d-8967-4674-a6c3-dc794df43fe0", "value": "MindSystem" }, { "description": "ransomware", "uuid": "804c576e-8679-47ff-9550-0c1abe896e46", "value": "Mini" }, { "description": "ransomware", "uuid": "63f2149a-c736-4a7d-86f9-0993cb568630", "value": "Minotaur" }, { "description": "ransomware", "uuid": "6c01d999-123f-4301-939d-a65bbcf00d90", "value": "MMM" }, { "description": "ransomware", "uuid": "c4461bdf-560d-4f89-a5cb-f0960a720687", "value": "MNS CryptoLocker" }, { "description": "ransomware", "uuid": "98c9ebce-d11c-41b7-9923-4e94dca22fb0", "value": "MoneroPay" }, { "description": "ransomware", "uuid": "4f579928-8f50-459c-8878-df1c75437c38", "value": "MongoLock" }, { "description": "ransomware", "uuid": "8e103d80-1e53-42b0-a21a-5a2bcefa7d3f", "value": "MoonCryptor" }, { "description": "ransomware", "uuid": "b14d39e1-36ea-45a9-8609-95ac7ffce3cd", "value": "Mordor" }, { "description": "ransomware", "uuid": "21181132-affd-464e-81cd-35ef575fc56d", "value": "MorrisBatchCrypt" }, { "description": "ransomware", "uuid": "eecce3be-ba24-4cf4-b9cf-8780533dc487", "value": "Moth" }, { "description": "ransomware", "uuid": "a319539b-ccd0-4278-83fa-9419331bb1f2", "value": "MoWare H.F.D" }, { "description": "ransomware", "uuid": "c21111d1-fc51-437a-9c73-1b89922bea95", "value": "Mr.Locker" }, { "description": "ransomware", "uuid": "7221c504-c3a3-4020-9490-01e569aeddcb", "value": "Mr403Forbidden" }, { "description": "ransomware", "uuid": "754ea5a6-6d56-482c-bb0a-c6618fca4390", "value": "MuchLove" }, { "description": "ransomware", "uuid": "7f8d5860-35db-4f23-a174-514a0066e573", "value": "Muhstik" }, { "description": "ransomware", "uuid": "0a68c300-6ce0-4664-9956-3abafb3e526e", "value": "Mystic" }, { "description": "ransomware", "uuid": "6aa66f32-54f7-46b7-bb5b-9e953bf97ced", "value": "MZP" }, { "description": "ransomware", "uuid": "eeb3c94c-1424-49a9-831b-36bbd9e81a1d", "value": "N2019cov" }, { "description": "ransomware", "uuid": "c06b039c-7a68-4f35-9948-87934f287ddd", "value": "Naampa" }, { "description": "ransomware", "uuid": "2fe2b576-9673-46b2-b558-811c26db3f6b", "value": "NazCrypt" }, { "description": "According to Vitali Kremez and Michael Gillespie, this ransomware shares much code with Nemty 2.5. A difference is removal of the RaaS component, which was switched to email communications for payments. Uses AES-128, which is then protected RSA2048.", "meta": { "links": [ "http://hxt254aygrsziejn.onion" ], "refs": [ "https://www.zdnet.com/article/a-deep-dive-into-nefilim-a-double-extortion-ransomware-group", "https://www.trendmicro.com/en_nz/research/21/f/nefilim-modern-ransomware-attack-story.html", "http://www.secureworks.com/research/threat-profiles/gold-mansard", "https://blog.qualys.com/vulnerabilities-research/2021/05/12/nefilim-ransomware", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://documents.trendmicro.com/assets/white_papers/wp-modern-ransomwares-double-extortion-tactics.pdf", "https://id-ransomware.blogspot.com/2020/03/nefilim-ransomware.html", "https://intel471.com/blog/how-cybercriminals-create-turbulence-for-the-transportation-industry", "https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/", "https://labs.sentinelone.com/meet-nemty-successor-nefilim-nephilim-ransomware/", "https://news.sophos.com/en-us/2021/01/26/nefilim-ransomware-attack-uses-ghost-credentials/", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://securelist.com/evolution-of-jsworm-ransomware/102428/", "https://us-cert.cisa.gov/ncas/alerts/aa20-345a", "https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/", "https://www.accenture.com/us-en/blogs/cyber-defense/evolving-danger-ransomware-extortion", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/wp-spark-state-of-ransomware.pdf", "https://www.bleepingcomputer.com/news/security/home-appliance-giant-whirlpool-hit-in-nefilim-ransomware-attack/", "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/", "https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/", "https://www.cert.govt.nz/it-specialists/advisories/active-ransomware-campaign-leveraging-remote-access-technologies/", "https://www.fireeye.com/blog/threat-research/2020/07/financially-motivated-actors-are-expanding-access-into-ot.html", "https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/", "https://www.intezer.com/wp-content/uploads/2021/02/Intezer-2020-Go-Malware-Round-Up.pdf", "https://www.mandiant.com/resources/financially-motivated-actors-are-expanding-access-into-ot", "https://www.picussecurity.com/resource/blog/how-to-beat-nefilim-ransomware-attacks", "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf", "https://www.trendmicro.com/en_us/research/21/b/nefilim-ransomware.html", "https://www.trendmicro.com/en_us/research/21/f/nefilim-modern-ransomware-attack-story.html", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/nefilim-ransomware-threatens-to-expose-stolen-data", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks", "https://www.ransomlook.io/group/nefilim" ] }, "related": [ { "dest-uuid": "5fb75933-1ed5-4512-a062-d39865eedab0", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "related-to" } ], "uuid": "d12f369c-f776-468a-8abf-8000b1b30642", "value": "Nefilim" }, { "description": "ransomware", "uuid": "38fbf2d7-10a2-4cb2-9d50-cb2434a55c10", "value": "Negozl" }, { "description": "ransomware", "uuid": "686d157c-6c30-4ffb-b192-ca99d90770da", "value": "Neitrino" }, { "description": "ransomware", "uuid": "78c192ac-7fb6-4c85-8e20-9f86f4633873", "value": "NewWave" }, { "description": "ransomware", "uuid": "d6899ce2-7d67-4730-9a32-4721051d33f9", "value": "NextCry" }, { "description": "ransomware", "uuid": "e361e083-de14-4ffd-80b9-f071096ab973", "value": "Nightmare" }, { "description": "ransomware", "uuid": "d79ab668-4720-4875-8959-436c7fd81022", "value": "NinjaLoc" }, { "description": "ransomware", "uuid": "ab9ece36-6218-4467-929f-d07192a98b6a", "value": "NM4" }, { "description": "ransomware", "uuid": "fd447eea-9e79-4143-8e7d-246b022c7950", "value": "Noblis" }, { "description": "ransomware", "uuid": "6db73f66-912d-43f7-ae21-7988aed2ea22", "value": "Nog4yH4n" }, { "description": "ransomware", "uuid": "2a0b033f-c14c-42ec-9f10-57dc2de3639e", "value": "Nomikon" }, { "description": "ransomware", "uuid": "bf54e9f3-81af-43f7-b378-0109c4adc489", "value": "NotAHero" }, { "description": "ransomware", "uuid": "6fc911ca-2f9c-428e-8986-aff706edee92", "value": "Nozelesn" }, { "description": "ransomware", "uuid": "619ccdda-2f40-48fe-9492-dd12c70a4029", "value": "Nulltica" }, { "description": "ransomware", "uuid": "8f869515-4c4e-4cd0-8b15-9dc3f9a43902", "value": "Nx / OSR" }, { "description": "ransomware", "uuid": "e8bc21bf-ddfa-4245-89b4-19cfb430eb7d", "value": "Nyton" }, { "description": "ransomware", "uuid": "641b511e-c974-4584-b8ab-08c1296ac73b", "value": "NZMR" }, { "description": "ransomware", "uuid": "9686665e-b862-4399-84b9-407714df1677", "value": "Ogre" }, { "description": "ransomware", "uuid": "c1470d12-fd35-497e-b1cf-0484e755b7a2", "value": "OhNo!" }, { "description": "ransomware", "uuid": "652d3fdd-a641-4553-8695-69e0ef74bd1c", "value": "Oled" }, { "description": "ransomware", "uuid": "9162c2e1-6936-4c13-a8c3-c10eab321bd5", "value": "OmniSphere" }, { "description": "ransomware", "uuid": "47273227-8079-46e6-9b89-3abdd39c017f", "value": "One" }, { "description": "ransomware", "uuid": "3358ae46-afcd-4685-81b6-75970f502660", "value": "ONI" }, { "description": "ransomware", "uuid": "d056b6f3-4cb0-41a8-a0f5-4fec33871697", "value": "OoPS Ramenware" }, { "description": "ransomware", "uuid": "3c2ce8a5-e060-4466-847a-3c2db9282bd6", "value": "OopsLocker" }, { "description": "ransomware", "uuid": "88b486e5-ccb2-4f67-8967-f841fb28ea76", "value": "OPdailyallowance" }, { "description": "ransomware", "uuid": "1e63a74c-a975-4997-ae2c-4ac9196412e4", "value": "OpenToYou" }, { "description": "ransomware", "uuid": "c1a4ddf5-cfe6-4482-a8d4-69761eff0554", "value": "Ordinal" }, { "description": "ransomware", "uuid": "c624a4b1-b4aa-4810-b860-45545c6ecb50", "value": "Ordinypt" }, { "description": "ransomware", "uuid": "0ef81fda-237e-4d28-8bd7-f05c748eb0d8", "value": "Pacman" }, { "description": "ransomware", "uuid": "4857ec1b-7d5f-487d-a2cd-91588158fe49", "value": "PassLock" }, { "description": "ransomware", "uuid": "8acc6960-3eb9-479d-a745-7c7eddacc0f2", "value": "Pay-or-Lost" }, { "description": "ransomware", "uuid": "dc5be315-4829-448a-9359-05d5b9187756", "value": "PayForNature" }, { "description": "ransomware", "uuid": "ef63051e-a99e-43db-b81d-80ec95e74610", "value": "Paymen45" }, { "description": "ransomware", "uuid": "7a2eeb1a-6ae3-4e1c-a4f7-af4a0be2d98e", "value": "Payment" }, { "description": "ransomware", "uuid": "2a20dd7e-242e-45ac-8245-1864320ed157", "value": "PClock и PClock2" }, { "description": "ransomware", "uuid": "fc91d065-21c2-44ae-9169-241d60f1a786", "value": "PPDDDP" }, { "description": "ransomware", "uuid": "0df4ba53-b7c9-4e2a-979d-f8e3d7737aa9", "value": "PEC 2017" }, { "description": "ransomware", "uuid": "05f9a3ce-2611-40b9-b788-c8dc7233e5a7", "value": "Pendor" }, { "description": "ransomware", "uuid": "48bef862-8a8c-4eeb-b72c-a756762b52c7", "value": "Pennywise" }, { "description": "ransomware", "uuid": "512d011c-81a8-4218-866c-1497f4572caf", "value": "PewCrypt +decrypt" }, { "description": "ransomware", "uuid": "c37cf393-f299-4b02-864c-5e7e5f244d04", "value": "PewDiePie" }, { "description": "ransomware", "uuid": "bbbfe905-6236-419a-ab21-a33202597b1c", "value": "PhobosImposter" }, { "description": "ransomware", "uuid": "37a26943-99b6-40ae-984d-91e044546d1b", "value": "PhoneNumber" }, { "description": "ransomware", "uuid": "70ce8986-d1c3-4e10-8096-1ee2539f11d7", "value": "PHP" }, { "description": "ransomware", "uuid": "5822a3dc-64b3-4303-b0ba-d2e804a5015c", "value": "Pirateware" }, { "description": "ransomware", "uuid": "88c32b3b-daa1-4cec-8e05-753ee5785704", "value": "PoisonFang" }, { "description": "ransomware", "uuid": "fc3984d8-b1c6-45e7-8d36-e51532c9b7fc", "value": "PonyFinal" }, { "description": "ransomware", "uuid": "bd401c00-e690-4dae-80ac-c47aab227e5f", "value": "PooleZoor" }, { "description": "ransomware", "uuid": "d494a2e6-17e6-435f-9bcd-ef728d18f504", "value": "PopCornTime" }, { "description": "ransomware", "uuid": "3687c99c-f44e-421d-a04d-0a80d086c53a", "value": "PowerHentai" }, { "description": "ransomware", "uuid": "662bf791-0a13-48e8-9f21-07dfb328d02b", "value": "PowerLocky" }, { "description": "ransomware", "uuid": "5ed83975-a681-4061-8314-9ef76f319ef2", "value": "PowerShell Locker 2013" }, { "description": "ransomware", "uuid": "b9a6faf4-733d-44b3-889b-ec468697ba3f", "value": "PowerShell Locker 2015" }, { "description": "ransomware", "uuid": "535916a2-283b-4512-bc8b-e5d98c055fab", "value": "Pr0tector" }, { "description": "ransomware", "uuid": "d8da450f-5e17-4301-b1ba-5468aa69d17a", "value": "Predator" }, { "description": "ransomware", "uuid": "bd351d3d-3633-4aba-a35e-82cb7a00b2d5", "value": "Priapos" }, { "description": "ransomware", "uuid": "114fbac2-6d2b-46b5-bc08-ed0c94cd756e", "value": "Project23" }, { "description": "ransomware", "uuid": "084f9aec-4ebc-46a2-be97-0d1d172be044", "value": "Project57" }, { "description": "PwndLocker is a ransomware that was observed in late 2019 and is reported to have been used to target businesses and local governments/cities. According to one source, ransom amounts demanded as part of PwndLocker activity range from $175k USD to $650k USD depending on the size of the network. PwndLocker attempts to disable a variety of Windows services so that their data can be encrypted. Various processes will also be targeted, such as web browsers and software related to security, backups, and databases. Shadow copies are cleared by the ransomware, and encryption of files occurs once the system has been prepared in this way. Executable files and those that are likely to be important for the system to continue to function appear to be skipped by the ransomware, and a large number of folders mostly related to Microsoft Windows system files are also ignored. As of March 2020, encrypted files have been observed with the added extensions of .key and .pwnd. Ransom notes are dropped in folders where encrypted files are found and also on the user's desktop.", "meta": { "links": [ "http://msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion" ], "refs": [ "https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://id-ransomware.blogspot.com/2019/10/pwndlocker-ransomware.html", "https://medium.com/s2wlab/operation-synctrek-e5013df8d167", "https://news.sophos.com/en-us/2020/07/27/prolock-ransomware-gives-you-the-first-8-kilobytes-of-decryption-for-free/", "https://norfolkinfosec.com/tinypos-and-prolocker-an-odd-relationship/", "https://raw.githubusercontent.com/fboldewin/When-ransomware-hits-an-ATM-giant---The-Diebold-Nixdorf-case-dissected/main/When%20ransomware%20hits%20an%20ATM%20giant%20-%20The%20Diebold%20Nixdorf%20case%20dissected%20-%20Group-IB%20CyberCrimeCon2020.pdf", "https://soolidsnake.github.io/2020/05/11/Prolock_ransomware.html", "https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://www.bleepingcomputer.com/news/security/new-pwndlocker-ransomware-targeting-us-cities-enterprises/", "https://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/", "https://www.cert-pa.it/notizie/pwndlocker-si-rinnova-in-prolock-ransomware/", "https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-009/", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf", "https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware", "https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/", "https://www.group-ib.com/blog/prolock", "https://www.group-ib.com/blog/prolock_evolution", "https://www.hornetsecurity.com/en/security-information/qakbot-malspam-leading-to-prolock/", "https://www.hornetsecurity.com/en/threat-research/qakbot-reducing-its-on-disk-artifacts/", "https://www.intrinsec.com/egregor-prolock/", "https://www.it-klinika.rs/blog/paznja-novi-opasni-ransomware-pwndlocker-i-u-srbiji", "https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html", "https://www.zdnet.com/article/fbi-prolock-ransomware-gains-access-to-victim-networks-via-qakbot-infections/", "https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/", "https://www.ransomlook.io/group/prolock" ] }, "related": [ { "dest-uuid": "421a3805-7741-4315-82c2-6c9aa30d0953", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "dropped-by" } ], "uuid": "c4417bfb-717f-48d9-bd56-bc9e85d07c19", "value": "ProLock" }, { "description": "ransomware", "uuid": "f5390f29-d832-434d-8547-5cab7f82a93b", "value": "Prometey" }, { "description": "ransomware", "uuid": "a732a730-3fb4-4642-a4c5-25edaf0a1b9f", "value": "Protected" }, { "description": "ransomware", "uuid": "4274477b-65c7-4497-846b-c8beebc264a2", "value": "PSCrypt" }, { "description": "ransomware", "uuid": "801d7e9f-8076-4d6f-894e-c557f3b9cfeb", "value": "PshCrypt" }, { "description": "ransomware", "uuid": "7cce4912-900f-4d16-b2c5-37b9078f3d7b", "value": "PTP" }, { "description": "ransomware", "uuid": "64c5896a-141c-41fb-bc58-705f008c7b8f", "value": "Pulpy" }, { "description": "ransomware", "uuid": "119b0b4d-034e-4e58-a7a4-833f083848cd", "value": "PureLocker" }, { "description": "ransomware", "uuid": "a8b6433c-fc01-4c77-9a89-5f0f57136aaa", "value": "PwndLocker" }, { "description": "ransomware", "uuid": "bf927535-eaf2-48e4-9b38-287de9ec4a0b", "value": "PyteHole" }, { "description": "ransomware", "uuid": "ee55d30a-8735-42f4-b8e9-3610959be772", "value": "Python" }, { "description": "ransomware", "uuid": "b79b60a4-2b47-4bb1-b36e-602a03afc7cd", "value": "PZDC" }, { "description": "ransomware", "uuid": "89cc64e1-d33c-4922-84d4-0467bdeddba6", "value": "Qinynore" }, { "description": "ransomware", "uuid": "8f5b9eff-242d-4f9b-9aa6-c24f92f7f0f9", "value": "QNAPCrypt" }, { "description": "ransomware", "uuid": "9bd4c0c6-e8fe-495a-99b8-b5ea741ff8ae", "value": "QP" }, { "description": "ransomware", "uuid": "380c73bf-7734-44c4-9f46-063cbd20475f", "value": "QuakeWay" }, { "description": "ransomware", "uuid": "60f4c416-8752-4d59-8e9e-b12f16afda83", "value": "Qweuirtksd" }, { "description": "ransomware", "uuid": "2943ea4b-42e8-4e5c-9abb-d6c3e94b84ce", "value": "R3store" }, { "description": "ransomware", "uuid": "8b1f7d30-1115-4ad2-a986-fd797edf2b4d", "value": "RabbitFox" }, { "description": "ransomware", "uuid": "c07fd277-f133-4deb-84ef-2f651aa0d989", "value": "Ramsey" }, { "description": "ransomware", "uuid": "93e70c60-6bd2-4f01-a28a-1ae287349d61", "value": "RandomLocker" }, { "description": "ransomware", "uuid": "d2b23d28-c12d-422f-8558-0d79ed98d335", "value": "RanRans" }, { "description": "ransomware", "uuid": "d2d0d87f-249f-4223-82b2-71c82df6c7f2", "value": "Rans0mLocked" }, { "description": "ransomware", "uuid": "0c1b4371-9c6e-41f2-9410-e76a1094d0ca", "value": "Ransed" }, { "description": "ransomware", "uuid": "dfdc4876-bc48-4748-822a-dcce1c4058c4", "value": "Ransom102" }, { "description": "ransomware", "uuid": "493847f8-57b1-42cc-9303-6b1eb9576580", "value": "RansomAES" }, { "description": "ransomware", "uuid": "b63ed281-5357-4d20-afef-3377b70fd48b", "value": "RansomCuck" }, { "description": "ransomware", "uuid": "65844c85-ad66-46e9-bb44-f99e601179a2", "value": "RansomMine" }, { "description": "ransomware", "uuid": "1f5c7ad1-5ec5-4e0f-b7e0-c87232693a5d", "value": "Ransomnix" }, { "description": "ransomware", "uuid": "1fe7d70f-8540-4f21-8675-2fe72bacce85", "value": "Ransom Prank" }, { "description": "ransomware", "uuid": "7ec4a72d-12d3-46bb-a796-0296db298935", "value": "RansomUserLocker" }, { "description": "ransomware", "uuid": "8af10e62-84e7-45c5-ae10-db1106cec43a", "value": "RansomWarrior" }, { "description": "ransomware", "uuid": "9fd0b741-44fb-42fe-bf3d-b36b807878fe", "value": "Rapid" }, { "description": "ransomware", "uuid": "8a7c32fd-9851-40c3-9fd9-a889a015db5e", "value": "Rapid 2.0" }, { "description": "ransomware", "uuid": "07ef8e30-7bcd-4f14-af50-a113fdf60774", "value": "Rapid 3.0" }, { "description": "ransomware", "uuid": "84160999-eebb-4f76-8253-9e09d447f472", "value": "Rapid-Gillette" }, { "description": "ransomware", "uuid": "8cd93feb-4bf0-4d97-b5a2-061198652f1a", "value": "Ra" }, { "description": "ransomware", "uuid": "a9d76a58-0ab3-4942-b364-27f89a1915eb", "value": "RaRuCrypt" }, { "description": "ransomware", "uuid": "81e4038a-5e4d-4df1-90b7-c4aef735d757", "value": "RedBoot" }, { "description": "ransomware", "uuid": "c26438bb-5aa3-4de4-a749-329d2560a350", "value": "Redkeeper" }, { "description": "ransomware", "uuid": "4b2746c5-77f3-4f46-90de-4a0816dcd621", "value": "RedFox" }, { "description": "ransomware", "uuid": "56351998-4871-4b7c-9c4c-201aa2ef7eaa", "value": "RedRum" }, { "description": "ransomware", "uuid": "7c23a477-ea87-48d9-8c7e-d9333c28e984", "value": "Redshot" }, { "description": "ransomware", "uuid": "570ba51b-3ce7-4f5b-88a9-98b9f22f8397", "value": "Reetner" }, { "description": "ransomware", "uuid": "ca306262-b8e9-46a1-abcd-db5df38b47d5", "value": "RekenSom" }, { "description": "ransomware", "uuid": "f5d20d2c-2624-4a0a-a136-36457d65360b", "value": "Relock" }, { "description": "ransomware", "uuid": "a27e94d4-9fcb-4729-926c-b507cad09674", "value": "RensenWare" }, { "description": "ransomware", "uuid": "53386169-9045-4636-b4e9-fd9405663d71", "value": "Rentyr" }, { "description": "ransomware", "uuid": "11367b8d-0627-4774-894a-032fde021979", "value": "RestoLocker" }, { "description": "ransomware", "uuid": "f881e6a3-2298-4e82-9d0a-75ceddf0e822", "value": "Resurrection" }, { "description": "ransomware", "uuid": "19274b88-c0dc-4e91-957b-93d4a992329b", "value": "Retis" }, { "description": "ransomware", "uuid": "af2011f8-b076-43cf-afb7-a348a7b00b9a", "value": "RetMyData" }, { "description": "ransomware", "uuid": "7f750865-50aa-40cb-9614-d7d1c357999b", "value": "Revolution" }, { "description": "ransomware", "uuid": "8cf3f181-c136-4f09-82ea-f8c5e6ca4b64", "value": "Reyptson" }, { "description": "ransomware", "uuid": "39e600c4-2c5b-4798-8a0e-0fa530c2bd0a", "value": "Rhino" }, { "description": "ransomware", "uuid": "8c18e32f-0b02-4551-b53b-2ac25baaccaa", "value": "Rijndael" }, { "description": "ransomware", "uuid": "34bdd9f9-94e6-4805-b6b5-27632686070f", "value": "Rogue HT" }, { "description": "ransomware", "uuid": "64c573b7-80d1-42d0-9fac-dab07f5df00f", "value": "Rontok" }, { "description": "ransomware", "uuid": "0283d153-30f5-4be0-9ab7-8eee91fccd63", "value": "Rozlok" }, { "description": "ransomware", "uuid": "84a5bfc2-44dc-4ddf-95d7-387ff16c7415", "value": "RSA-NI" }, { "description": "ransomware", "uuid": "ce28af26-b03e-45ca-8e6d-20fbb36233db", "value": "RSA2048Pro" }, { "description": "ransomware", "uuid": "224966b2-8d6a-4602-8d7d-67e7c8b2068f", "value": "Ruby" }, { "description": "ransomware", "uuid": "b48f7bab-c2ba-4f80-9547-4f2bfef38959", "value": "Rush" }, { "description": "ransomware", "uuid": "15d0121a-aac9-41cb-a140-69c3eb739d4a", "value": "Russenger" }, { "description": "ransomware", "uuid": "100741e9-1803-4be7-98a8-6e5eeb01a50d", "value": "Russian EDA2" }, { "description": "ransomware", "uuid": "6c7c182b-2a7a-43be-91d8-2bc34d9273c1", "value": "SAD" }, { "description": "ransomware", "uuid": "fb94c242-0b03-4338-8c5a-7e4357e5a69c", "value": "SadComputer" }, { "description": "ransomware", "uuid": "a5aa9c7d-10f7-4091-9c9a-e02acdbe5ca6", "value": "Sadogo" }, { "description": "ransomware", "uuid": "dd020ef8-0f84-4403-8e2a-09728582467f", "value": "Salsa" }, { "description": "ransomware", "uuid": "2869ae30-4106-4080-a63b-be29caecf5b7", "value": "Santa Encryptor" }, { "description": "ransomware", "uuid": "3f8ec946-b80d-45b6-ae82-bffbb0bb05d7", "value": "Saramat" }, { "description": "ransomware", "uuid": "43690415-9a4f-4019-a02e-26ec3dd2961c", "value": "SARansom" }, { "description": "ransomware", "uuid": "120b33e8-75e2-45bd-b7ba-6726ed2a4ad7", "value": "Satan Cryptor 2.0" }, { "description": "ransomware", "uuid": "aefd8f3f-20c2-4b08-bd00-99c1e67152c4", "value": "Satan's Doom Crypter" }, { "description": "ransomware", "uuid": "d7a08ff9-af25-45e5-9fb7-c54defd6f62c", "value": "SatanCryptor Go" }, { "description": "ransomware", "uuid": "90db5ee9-f2de-47aa-a923-2862800b473b", "value": "Saturn" }, { "description": "ransomware", "uuid": "3f2ed9f6-384b-4846-97d0-8dec61b9f03a", "value": "Satyr" }, { "description": "ransomware", "uuid": "4790fcdd-deab-4a9d-a8b6-dc413dee4ff8", "value": "SaveTheQueen" }, { "description": "ransomware", "uuid": "f9884cee-1105-4f39-9e42-dda43841fd56", "value": "ScammerLocker HT" }, { "description": "ransomware", "uuid": "9d1e1894-28d6-412b-8014-ac6c92657bc9", "value": "ScammerLocker Ph" }, { "description": "ransomware", "uuid": "eaea10da-947e-42f9-99c9-6a576fda3bdc", "value": "Schwerer" }, { "description": "ransomware", "uuid": "4b6bea32-12bd-4ede-8912-f9037be3b454", "value": "ScorpionLocker" }, { "description": "ransomware", "uuid": "23a6b580-6df0-4193-a66f-721bacbe60fc", "value": "Scrabber" }, { "description": "ransomware", "uuid": "f13796ff-a16c-4cd0-b4e1-9f4593c90d2e", "value": "Scroboscope" }, { "description": "ransomware", "uuid": "1b14e605-c8ce-4281-b09f-3c2478afc4f4", "value": "SecretSystem" }, { "description": "ransomware", "uuid": "e0e111d1-8499-427d-aa37-41f1e52da79d", "value": "SecureCryptor" }, { "description": "ransomware", "uuid": "5142f162-d123-4eca-a428-86033d9d60e0", "value": "SeginChile" }, { "description": "ransomware", "uuid": "7e9924c3-f166-40be-b1c5-85011b77a7f2", "value": "SEND.ID.TO" }, { "description": "ransomware", "uuid": "db6208a6-16a6-49fa-9259-ccd7626719f9", "value": "Seon" }, { "description": "ransomware", "uuid": "de8ddc1c-3e86-46e9-abc5-4409257dd174", "value": "Sepsis" }, { "description": "ransomware", "uuid": "75b0d6cd-477c-415b-bf3a-fd8181ea6747", "value": "SepSys" }, { "description": "ransomware", "uuid": "8e0a2826-279a-4d7f-901f-223b65d556e2", "value": "Shadi" }, { "description": "ransomware", "uuid": "a6a80481-0c0b-470d-bdc4-a35f75c6ec2e", "value": "ShadowCryptor" }, { "description": "ransomware", "uuid": "14162500-23ce-47e5-8375-664516f2bf3c", "value": "ShinigamiLocker" }, { "description": "ransomware", "uuid": "a7b363ef-7dd6-4df4-81c0-299670c11240", "value": "ShkolotaCrypt" }, { "description": "ransomware", "uuid": "0e492b45-03c8-4f87-9038-4d37c7203b18", "value": "Shrug" }, { "description": "ransomware", "uuid": "95b099a1-6549-4bf7-a895-3c06259ea000", "value": "Shutdown57" }, { "description": "ransomware", "uuid": "21d4caeb-96e4-4564-8d62-6d7521b0d8ec", "value": "ShutUpAndDance" }, { "description": "ransomware", "uuid": "92e5861f-5b20-4401-a75f-f5120269b827", "value": "Sifreli 2017" }, { "description": "ransomware", "uuid": "87372df7-0fa1-4d1e-bf76-4cfdcdced997", "value": "Sifreli 2019" }, { "description": "ransomware", "uuid": "364013f9-15d2-41c0-b458-fd4085466151", "value": "SifreCozucu" }, { "description": "ransomware", "uuid": "939e7780-5c6e-43f4-9710-c0c219762bc9", "value": "SilentSpring" }, { "description": "ransomware", "uuid": "c3a9d2d0-d239-40af-86cc-51457ed82b46", "value": "SintaLocker" }, { "description": "ransomware", "uuid": "7c36b38e-6851-402b-93cd-195e029cba84", "value": "Skull" }, { "description": "ransomware", "uuid": "fe5ea390-fe3a-4ec9-b0f6-8365c525f5be", "value": "Skull HT" }, { "description": "ransomware", "uuid": "0d3634a3-1766-4b49-8ceb-2274ca2048af", "value": "SkyStars" }, { "description": "ransomware", "uuid": "eae70261-6efc-424f-829f-4d179c7a75ae", "value": "SlankCryptor" }, { "description": "ransomware", "uuid": "787ea4ce-23ab-464e-9dd8-bb6d24b0c481", "value": "Snake-Ekans" }, { "description": "ransomware", "uuid": "92d45020-2aa0-49ac-8e71-be8f3a3f79eb", "value": "SnakeLocker" }, { "description": "ransomware", "meta": { "links": [ "http://hl66646wtlp2naoqnhattngigjp5palgqmbwixepcjyq5i534acgqyad.onion", "https://snatch.press/", "https://snatchteam.cc", "https://snatchnews.top/" ], "refs": [ "https://t.me/snatch_news", "https://blog.intel471.com/2020/05/21/a-brief-history-of-ta505/", "https://github.com/albertzsigovits/malware-notes/blob/master/Snatch.md", "https://intel471.com/blog/a-brief-history-of-ta505", "https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://thedfirreport.com/2020/06/21/snatch-ransomware/", "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", "https://twitter.com/VK_Intel/status/1191414501297528832", "https://www.bleepingcomputer.com/news/security/snatch-ransomware-reboots-to-windows-safe-mode-to-bypass-av-tools/", "https://www.crowdstrike.com/blog/financial-motivation-drives-golang-malware-adoption/", "https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/", "https://www.secureworks.com/blog/ransomware-groups-use-tor-based-backdoor-for-persistent-access", "https://www.ransomlook.io/group/snatch" ] }, "uuid": "1a58eeac-26dc-40e6-8182-22cd461ba736", "value": "Snatch" }, { "description": "ransomware", "uuid": "f0a26e38-d67c-4215-8a9d-1723ac984d62", "value": "SnowPicnic" }, { "description": "ransomware", "uuid": "f2125a86-a23d-4165-a6b7-821db3b48b95", "value": "SoFucked" }, { "description": "ransomware", "uuid": "e065c7cc-061d-43a8-9668-1aa187e0fd52", "value": "SOLO" }, { "description": "ransomware", "uuid": "48f18fa2-7dea-4bdf-8736-253672b62140", "value": "Somik1" }, { "description": "ransomware", "uuid": "b5f99a93-0c4f-491d-a36a-617d892b5e38", "value": "Sorry HT" }, { "description": "ransomware", "uuid": "2fab1ada-2e01-4704-b4d8-e3bb75e6488b", "value": "SpartCrypt" }, { "description": "ransomware", "uuid": "1e968067-dd8f-4c15-a756-4f572a0ee2cf", "value": "Spectre" }, { "description": "ransomware", "uuid": "dbe1f272-07c0-4189-ab91-4a6ee7d1ee9a", "value": "Sphinx" }, { "description": "ransomware", "uuid": "9dad4770-3fd8-48e8-8dd3-bac621f9932a", "value": "Spiteful Doubletake" }, { "description": "ransomware", "uuid": "a73abf3d-abda-4916-9401-8c522f87de7c", "value": "SpongeBob" }, { "description": "ransomware", "uuid": "5eacbcf2-84b9-4467-a8de-4c8e9af2c840", "value": "StalinLocker" }, { "description": "ransomware", "uuid": "6a9f0f9f-2033-4361-918b-fbfa1cac5e9b", "value": "Stinger" }, { "description": "ransomware", "uuid": "e6b1ec39-e118-47d2-9205-468c87be86c2", "value": "Storm" }, { "description": "ransomware", "uuid": "c6ab1853-d980-4eb8-b2d5-5c22d9eb882a", "value": "StrawHat" }, { "description": "ransomware", "uuid": "928e5d57-8029-4300-be0a-5e6e43c220dd", "value": "Streamer" }, { "description": "ransomware", "uuid": "d018d87e-4baa-45bd-880b-496c18726da3", "value": "Striked" }, { "description": "ransomware", "uuid": "1ae8b4dd-eaef-4181-a699-02536aece63d", "value": "Stroman" }, { "description": "ransomware", "uuid": "8371370f-8d53-4e90-95f7-e20540f5d052", "value": "Stupid" }, { "description": "ransomware", "uuid": "b8826051-f533-4e70-b59e-166009946ee3", "value": "StupidJapan" }, { "description": "ransomware", "uuid": "4d1c8d02-f3e2-4a95-8ca2-f3665ec6cc8d", "value": "Styver" }, { "description": "ransomware", "uuid": "5039d334-c737-4d5b-941c-38a714a014c2", "value": "Styx" }, { "description": "ransomware", "uuid": "41ee30d0-4c67-4445-990b-07c3c8f1aa28", "value": "SuperB" }, { "description": "ransomware", "uuid": "f379af94-1826-41bb-a879-ff84a1319848", "value": "SuperCrypt" }, { "description": "ransomware", "uuid": "f3673646-cfd7-4b6e-bd43-b3366d3391d9", "value": "Suri" }, { "description": "ransomware", "uuid": "60561968-40ba-44b6-9ef5-5577c2422f72", "value": "Symbiom" }, { "description": "ransomware", "uuid": "59863099-6ef0-4fad-87cb-adf21d22ace4", "value": "SymmyWare" }, { "description": "ransomware", "uuid": "b779b4c0-f32c-4815-bcdf-b81f44a5efd0", "value": "Syrk" }, { "description": "ransomware", "uuid": "a1bae9e1-2eed-4004-b289-b572936450a3", "value": "SYSDOWN" }, { "description": "ransomware", "uuid": "ea3f6dc9-4afe-43c6-be84-1ba9c752c9c6", "value": "SystemCrypter" }, { "description": "ransomware", "uuid": "561090ca-d8a6-43f8-acbb-c2d58d422cbd", "value": "T1Happy" }, { "description": "ransomware", "uuid": "dcfb11cf-bc62-4c2c-9ff8-f4c019c1141d", "value": "Takahiro Locker" }, { "description": "ransomware", "uuid": "4945d7b7-33a7-4e41-94ba-f55650f336e7", "value": "TBHRanso" }, { "description": "ransomware", "uuid": "02467be1-ac0d-4fcd-b2b9-0d0c7d337e06", "value": "Teamo" }, { "description": "ransomware", "uuid": "12622e89-46d4-4cd5-95be-c3a2d12e8a18", "value": "Tear Dr0p" }, { "description": "ransomware", "uuid": "6ee1b6e3-dac1-483b-aa8c-6afe4433e1ed", "value": "Technicy" }, { "description": "ransomware", "uuid": "db9aa4f1-5f54-4bed-9f7a-a19e906f94b4", "value": "TeslaWare" }, { "description": "ransomware", "uuid": "d5d35c4f-ebde-43ae-acfc-d41c06210893", "value": "TFlower" }, { "description": "ransomware", "uuid": "9867ec9e-a772-4c70-81dc-1517330e58bd", "value": "The Brotherhood" }, { "description": "ransomware", "uuid": "cafb301d-098f-40d3-92c7-722b2cc15172", "value": "The Magic" }, { "description": "ransomware", "uuid": "8ab31008-966e-4ad5-88a2-9e820b814292", "value": "TheCursedMurderer" }, { "description": "ransomware", "uuid": "3ec11602-d4df-4341-a9f0-91caf2be1cc0", "value": "TheDarkEncryptor" }, { "description": "ransomware", "uuid": "3ecf7a76-9e37-4d36-9dda-be8d0a38d56a", "value": "Thor" }, { "description": "ransomware", "uuid": "6c01d67f-2d59-45ae-a5ba-decef1f2cc0d", "value": "THT" }, { "description": "ransomware", "uuid": "630d46fe-306d-49fa-b2e4-9f85f8b86000", "value": "ThunderCrypt" }, { "description": "ransomware", "uuid": "772f6749-a753-42af-8442-e6526f8b9a2a", "value": "Tk" }, { "description": "ransomware", "uuid": "904fc008-64f6-4adf-863e-f5b6b63df65c", "value": "Torchwood" }, { "description": "ransomware", "uuid": "dcf0947c-15f3-438c-97e0-ec65d63b80bb", "value": "TorLocker" }, { "description": "ransomware", "uuid": "483cae7f-4554-46db-8bbc-223881ae9a1c", "value": "TotalWipeOut" }, { "description": "ransomware", "uuid": "abdb9c59-c07b-4701-8208-e6a0cf9efe98", "value": "TPS1.0" }, { "description": "ransomware", "uuid": "95d5eba2-dbb6-4527-9dee-ba13d1c9ac00", "value": "Trick-Or-Treat" }, { "description": "ransomware", "uuid": "6853449b-8b09-43be-96dc-26b16b4d421b", "value": "Trojan-Syria" }, { "description": "ransomware", "uuid": "18c91134-1df6-4853-a1c2-c8424137f2e6", "value": "TrumpHead" }, { "description": "ransomware", "uuid": "90c6daf8-8212-4ea8-9b59-af49b290b3b9", "value": "TurkStatik" }, { "description": "ransomware", "uuid": "0407e98d-cd3e-42e1-8daf-3c51d2e4906a", "value": "UCCU" }, { "description": "ransomware", "uuid": "ba4f3704-cb2d-4a12-8d81-c825063aaaca", "value": "Ukash" }, { "description": "ransomware", "uuid": "fbbb3784-ddf9-447a-91d8-e155317edd87", "value": "Ultimo HT" }, { "description": "ransomware", "uuid": "911e63bc-ab09-4da1-8db7-2ad9354eafee", "value": "UltraCrypter" }, { "description": "ransomware", "uuid": "a9695d8a-9d83-4ae0-9460-f4f56c41ed90", "value": "Unikey" }, { "description": "ransomware", "uuid": "5ee8d6db-8a82-40ee-9e8e-a96795b3fee0", "value": "Unknown Crypted" }, { "description": "ransomware", "uuid": "348fda47-e254-479e-b702-ebefda3f490d", "value": "Unknown Lock" }, { "description": "ransomware", "uuid": "b73d6fd8-7707-451a-a5cb-0425289b02be", "value": "Unknown XTBL" }, { "description": "ransomware", "uuid": "f94e3dba-cdd6-438e-bc7e-b71af6e8e161", "value": "Unlckr" }, { "description": "ransomware", "uuid": "15140e19-f09e-4543-9a4c-b0f0e96860fe", "value": "UNNAM3D" }, { "description": "ransomware", "uuid": "d77b1546-d37d-47ed-9a46-52892bdbd639", "value": "Unnamed Bin" }, { "description": "ransomware", "uuid": "2fe11a8a-dfc3-41c3-891f-365a10a1debd", "value": "Unrans" }, { "description": "ransomware", "uuid": "10666f8c-9e0a-485e-88cc-98b993321d5f", "value": "UselessDisk" }, { "description": "ransomware", "uuid": "f43f4c9a-5008-477c-9105-4d444c883caa", "value": "UselessFiles" }, { "description": "ransomware", "uuid": "a6a04c23-9df3-47b9-9095-4b7f9799f51a", "value": "USR0" }, { "description": "ransomware", "uuid": "edcc3607-b246-44ce-8878-5af1a09976ae", "value": "Vaca" }, { "description": "ransomware", "uuid": "74a8637a-ac0d-45dd-91d5-326459f09cb5", "value": "VCrypt" }, { "description": "ransomware", "uuid": "d1deeb03-5084-4b50-bb19-38d7bd36a42f", "value": "vCrypt1" }, { "description": "ransomware", "uuid": "d9dd94aa-a646-40b3-a2d3-5870c6be66cf", "value": "VegaLocker" }, { "description": "ransomware", "uuid": "1ccd6940-4eb7-416c-a0de-1fb672d93c80", "value": "Velso" }, { "description": "ransomware", "uuid": "7fd558de-1dfe-432a-834b-3e2691ee7283", "value": "Vendetta" }, { "description": "ransomware", "uuid": "3d71e8a0-d823-47c0-8a0d-62e35d348514", "value": "VevoLocker" }, { "description": "ransomware", "uuid": "e089f805-8cc2-41d0-b67e-eae21d78bc6c", "value": "VHD" }, { "description": "ransomware", "uuid": "99edd501-76ca-4492-a0a3-8e1c988be22a", "value": "ViACrypt" }, { "description": "ransomware", "uuid": "777390e2-0d15-499a-8f87-5a5851cdbd09", "value": "Viagra" }, { "description": "ransomware", "uuid": "7eb414f6-11d9-4424-b486-e1e379b6840f", "value": "VideoBelle" }, { "description": "ransomware", "uuid": "38c94712-deed-470a-b784-0f4665aebf39", "value": "ViiperWare" }, { "description": "ransomware", "uuid": "0fecef7e-a387-497f-bc26-9560fd943afb", "value": "Viro" }, { "description": "ransomware", "uuid": "3f62e429-7e6d-41c5-b716-9eb2304e60dc", "value": "ViroBotnet" }, { "description": "ransomware", "uuid": "fc8cc150-c2fb-40cd-9cca-638b8a091861", "value": "VisionCrypt" }, { "description": "ransomware", "uuid": "dff0c92b-953d-4fef-8b36-f36906f806d2", "value": "VMola" }, { "description": "ransomware", "uuid": "823e56de-7d4c-4914-a49b-524a5bb77b02", "value": "VoidCrypt" }, { "description": "ransomware", "uuid": "1da33eaf-096e-4076-8676-23da3a97ed74", "value": "Vulston" }, { "description": "ransomware", "uuid": "a5d35c2d-7d06-4539-a4f7-75499663d152", "value": "Waffle" }, { "description": "ransomware", "uuid": "26aec13a-eaf2-4adb-9c67-e6ae8f318a0c", "value": "Waiting" }, { "description": "ransomware", "uuid": "e5b2a647-0107-4309-9695-c7bb7859cf4c", "value": "Waldo" }, { "description": "ransomware", "uuid": "a3be0f12-ece5-4bdb-bcb6-1f5732eb5735", "value": "Wanna Decryptor Portuguese" }, { "description": "ransomware", "uuid": "45259e4f-7c68-4e9a-86af-078607181a84", "value": "WannabeHappy" }, { "description": "ransomware", "uuid": "30a56d79-1dee-401e-ad3d-3ea939c4efde", "value": "WannaCash" }, { "description": "ransomware", "uuid": "870836be-0534-437e-a25a-7f1e70f9f394", "value": "WannaDie" }, { "description": "ransomware", "uuid": "b222ca29-29b1-4aaa-a709-a3730a70216a", "value": "WannaPeace" }, { "description": "ransomware", "uuid": "4dd51f0f-ad6b-4117-b071-505ec4b71730", "value": "WannaSpam" }, { "description": "ransomware", "uuid": "9540bd2d-638b-4e79-a231-6f06b055c916", "value": "Want Money" }, { "description": "ransomware", "uuid": "0ca42fde-477c-459d-89a6-bed041a73b70", "value": "Wesker" }, { "description": "ransomware", "uuid": "5e678363-c42e-4852-9a2e-90212310a522", "value": "WhatAFuck" }, { "description": "ransomware", "uuid": "305b6505-1186-43c8-acd9-431322287ec6", "value": "WhyCry" }, { "description": "ransomware", "uuid": "cb343570-c8a0-4bb6-ba3b-88126449593e", "value": "Windows10" }, { "description": "ransomware", "uuid": "99a8b639-1b06-4e4b-9994-a6e4d0601341", "value": "WininiCrypt" }, { "description": "ransomware", "uuid": "1942a99a-5c5a-49ef-8c6d-0cb6b0fb082b", "value": "Winsecure" }, { "description": "ransomware", "uuid": "8ec00fe5-475b-47bc-a7fc-b470d15aaa75", "value": "WinUpdatesDisabler" }, { "description": "ransomware", "uuid": "f14af77c-5a98-4840-953c-2f37af8cdcc5", "value": "WTDI" }, { "description": "ransomware", "uuid": "39bcd377-24cb-42f4-8f2a-2aa17d5171dc", "value": "X Locker 5.0" }, { "description": "ransomware", "uuid": "78e05406-ce59-478a-bf1e-1b1abe22e116", "value": "XCry" }, { "description": "ransomware", "uuid": "88f4f772-8c6e-4201-92aa-819c5e7af5c1", "value": "XD" }, { "description": "ransomware", "uuid": "9582a86c-c20d-4e1f-a124-bf2c6d8adf33", "value": "XData" }, { "description": "ransomware", "uuid": "4272cc4a-9d93-4712-b641-b7f4fc9f86bc", "value": "XeroWare" }, { "description": "ransomware", "uuid": "5ecc109c-9f04-4e56-86c4-83b37181e75b", "value": "Xlockr" }, { "description": "ransomware", "uuid": "a0c2b579-20f0-4357-8a01-596ce20db48a", "value": "XmdXtazX" }, { "description": "ransomware", "uuid": "95d00a69-c048-48c3-bc6b-fa6a655d8ff3", "value": "Xncrypt" }, { "description": "ransomware", "related": [ { "dest-uuid": "bcaaad6f-0597-4b89-b69b-84a6be2b7bc3", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "used-by" }, { "dest-uuid": "509aff15-ba17-4582-b1a0-b0ed89df01d8", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "c76e2ee8-52d1-4a55-81df-5542d232ca32", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "a8f167a8-30b9-4953-8eb6-247f0d046d32", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "d650da35-7ad7-417a-902a-16ea55bd1126", "value": "XRat" }, { "description": "ransomware", "uuid": "f5c46d3f-404b-4640-9892-005f845d33a2", "value": "XyuEncrypt" }, { "description": "ransomware", "uuid": "c08fd941-e54c-4ac6-b94a-fc9b5c9617da", "value": "xXLecXx" }, { "description": "ransomware", "uuid": "ebfa8988-8063-4e3c-a635-7da898389aa4", "value": "Yatron" }, { "description": "ransomware", "uuid": "d6791998-5c0a-4943-bda5-b378d1326a13", "value": "Yoshikada" }, { "description": "ransomware", "uuid": "e32b8df2-6f03-4232-b64a-2de14b5642f3", "value": "YYYYBJQOQDU" }, { "description": "ransomware", "uuid": "2f6d77c5-54df-4997-b82c-ca54d6948d6f", "value": "ZariqaCrypt" }, { "description": "ransomware", "uuid": "463d17d4-e35e-4614-9247-47a3a50a8cda", "value": "Zelta Free" }, { "description": "ransomware", "uuid": "fee8e9fa-68b9-4b69-bd62-6213971e7e10", "value": "ZenCrypt" }, { "description": "ransomware", "uuid": "5e3a2958-6922-465e-bc36-3b6e59ad1bc1", "value": "Zeoticus" }, { "description": "ransomware", "uuid": "bc62429c-1bf7-42c0-997d-d8c2f80355de", "value": "Zeppelin" }, { "description": "ransomware", "uuid": "90ac4150-aab9-44a2-bd56-2bcfa773798b", "value": "Zero-Fucks" }, { "description": "ransomware", "uuid": "9296d2bc-ec26-4724-88b4-82ab682ed11e", "value": "ZeroLocker" }, { "description": "ransomware", "uuid": "03686533-7339-4401-b90d-1125eeffa07f", "value": "Zeronine" }, { "description": "ransomware", "uuid": "4ff2a1ff-a35e-4d3a-a132-2dcefa2995f7", "value": "ZeroRansom" }, { "description": "ransomware", "uuid": "2147b5a8-2f4a-433c-95aa-cdeb4349c542", "value": "Zilla" }, { "description": "ransomware", "uuid": "ae9ec6c3-570f-41fc-ac18-5b129976727a", "value": "ZimbraCryptor" }, { "description": "ransomware", "uuid": "0dfbed7c-66c5-4309-b8ba-7c7a6e659512", "value": "ZipLocker" }, { "description": "ransomware", "uuid": "774e5809-2d72-4c3d-a28b-5c51f17f1981", "value": "Zipper" }, { "description": "ransomware", "uuid": "a67eedaf-84c5-42ed-86fe-853c76599fe5", "value": "Zoldon" }, { "description": "ransomware", "uuid": "03e34bcf-af8b-429d-ac66-aeff844e8fd6", "value": "ZorgoCry" }, { "description": "ransomware", "uuid": "78541326-4aaa-4eda-8f55-bf21bb2537ab", "value": "Smaug" }, { "description": "ransomware", "uuid": "e3cce543-64b0-4f7a-a176-f1ddc429da3f", "value": "GammA" }, { "description": "ransomware", "uuid": "c35de33c-8f7c-41f3-9b74-6da34a0d31c6", "value": "BlackMoon" }, { "description": "ransomware", "uuid": "ab33547b-2b6c-47ae-8fca-9747735b0955", "value": "MilkmanVictory" }, { "description": "ransomware", "uuid": "1263f5e9-7073-443b-a884-caf9ebf47a1a", "value": "Dragoncyber" }, { "description": "ransomware", "uuid": "61513ee1-4667-43eb-831a-3e01d8e1039f", "value": "Solider" }, { "description": "ransomware", "uuid": "a65bde28-b74c-4ec5-ae20-01cbe101b025", "value": "Biglock" }, { "description": "ransomware", "uuid": "c2880897-759e-4cbf-8d08-a3418567a33c", "value": "Immuni" }, { "description": "ransomware", "uuid": "d848ca6f-c935-4dba-b706-bd06be094a87", "value": "Black claw" }, { "description": "ransomware", "uuid": "b6096de6-c831-4a64-9108-e3fcfc7fcc44", "value": "Banks1" }, { "description": "ransomware", "uuid": "9683775c-7d36-4a5a-9580-1038ed17d9d2", "value": "UnluckyWare" }, { "description": "ransomware", "uuid": "7d949282-005f-45de-96b3-5584a1114cd6", "value": "Zorab" }, { "description": "ransomware", "uuid": "b56a89d1-1748-42a0-8a78-02e882a219a9", "value": "FonixCrypter" }, { "description": "ransomware", "uuid": "ab0f5636-38cf-4c89-a090-df4f006bd47b", "value": "LickyAgent" }, { "description": "ransomware", "uuid": "d52ba288-4bcc-4f52-be6c-0d9cfadbf194", "value": "DualShot" }, { "description": "ransomware", "uuid": "e68a3736-1d87-4a77-9814-b23c65cee3c3", "value": "RNS" }, { "description": "ransomware", "uuid": "b1126047-eaaa-4e2f-abc9-f64faa84d692", "value": "Such_Crypt" }, { "description": "ransomware", "uuid": "c64d6b5d-44a1-461e-acc6-2b4571f6163d", "value": "20dfs" }, { "description": "ransomware", "uuid": "cfa9c2ee-6a2f-4cd4-849f-bcf8e9aa77a7", "value": "CryDroid" }, { "description": "ransomware", "uuid": "6f011a57-6a70-4e2a-9a51-36d9032bef05", "value": "TomNom" }, { "description": "ransomware", "uuid": "ada0a2d1-f595-4988-b87a-623c5581bbad", "value": "Yogynicof" }, { "description": "ransomware", "uuid": "d160c549-3cf8-4f20-b041-8d775469a566", "value": "CobraLocker" }, { "description": "ransomware", "uuid": "ca9a3c5c-ef8e-4e09-bd91-0347a6967837", "value": "PL" }, { "description": "ransomware", "uuid": "ed6f4c24-a2eb-4395-ae76-4d4992b21f5b", "value": "CryCryptor" }, { "description": "ransomware", "uuid": "d1c43e2b-75a5-4d75-a8b7-b46fe106ed87", "value": "Blocky" }, { "description": "ransomware", "uuid": "b7d9e0c2-e772-41e0-9202-5df2bcff9022", "value": "OhNo-FakePDF" }, { "description": "ransomware", "uuid": "455b864e-47c0-419f-9c0c-a75bac6d5e84", "value": "Try2Cry" }, { "description": "ransomware", "uuid": "5e1df833-e4de-44a9-8728-1681a6e6afbc", "value": "LolKek" }, { "description": "ransomware", "uuid": "165949bf-bc59-43c8-a9b7-d281da5688ee", "value": "FlowEncrypt" }, { "description": "ransomware", "uuid": "3ae97d00-4b38-4f81-a055-a1057e3cebae", "value": "WhoLocker" }, { "description": "ransomware", "uuid": "ad010794-bdac-4157-adba-e87014a29708", "value": "Pojie" }, { "description": "ransomware", "uuid": "c795358a-c462-48f0-a5ff-9bdc1dd869e5", "value": "Aris Locker" }, { "description": "ransomware", "uuid": "7750a0ed-e17b-4eaf-97f1-ddf097c48858", "value": "EduRansom" }, { "description": "ransomware", "uuid": "db954a2d-4602-4722-977d-3b147ebc1858", "value": "Fastwind" }, { "description": "ransomware", "uuid": "51600819-3b88-43a9-b64e-d08bf5d29f7c", "value": "Silvertor" }, { "description": "ransomware", "meta": { "links": [ "http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion" ], "refs": [ "https://medium.com/@velasco.l.n/exorcist-ransomware-from-triaging-to-deep-dive-5b7da4263d81", "https://www.ransomlook.io/group/exorcist" ] }, "uuid": "b8b0933a-896a-45d1-8284-ebc55dff1f98", "value": "Exorcist" }, { "description": "ransomware", "uuid": "df5ef12b-c0e3-4069-beaa-e84ea953befc", "value": "WyvernLocker" }, { "description": "ransomware", "uuid": "58d0f5cf-5e71-44dc-b493-b0d3c0724587", "value": "Ensiko" }, { "description": "ransomware", "uuid": "d667e11f-95d0-4c44-a0c6-b6ab617c307f", "value": "Django" }, { "description": "ransomware", "uuid": "2c754dfc-0748-47d7-8853-652c1d6a93a7", "value": "RansomBlox" }, { "description": "ransomware", "uuid": "a378ddf1-5981-4e76-8672-60dd4cb67dc1", "value": "BitRansomware" }, { "description": "ransomware", "uuid": "e9cd52e1-b3e0-4da9-b969-4a3947f3f6bf", "value": "AESMew" }, { "description": "ransomware", "uuid": "4cd34987-7b49-4a75-8668-a02498b9b1ac", "value": "DeathOfShadow" }, { "description": "ransomware", "uuid": "9acc2bd8-9215-4795-bf2b-c4281a8ca697", "value": "XMRLocker" }, { "description": "ransomware", "uuid": "0aada732-3b59-4410-a043-5a190d391927", "value": "WinWord64" }, { "description": "ransomware", "uuid": "937d3070-7fc6-4967-98bc-17acb0c8da8e", "value": "ThunderX" }, { "description": "ransomware", "meta": { "refs": [ "https://howtofix.guide/ransom-mountlocket/" ] }, "related": [ { "dest-uuid": "0ca6ac54-ad2b-4945-9580-ac90e702fd2c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "7513650c-ba09-49bf-b011-d2974c7ae023", "value": "Mountlocket" }, { "description": "ransomware", "uuid": "09fac901-8fcf-4faa-b1e3-96407433d0f2", "value": "Gladius" }, { "description": "ransomware", "uuid": "1ff34e4a-a205-493f-bdd0-2212d80fd83c", "value": "Cyrat" }, { "description": "ransomware", "uuid": "705e03d1-b0c9-4c0b-9b10-fb751e09a020", "value": "Crypt32" }, { "description": "ransomware", "uuid": "16ebc67f-96d2-4497-84da-a05713352aba", "value": "BizHack" }, { "description": "ransomware", "uuid": "971bdbfe-d55d-410f-9b07-57ba69027eb8", "value": "Geneve" }, { "description": "ransomware", "uuid": "361a35bc-c952-41ad-bd27-c32b690aa9e3", "value": "Z3" }, { "description": "ransomware", "uuid": "e723285e-14ff-4d25-97c3-43e73168d606", "value": "Leakthemall" }, { "description": "Conti ransomware is a RaaS and has been observed encrypting networks since mid-2020.\nConti was developed by the “TrickBot” group, an organized Russian cybercriminal operation. Their reputation has allowed the group to create a strong brand name, attracting many affiliates which has made Conti one of the most widespread ransomware strains in the world.\nOne of the last known “Conti” attacks was against the government of Costa Rica in April 2022 causing the country to declare a state of emergency.\nShortly after this final attack, the “Conti” brand disappeared. The group behind it likely switched to a different brand to avoid sanctions and start over with a new, clean reputation.", "meta": { "attribution-confidence": "100", "country": "RU", "extensions": [ ".conti" ], "links": [ "http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/", "http://continews.click" ], "ransomnotes": [ "All of your files are currently encrypted by CONTI ransomware." ], "refs": [ "https://www.cyber.gov.au/acsc/view-all-content/advisories/2021-010-acsc-ransomware-profile-conti", "https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/787/original/ransomware-chats.pdf?1651576098", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-virtual-machines", "https://threatpost.com/affiliate-leaks-conti-ransomware-playbook/168442", "https://unit42.paloaltonetworks.com/conti-ransomware-gang", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://intel471.com/blog/malware-before-ransomware-trojan-information-stealer-cobalt-strike", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf", "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v", "https://securelist.com/new-ransomware-trends-in-2022/106457/", "https://www.advintel.io/post/advintel-s-state-of-emotet-aka-spmtools-displays-over-million-compromised-machines-through-2022", "https://www.esentire.com/blog/analysis-of-leaked-conti-intrusion-procedures-by-esentires-threat-response-unit-tru", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.secureworks.com/blog/gold-ulrick-continues-conti-operations-despite-public-disclosures", "https://www.threatstop.com/blog/first-conti-then-hive-costa-rica-gets-hit-with-ransomware-again", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-group-targets-esxi-hypervisors-with-its-linux-variant.html", "https://www.youtube.com/watch?v=cYx7sQRbjGA", "http://chuongdong.com/reverse%20engineering/2020/12/15/ContiRansomware/", "https://0xthreatintel.medium.com/reversing-conti-ransomware-bfce15019e74", "https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel", "https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf", "https://arcticwolf.com/resources/blog/conti-ransomware-leak-analyzed", "https://arcticwolf.com/resources/blog/karakurt-web", "https://areteir.com/wp-content/uploads/2020/08/Arete_Insight_Is-Conti-the-new-Ryuk_August2020.pdf", "https://assets.sentinelone.com/ransomware-enterprise/conti-ransomware-unpacked", "https://attackiq.com/2022/06/15/attack-graph-emulating-the-conti-ransomware-teams-behaviors/", "https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html", "https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti", "https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/", "https://blog.qualys.com/vulnerabilities-threat-research/2021/11/18/conti-ransomware", "https://blog.reversinglabs.com/blog/conversinglabs-ep-2-conti-pivots-as-ransomware-as-a-service-struggles", "https://blog.talosintelligence.com/2021/09/Conti-leak-translation.html", "https://blog.talosintelligence.com/2022/05/conti-and-hive-ransomware-operations.html", "https://blogs.blackberry.com/en/2022/09/the-curious-case-of-monti-ransomware-a-real-world-doppelganger", "https://blogs.vmware.com/security/2022/09/threat-report-illuminating-volume-shadow-deletion.html", "https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://cluster25.io/2022/03/02/contis-source-code-deep-dive-into/", "https://cocomelonc.github.io/investigation/2022/03/27/malw-inv-conti-1.html", "https://cocomelonc.github.io/investigation/2022/04/11/malw-inv-conti-2.html", "https://cocomelonc.github.io/tutorial/2022/04/02/malware-injection-18.html", "https://content.secureworks.com/-/media/Files/US/Reports/Monthly%20Threat%20Intelligence/Secureworks_ECO1_ThreatIntelligenceExecutiveReport2022Vol2.ashx", "https://cti-league.com/wp-content/uploads/2021/02/CTI-League-Darknet-Report-2021.pdf", "https://cybersecurity.att.com/blogs/security-essentials/stories-from-the-soc-powershell-proxyshell-conti-ttps-oh-my", "https://cyware.com/news/ransomware-becomes-deadlier-conti-makes-the-most-money-39e17bae/", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://documents.trendmicro.com/assets/pdf/datasheet-ransomware-in-Q1-2022.pdf", "https://eclypsium.com/2022/06/02/conti-targets-critical-firmware/", "https://github.com/TheParmak/conti-leaks-englished", "https://github.com/cdong1012/ContiUnpacker", "https://github.com/whichbuffer/Conti-Ransomware-IOC", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf", "https://intel471.com/blog/conti-emotet-ransomware-conti-leaks", "https://intel471.com/blog/conti-leaks-cybercrime-fire-team", "https://intel471.com/blog/conti-vs-monti-a-reinvention-or-just-a-simple-rebranding", "https://intel471.com/blog/shipping-companies-ransomware-credentials", "https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/", "https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/", "https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/", "https://krebsonsecurity.com/2021/10/conti-ransom-gang-starts-selling-access-to-victims/", "https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-ii-the-office/", "https://lifars.com/wp-content/uploads/2021/10/ContiRansomware_Whitepaper.pdf", "https://marcoramilli.com/2021/11/07/conti-ransomware-cheat-sheet/", "https://medium.com/@arnozobec/analyzing-conti-leaks-without-speaking-russian-only-methodology-f5aecc594d1b", "https://medium.com/@whickey000/how-i-cracked-conti-ransomware-groups-leaked-source-code-zip-file-e15d54663a8", "https://medium.com/cycraft/the-road-to-ransomware-resilience-c1ca37036efd", "https://nakedsecurity.sophos.com/2021/08/06/conti-ransomware-affiliate-goes-rogue-leaks-company-data/", "https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/", "https://news.sophos.com/en-us/2021/02/16/conti-ransomware-evasive-by-nature/", "https://news.sophos.com/en-us/2021/02/16/what-to-expect-when-youve-been-hit-with-conti-ransomware/", "https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/", "https://news.sophos.com/en-us/2022/02/22/cyberthreats-during-russian-ukrainian-tensions-what-can-we-learn-from-history-to-be-prepared/", "https://news.sophos.com/en-us/2022/02/28/conti-and-karma-actors-attack-healthcare-provider-at-same-time-through-proxyshell-exploits/?cmp=30728", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/", "https://redcanary.com/blog/intelligence-insights-november-2021/", "https://research.checkpoint.com/2022/leaks-of-conti-ransomware-group-paint-picture-of-a-surprisingly-normal-tech-start-up-sort-of/", "https://research.nccgroup.com/2022/03/31/conti-nuation-methods-and-techniques-observed-in-operations-post-the-leaks/", "https://research.nccgroup.com/2022/04/29/adventures-in-the-land-of-bumblebee-a-new-malicious-loader/", "https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/787/original/ransomware-chats.pdf", "https://securelist.com/luna-black-basta-ransomware/106950", "https://securelist.com/modern-ransomware-groups-ttps/106824/", "https://securityaffairs.co/wordpress/128190/cyber-crime/conti-ransomware-takes-over-trickbot.html", "https://securityandtechnology.org/wp-content/uploads/2021/04/IST-Ransomware-Task-Force_Final_Report.pdf", "https://share.vx-underground.org/Conti/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/log4j-vulnerabilities-attacks", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://thedfirreport.com/2021/05/12/conti-ransomware/", "https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/", "https://thedfirreport.com/2021/09/13/bazarloader-to-conti-ransomware-in-32-hours/", "https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/", "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/", "https://thedfirreport.com/2021/12/13/diavol-ransomware/", "https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/", "https://thehackernews.com/2022/05/malware-analysis-trickbot.html", "https://therecord.media/conti-leaks-the-panama-papers-of-ransomware/", "https://therecord.media/conti-ransomware-gang-chats-leaked-by-pro-ukraine-member/", "https://therecord.media/disgruntled-ransomware-affiliate-leaks-the-conti-gangs-technical-manuals/", "https://threatpost.com/affiliate-leaks-conti-ransomware-playbook/168442/", "https://threatpost.com/conti-ransomware-decryptor-trickbot-source-code-leaked/178727/", "https://threatpost.com/conti-ransomware-v-3-including-decryptor-leaked/179006/", "https://twitter.com/AltShiftPrtScn/status/1350755169965924352", "https://twitter.com/AltShiftPrtScn/status/1417849181012647938", "https://twitter.com/AltShiftPrtScn/status/1423188974298861571", "https://twitter.com/TheDFIRReport/status/1498642512935800833", "https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/", "https://unit42.paloaltonetworks.com/conti-ransomware-gang/", "https://us-cert.cisa.gov/ncas/alerts/aa21-265a", "https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/", "https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://www.advanced-intel.com/post/hunting-for-corporate-insurance-policies-indicators-of-ransom-exfiltrations", "https://www.advanced-intel.com/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent", "https://www.advintel.io/post/24-hours-from-log4shell-to-local-admin-deep-dive-into-conti-gang-attack-on-fortune-500-dfir", "https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love", "https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape", "https://www.advintel.io/post/hydra-with-three-heads-blackbyte-the-future-of-ransomware-subsidiary-groups", "https://www.advintel.io/post/ransomware-advisory-log4shell-exploitation-for-initial-access-lateral-movement", "https://www.bankinfosecurity.com/cybercrime-moves-conti-ransomware-absorbs-trickbot-malware-a-18573", "https://www.bleepingcomputer.com/news/security/angry-conti-ransomware-affiliate-leaks-gangs-attack-playbook/", "https://www.bleepingcomputer.com/news/security/cisa-updates-conti-ransomware-alert-with-nearly-100-domain-names/", "https://www.bleepingcomputer.com/news/security/conti-ransomware-gang-takes-over-trickbot-malware-operation/", "https://www.bleepingcomputer.com/news/security/conti-ransomware-source-code-leaked-by-ukrainian-researcher/", "https://www.bleepingcomputer.com/news/security/conti-ransomwares-internal-chats-leaked-after-siding-with-russia/", "https://www.bleepingcomputer.com/news/security/hackers-use-contis-leaked-ransomware-to-attack-russian-companies/", "https://www.bleepingcomputer.com/news/security/hhs-conti-ransomware-encrypted-80-percent-of-irelands-hse-it-systems/", "https://www.bleepingcomputer.com/news/security/karakurt-revealed-as-data-extortion-arm-of-conti-cybercrime-syndicate/", "https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/", "https://www.bleepingcomputer.com/news/security/ryuk-successor-conti-ransomware-releases-data-leak-site/", "https://www.bleepingcomputer.com/news/security/taiwanese-apple-and-tesla-contractor-hit-by-conti-ransomware/", "https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf", "https://www.clearskysec.com/wp-content/uploads/2021/02/Conti-Ransomware.pdf", "https://www.connectwise.com/resources/conti-profile", "https://www.coveware.com/blog/2022/1/26/ransomware-as-a-service-innovation-curve", "https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound", "https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware", "https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/", "https://www.crowdstrike.com/blog/how-to-defend-against-conti-darkside-revil-and-other-ransomware/", "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/", "https://www.cyberark.com/resources/threat-research-blog/conti-group-leaked", "https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware", "https://www.cybereason.com/blog/threat-analysis-report-from-shatak-emails-to-the-conti-ransomware", "https://www.cyberscoop.com/ransomware-gang-conti-bounced-back/", "https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/", "https://www.cynet.com/attack-techniques-hands-on/shelob-moonlight-spinning-a-larger-web/", "https://www.darktrace.com/en/blog/the-double-extortion-business-conti-ransomware-gang-finds-new-avenues-of-negotiation/", "https://www.domaintools.com/resources/blog/the-most-prolific-ransomware-families-a-defenders-guide", "https://www.dragos.com/blog/industry-news/dragos-ics-ot-ransomware-analysis-q4-2021/", "https://www.dragos.com/blog/industry-news/suspected-conti-ransomware-activity-in-the-auto-manufacturing-sector/", "https://www.eldiario.es/tecnologia/capos-cibercrimen-avisan-contratacaran-si-hackea-rusia_1_8795458.html", "https://www.elliptic.co/blog/conti-ransomware-nets-at-least-25.5-million-in-four-months", "https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire", "https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider", "https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/", "https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf", "https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox", "https://www.ic3.gov/Media/News/2021/210521.pdf", "https://www.ironnet.com/blog/ransomware-graphic-blog", "https://www.mbsd.jp/2022/03/08/assets/images/MBSD_Summary_of_ContiLeaks_Rev3.pdf", "https://www.mbsd.jp/research/20210413/conti-ransomware/", "https://www.ncsc.gov.ie/pdfs/HSE_Conti_140521_UPDATE.pdf", "https://www.prevailion.com/what-wicked-webs-we-unweave/", "https://www.prodaft.com/m/reports/Conti_TLPWHITE_v1.6_WVcSEtc.pdf", "https://www.prodaft.com/m/reports/WizardSpider_TLPWHITE_v.1.4.pdf", "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf", "https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html", "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-annex-download.pdf", "https://www.redhotcyber.com/post/il-ransomware-conti-si-schiera-a-favore-della-russia", "https://www.secureworks.com/blog/gold-ulrick-leaks-reveal-organizational-structure-and-relationships", "https://www.sekoia.io/en/an-insider-insights-into-conti-operations-part-one", "https://www.sekoia.io/en/an-insider-insights-into-conti-operations-part-two/", "https://www.silentpush.com/blog/consequences-the-conti-leaks-and-future-problems", "https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html", "https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf", "https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf", "https://www.threatstop.com/blog/conti-ransomware-source-code-leaked", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/the-sound-of-malware.html", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict/IOC%20Resource%20for%20Russia-Ukraine%20Conflict-Related%20Cyberattacks-03032022.pdf", "https://www.trendmicro.com/en_us/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict.html", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-as-a-service-enabler-of-widespread-attacks", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-double-extortion-and-beyond-revil-clop-and-conti", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-by-the-numbers/lockbit-conti-and-blackcat-lead-pack-amid-rise-in-active-raas-and-extortion-groups-ransomware-in-q1-2022", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-conti", "https://www.trmlabs.com/post/analysis-corroborates-suspected-ties-between-conti-and-ryuk-ransomware-groups-and-wizard-spider", "https://www.truesec.com/hub/blog/proxyshell-qbot-and-conti-ransomware-combined-in-a-series-of-cyber-attacks", "https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-1", "https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-2", "https://www.youtube.com/watch?v=hmaWy9QIC7c", "https://www.youtube.com/watch?v=uORuVVQzZ0A", "https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/", "https://www.zscaler.com/blogs/security-research/conti-ransomware-attacks-persist-updated-version-despite-leaks", "https://yoroi.company/research/conti-ransomware-source-code-a-well-designed-cots-ransomware/", "https://www.ransomlook.io/group/conti" ] }, "related": [ { "dest-uuid": "0ca6ac54-ad2b-4945-9580-ac90e702fd2c", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "parent-of" }, { "dest-uuid": "9db5f425-fe49-4137-8598-840e7290ed0f", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "parent-of" }, { "dest-uuid": "1c43524e-0f2e-4468-b6b6-8a37f1d0ea87", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "parent-of" } ], "uuid": "201eff54-d41e-4f70-916c-5dfb9301730a", "value": "Conti" }, { "description": "ransomware", "uuid": "f3d28719-fa72-42c3-b0fe-cda484abbaf9", "value": "Makop" }, { "description": "ransomware", "uuid": "b0552a9f-8820-48c3-a75b-158063f17e1b", "value": "Best Crypt" }, { "description": "ransomware", "uuid": "784c93bb-4522-4988-92c0-fef89ff6086d", "value": "Consciousness" }, { "description": "ransomware", "uuid": "28d7d7e6-3803-4e77-bd89-8a0921a55c17", "value": "Flamingo" }, { "description": "ransomware", "uuid": "89346526-4f9d-4369-a1a2-53974a97a651", "value": "PewPew" }, { "description": "ransomware", "uuid": "9684f0dc-2c9d-46e3-a12f-65ea85a678e5", "value": "DogeCrypt" }, { "description": "ransomware", "uuid": "47354b68-52c9-4750-b783-97c278ddb6a2", "value": "Badbeeteam" }, { "description": "ransomware", "uuid": "e6b40e6b-7c3e-453c-a250-577f4b8a1a7c", "value": "Solve" }, { "description": "ransomware", "uuid": "6f7c24e3-b7e6-483c-92f0-99bf562f6397", "value": "RenameX12" }, { "description": "ransomware", "uuid": "e3c82188-6f63-48e1-ace8-e93484994792", "value": "Zhen" }, { "description": "ransomware", "uuid": "e5ef8579-a215-4450-8294-c887f3d62476", "value": "Datacloud" }, { "description": "ransomware", "uuid": "d511beb8-69c6-4ad8-aa82-fb7b56f467a5", "value": "Ironcat" }, { "description": "ransomware", "uuid": "ea521e5d-0908-4bb4-8111-b27f56b8fb8d", "value": "Dusk" }, { "description": "ransomware", "uuid": "966b504a-b032-4d99-80fa-5008228b2926", "value": "Cutekitty" }, { "description": "ransomware", "uuid": "3cc0e0d6-2b19-4505-8f2f-11456efeda8f", "value": "Babax" }, { "description": "ransomware", "uuid": "a7219d8e-e616-4808-8d5d-6eafe423405a", "value": "Eyecry" }, { "description": "ransomware", "uuid": "9f23a356-8ae8-40b2-bbde-d2f4ba62a883", "value": "Osno" }, { "description": "ransomware", "uuid": "1a49c0c2-3b66-4832-bf9c-d5624e6a5aaa", "value": "Loki" }, { "description": "ransomware", "uuid": "c4390e31-fdbd-44d9-babf-adc2b20a57ff", "value": "WoodRat" }, { "description": "ransomware", "uuid": "6d1ba8c7-3a86-4ec5-bfdf-f647c6fe984b", "value": "Curator" }, { "description": "ransomware", "uuid": "31c20516-d4ee-46fb-a020-ccc1b44177b7", "value": "32aa" }, { "description": "ransomware", "uuid": "6ac0f7e3-eebd-4112-a915-b069604c6d2b", "value": "Vaggen" }, { "description": "ransomware", "uuid": "fb98368c-79fb-4d34-a7e0-c4cc9847bce0", "value": "Clay" }, { "description": "ransomware", "uuid": "7b2f9d2c-d96a-4515-b57d-cc1cff35de3a", "value": "Pizhon" }, { "description": "ransomware", "uuid": "8439a797-4d81-4b8c-b278-3c41c640294f", "value": "InstallPay" }, { "description": "ransomware", "uuid": "ff711485-e052-4ca0-934a-748a7a5d6f4c", "value": "MetadataBin" }, { "description": "ransomware", "uuid": "bd743e59-1a2a-40ad-9cd4-d1e519d3b91d", "value": "TechandStrat" }, { "description": "ransomware", "uuid": "af35e406-7af3-46f1-b32d-305f9711f645", "value": "Mars" }, { "description": "ransomware", "uuid": "bee837e2-8bdb-4291-a267-4211bdc2a309", "value": "Scatterbrain" }, { "description": "ransomware", "uuid": "55d3f7c0-7aa8-4b0e-b0f9-86dd68c78968", "value": "CCECrypt" }, { "description": "ransomware", "uuid": "5de1dec7-749e-42ad-b0bf-68d5d774d5be", "value": "SZ40" }, { "description": "ransomware", "meta": { "date": "November 2020", "links": [ "http://pay2key2zkg7arp3kv3cuugdaqwuesifnbofun4j6yjdw5ry7zw2asid.onion/" ], "refs": [ "https://research.checkpoint.com/2020/ransomware-alert-pay2key", "https://www.twitter.com/p2ktwtacc", "https://keybase.io/pay2key", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://research.checkpoint.com/2020/ransomware-alert-pay2key/", "https://twitter.com/TrendMicroRSRCH/status/1389422784808378370", "https://www.bleepingcomputer.com/news/security/intels-habana-labs-hacked-by-pay2key-ransomware-data-stolen/", "https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf", "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf", "https://www.ransomlook.io/group/pay2key" ] }, "uuid": "678bc24d-a5c3-4ddd-9292-40958afa3492", "value": "Pay2Key" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "uuid": "ae288b5d-062c-4a11-ba81-14794dc6127f", "value": "Tripoli" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "uuid": "dcc12d6f-d59f-4451-999d-7728bf4e95aa", "value": "Devos" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "uuid": "63397164-fee2-4662-afac-cc651b0426cb", "value": "HowAreYou" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "uuid": "4be906e7-b6db-453f-8f9b-a8d8d9b29f4b", "value": "SifreCikis" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "uuid": "1bdafae9-51cd-4384-8ee7-774c9db7820f", "value": "68-Random-HEX" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "uuid": "a536a6bd-f567-4631-bdc7-ac38fd9faf81", "value": "RedRoman" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "uuid": "ce9b4949-aa84-46fe-a532-2d8b7846d1f5", "value": "MXX" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "uuid": "5553296d-2fe5-490b-bb16-bc2432ede8be", "value": "Exerwa CTF" }, { "description": "ransomware", "meta": { "date": "November 2020", "links": [ "http://3r6n77mpe737w4sbxxxrpc5phbluv6xhtdl5ujpnlvmck5tc7blq2rqd.onion" ], "refs": [ "https://blog.sekoia.io/vice-society-a-discreet-but-steady-double-extortion-ransomware-group", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://soolidsnake.github.io/2021/07/17/hellokitty_linux.html", "https://unit42.paloaltonetworks.com/emerging-ransomware-groups/", "https://www.bleepingcomputer.com/news/security/linux-version-of-hellokitty-ransomware-targets-vmware-esxi-servers/", "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/", "https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire", "https://www.govinfosecurity.com/vice-society-ransomware-gang-disrupted-spar-stores-a-18225", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-exposing-malware-in-linux-based-multi-cloud-environments.pdf", "https://blog.bushidotoken.net/2022/05/gamer-cheater-hacker-spy.html", "https://blog.malwarebytes.com/threat-spotlight/2021/03/hellokitty-when-cyberpunk-met-cy-purr-crime/", "https://blogs.vmware.com/security/2022/09/threat-report-illuminating-volume-shadow-deletion.html", "https://id-ransomware.blogspot.com/2020/11/hellokitty-ransomware.html", "https://labs.sentinelone.com/hellokitty-ransomware-lacks-stealth-but-still-strikes-home/", "https://medium.com/proferosec-osm/static-unpacker-and-decoder-for-hello-kitty-packer-91a3e8844cb7", "https://twitter.com/fwosar/status/1359167108727332868", "https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape", "https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group", "https://www.bleepingcomputer.com/news/security/hellokitty-ransomware-is-targeting-vulnerable-sonicwall-devices/", "https://www.cadosecurity.com/post/punk-kitty-ransom-analysing-hellokitty-ransomware-attacks", "https://www.cisa.gov/uscert/ncas/alerts/aa22-249a", "https://www.crowdstrike.com/blog/new-ransomware-variant-uses-golang-packer/", "https://www.databreaches.net/babuk-re-organizes-as-payload-bin-offers-its-first-leak/", "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html", "https://www.ic3.gov/Media/News/2021/211029.pdf", "https://www.speartip.com/resources/fbi-hellokitty-ransomware-adds-ddos-to-extortion-arsenal/", "https://www.ransomlook.io/group/hellokitty" ], "synonyms": [ "FiveHands" ] }, "uuid": "022c995a-f1ba-498f-b67e-92ef01fd06a3", "value": "HelloKitty" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "uuid": "1496ec2f-76b0-425b-badc-8b7749c7e370", "value": "HolidayCheer" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "uuid": "d4733b99-e1d7-4101-9653-65d8ed73bd47", "value": "Joker Korean" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "uuid": "c0222809-cffa-467b-a9b1-b7caaf238b14", "value": "VenomRAT" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "uuid": "2a2f3d8f-83c1-490b-94d1-b56b90e81d19", "value": "FileEngineering" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "uuid": "77714a96-6242-416a-ba6e-a1080e71cd81", "value": "LandSlide" }, { "description": "ransomware", "meta": { "date": "November 2020" }, "related": [ { "dest-uuid": "681f212a-af1b-4e40-a718-81b0dc46dc52", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "8fa6b51a-a48d-48dc-87ec-cf0d30ad66e8", "value": "Mobef-JustFun" }, { "description": "ransomware", "meta": { "date": "December 2020", "ransomnotes": [ "All your files have been encrypted\n\nContact us to this email to decrypt your files:\nancrypted1@gmail.com\nIn case of of no answer in 24 hours contact the secondary email:\nancrypted1@gmail.com\n\nYou can unlock them by buying the special key generated for you\n\nFree decryption as guarantee\nBefore paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived),and files should not contain valuable information. (databases,backups,large excel sheets, etc.)\n\n\nPayment is possible only with bitcoin\n\nHow to obtain bitcoins\nThe easoway to buy bitcoins is LocalBitcoins site. you have to register, click ?Buy bitcoins?, and select the seller by payment method and price.\nHttps://localbitcoins.com/buy_bitcoins\nAlso you can fund other places to buy Bitcoins and beginners guide here:\nHttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\n\nAttention !!!\n1. Do not rename encrypted files.\n2. Do not try to decrypt your data using third party softwares, it may cause permanent data loss.\n3. Decryption or your files with the help of third parties may cause increased price(they add their fee to ours) or you can become a victim of a scam" ], "refs": [ "https://malware-guide.com/blog/remove-amjixius-ransomware-restore-encrypted-files" ], "synonyms": [ "Ancrypted" ] }, "uuid": "1efe19b7-a8f3-455b-aefc-a41a5788bf2c", "value": "Amjixius" }, { "description": "ransomware", "meta": { "date": "Mars 2021" }, "uuid": "c99e4aee-03f7-4cb6-b1ce-2394d00d1472", "value": "DearCry" }, { "description": "ransomware", "meta": { "date": "Mars 2021" }, "uuid": "0353ecc5-849c-44a1-9ace-bff14e358c7a", "value": "JoJoCrypter" }, { "description": "ransomware", "meta": { "date": "Mars 2021" }, "uuid": "3742b551-b7e8-4256-81fa-137a05693bb8", "value": "RunExeMemory" }, { "description": "ransomware", "meta": { "date": "Febuary 2021" }, "uuid": "b0b690c4-b0d3-4e5e-a855-474f312287dc", "value": "Pay2Decrypt" }, { "description": "ransomware", "meta": { "date": "Febuary 2021" }, "uuid": "c7da6edc-dd6a-4e7b-8ce2-2f97a98f6efb", "value": "Tortoise" }, { "description": "ransomware", "meta": { "date": "Febuary 2021" }, "uuid": "401a8f57-7bf6-4a2a-834c-896bc29aa73f", "value": "EPICALLY" }, { "description": "ransomware", "meta": { "date": "Febuary 2021" }, "uuid": "52a907ab-f38b-4144-ba13-cab33adaab38", "value": "Random30" }, { "description": "ransomware", "meta": { "date": "Febuary 2021" }, "uuid": "419955fb-cfe6-4eba-b2ec-de53f4266e25", "value": "Hog" }, { "description": "ransomware", "meta": { "date": "Febuary 2021" }, "uuid": "f4c25d90-fea1-4bf5-8128-108f4ed279e4", "value": "Steel" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "8a12618d-caf0-4b97-a4d8-fb475820d6f1", "value": "JohnBorn" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "8018e133-c4c9-4a1b-bf39-5007c35c0a54", "value": "Egalyty" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "b7e0a8c9-ffac-416e-8c8e-1670f3b3729f", "value": "Namaste" }, { "description": "ransomware", "meta": { "date": "Febuary 2021" }, "uuid": "570382c4-7b30-4f05-a385-e0691e0abfbc", "value": "HDLocker" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "d2776f0d-29d6-45a2-be76-9072c52ce7cc", "value": "Epsilon" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "34865f14-c5b4-42b8-9cc1-e1325dbe0d23", "value": "DeroHE" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "29a61b85-4c63-46b0-bca0-32525ba1c56b", "value": "Vovalex" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "93e45f39-ee69-4907-b7c7-2eb406313b53", "value": "Bonsoir" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "91381710-823e-4eb6-a52f-28ab163638f3", "value": "PulpFictionQuote" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "8fc25ce2-a5f7-49dc-8480-2a7a2cb60606", "value": "NAS Data Compromiser" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "7f3e44d7-cccb-4fc7-86c6-006d25dc3c5d", "value": "CNH" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "5a7d70c5-c5a2-4f00-be6d-a7499ca350f1", "value": "Lucy" }, { "description": "ransomware", "meta": { "date": "December 2020", "synonyms": [ "OctEncrypt" ] }, "uuid": "e0189c0e-8da9-4e48-9c09-9cb8d8eb2a8b", "value": "OCT" }, { "description": "ransomware", "meta": { "date": "December 2020" }, "uuid": "556f7792-ed79-42cf-9912-865319e10d48", "value": "Pump" }, { "description": "ransomware", "meta": { "date": "December 2020" }, "uuid": "33edc2a9-231d-4a41-8dd8-ea9697dd0e13", "value": "LuciferCrypt" }, { "description": "ransomware", "meta": { "date": "December 2020" }, "uuid": "28ca283a-221f-4e8a-bcc3-feddd67991dc", "value": "Ziggy" }, { "description": "ransomware", "meta": { "date": "December 2020" }, "uuid": "0aed6d0e-6ecc-4295-a5ef-90389f1f00f9", "value": "CoderCrypt" }, { "description": "ransomware", "meta": { "date": "December 2020" }, "uuid": "97ac3893-4331-454f-882f-1dcd9f2c6bcb", "value": "BlueEagle" }, { "description": "ransomware", "meta": { "date": "December 2020" }, "uuid": "e8c800ce-c8e3-4176-87c9-8a0c48a9b5e4", "value": "Povisomware" }, { "description": "Ransomware written in C#. Fortunately, all current versions of the MafiaWare666 ransomware are decryptable. The Threat Lab from Avast has developed a free decryption tool for this malware.", "meta": { "date": "December 2020", "extensions": [ ".jcrypt", ".locked", ".daddycrypt", ".omero", ".ncovid", ".NotStonks", ".crypted", ".iam_watching", ".vn_os", ".wearefriends", ".MALWAREDEVELOPER", ".MALKI", ".poison", ".foxxy", ".ZAHACKED", ".JEBAĆ_BYDGOSZCZ!!!", ".titancrypt", ".crypt", ".MafiaWare666", ".brutusptCrypt", ".bmcrypt", ".cyberone", ".l33ch" ], "payment-method": "Bitcoin", "ransomenotes": [ "All of your files have been encrypted.\nTo unlock them, please send 1 bitcoin(s) to BTC address: 1BtUL5dhVXHwKLqSdhjyjK9Pe64Vc6CEH1 Afterwards,\nI please email your transaction ID to: this.email.address@gmail.com\nThank you and have a nice day! Encryption Log: ..." ], "ransomenotes-refs": [ "https://1.bp.blogspot.com/-OF8CopM3MUw/X-XLjUmRkYI/AAAAAAAAXpY/1mLe136SuT8DuruWJfwIVY5WnVs5B1gcgCLcBGAsYHQ/s943/txt-note.png" ], "ransomnotes-filenames": [ "___RECOVER__FILES__.jcrypt.txt", "_RECOVER__FILES__.jcrypt.txt", "___RECOVER__FILES__.locked.txt", "___RECOVER__FILES__.daddycrypt.txt", "___RECOVER__FILES__.omero.txt", "___RECOVER__FILES__.ncovid.txt", "___RECOVER__FILES__.crypted.txt", "___RECOVER__FILES__.iam_watching.txt", "___RECOVER__FILES__.titancrypt.txt", "_#ODZYSKAJ_PLIKI--.JEBAĆ_BYDGOSZCZ!!!.txt" ], "refs": [ "https://id-ransomware.blogspot.com/2020/12/jcrypt-ransomware.html", "https://twitter.com/kangxiaopao/status/1342027328063295488?lang=en", "https://twitter.com/demonslay335/status/1380610583603638277", "https://decoded.avast.io/threatresearch/decrypted-mafiaware666-ransomware/", "https://files.avast.com/files/decryptor/avast_decryptor_mafiaware666.exe" ], "synonyms": [ "RIP lmao", "Locked", "Daddycrypt", "Omero", "Crypted", "Ncovid", "NotStonks", "Iam_watching", "Vn_os", "Wearefriends", "MALWAREDEVELOPER", "MALKI", "Poison", "Foxxy", "Mafiaware666" ] }, "uuid": "dd5712e1-efa8-4054-a5df-fdfdbc9c25b6", "value": "JCrypt" }, { "description": "ransomware", "meta": { "date": "December 2020" }, "uuid": "9a2ecc67-6462-4d6e-9f18-eacc097ce6c7", "value": "Uh-Oh" }, { "description": "ransomware", "meta": { "date": "December 2020" }, "uuid": "b539d0d8-1dad-4874-b743-e07063f8907e", "value": "Mijnal" }, { "meta": { "date": "December 2020" }, "uuid": "440f9a8e-9837-433a-b2f3-c6a6914146ef", "value": "16x" }, { "description": "ransomware", "meta": { "date": "December 2020" }, "uuid": "ac805a25-0b35-4c3e-82a5-2c8d19a53294", "value": "Lockedv1" }, { "description": "ransomware", "meta": { "date": "JanuaryJ 2021" }, "uuid": "658dbbb2-c596-4ca0-a085-7b41f1fcebd0", "value": "XD Locker" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "c47eb2fa-9fe2-42b8-8339-49e4de7296e2", "value": "Knot" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "390fc4fc-9f46-480a-b114-aba898564c8a", "value": "Parasite" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "9d43444d-205b-4fac-81a8-2affd49b1eb6", "value": "Judge" }, { "description": "ransomware", "meta": { "date": "January 2021" }, "uuid": "f84b92bb-d8e8-4ddd-848c-1a91df504e8e", "value": "DEcovid19" }, { "description": "Ragnarok is is a ransomware that targetscorporate networks in Big Game Huntingtargeted attacks. The ransomware is associated with 'double-extortion' tactic, stealing and publishing files on a data leak site (DLS).", "meta": { "encryption": "AES", "extensions": [ ".ragnarok", ".ragnarok_cry" ], "links": [ "http://wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion", "http://sushlnty2j7qdzy64qnvyb6ajkwg7resd3p6agc2widnawodtcedgjid.onion/" ], "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnaro", "https://borncity.com/win/2021/03/27/tu-darmstadt-opfer-der-ragnarok-ransomware/", "https://techcrunch.com/2021/08/30/ragnarok-ransomware-gang-shuts-down-and-releases-its-decryption-key", "https://www.cpomagazine.com/cyber-security/ragnarok-ransomware-gang-closes-up-shop-leaves-master-decryptor-key-behind", "https://www.sababasecurity.com/cheese-shortage-in-dutch-supermarkets-after-a-ransomware-attack", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://github.com/k-vitali/Malware-Misc-RE/blob/master/2020-01-26-ragnarok-cfg-vk.notes.raw", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf", "https://news.sophos.com/en-us/2020/05/21/asnarok2/", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://www.bleepingcomputer.com/news/security/ragnarok-ransomware-releases-master-decryptor-after-shutdown/", "https://www.bleepingcomputer.com/news/security/ragnarok-ransomware-targets-citrix-adc-disables-windows-defender/", "https://www.ransomlook.io/group/ragnarok" ] }, "uuid": "fe7e4df0-97b9-4dd2-b3f8-79404fc8272d", "value": "Ragnarok" }, { "description": "Destructive malware deployed against targets in Ukraine in January 2022.", "meta": { "date": "January 2022", "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.whispergate", "https://www.cadosecurity.com/resources-for-dfir-professionals-responding-to-whispergate-malware/", "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/" ] }, "uuid": "feb5fa26-bad4-46da-921d-986d2fd81a40", "value": "WhisperGate" }, { "description": "BlackCat (ALPHV) is ransomware written in Rust. The ransomware makes heavy use of plaintext JSON configuration files to specify the ransomware functionality. BlackCat has many advanced capabilities like escalating privileges and bypassing UAC make use of AES and ChaCha20 or Salsa encryption, may use the Restart Manager, can delete volume shadow copies, can enumerate disk volumes and network shares automatically, and may kill specific processes and services. The ransomware exists for both Windows, Linux, and ESXi systems. Multiple extortion techniques are used by the BlackCat gang, such as exfiltrating victim data before the ransomware deployment, threats to release data if the ransomw is not paid, and distributed denial-of-service (DDoS) attacks.", "meta": { "date": "June 2021", "encryption": "AES", "links": [ "http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion", "http://2cuqgeerjdba2rhdiviezodpu3lc4qz2sjf4qin6f7std2evleqlzjid.onion", "http://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion/api/blog/all/0/6", "http://vqifktlreqpudvulhbzmc5gocbeawl67uvs2pttswemdorbnhaddohyd.onion/", "http://alphvuzxyxv6ylumd2ngp46xzq3pw6zflomrghvxeuks6kklberrbmyd.onion" ], "ransomnotes-refs": [ "https://unit42.paloaltonetworks.com/wp-content/uploads/2022/01/word-image-78.png" ], "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcat", "https://1-id--ransomware-blogspot-com.translate.goog/2021/12/blackcat-ransomware.html?_x_tr_enc=1&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=ru", "https://medium.com/s2wblog/blackcat-new-rust-based-ransomware-borrowing-blackmatters-configuration-31c8d330a809", "https://github.com/f0wl/blackCatConf", "https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/", "https://www.varonis.com/blog/alphv-blackcat-ransomware", "https://www.intrinsec.com/alphv-ransomware-gang-analysis", "https://unit42.paloaltonetworks.com/blackcat-ransomware/", "https://www.cyber.gov.au/acsc/view-all-content/advisories/2022-004-acsc-ransomware-profile-alphv-aka-blackcat", "https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/", "https://blog.emsisoft.com/en/40931/ransomware-profile-alphv/", "https://blog.group-ib.com/blackcat", "https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://killingthebear.jorgetesta.tech/actors/alphv", "https://krebsonsecurity.com/2022/01/who-wrote-the-alphv-blackcat-ransomware-strain/", "https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/", "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v", "https://securelist.com/a-bad-luck-blackcat/106254/", "https://securelist.com/new-ransomware-trends-in-2022/106457/", "https://securityscorecard.com/research/the-increase-in-ransomware-attacks-on-local-governments", "https://thehackernews.com/2022/04/researchers-connect-blackcat-ransomware.html", "https://twitter.com/sisoma2/status/1473243875158499330", "https://www.advintel.io/post/blackcat-in-a-shifting-threat-landscape-it-helps-to-land-on-your-feet-tech-dive", "https://www.bleepingcomputer.com/news/security/hive-ransomware-ports-its-linux-vmware-esxi-encryptor-to-rust/", "https://www.forescout.com/resources/analysis-of-an-alphv-incident", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.theregister.com/2022/03/22/talos-ransomware-blackcat/", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/blackcat-ransomware-as-a-service.html", "https://www.zdnet.com/article/blackcat-ransomware-implicated-in-attack-on-german-oil-companies/", "https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf", "https://documents.trendmicro.com/assets/pdf/datasheet-ransomware-in-Q1-2022.pdf", "https://go.kaspersky.com/rs/802-IJN-240/images/TR_BlackCat_Report.pdf", "https://id-ransomware.blogspot.com/2021/12/blackcat-ransomware.html", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf", "https://securelist.com/modern-ransomware-groups-ttps/106824/", "https://securityscorecard.com/blog/ttps-associated-with-new-version-of-blackcat-ransomware", "https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-alphv-rust-ransomware", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-ransomware-ttps", "https://therecord.media/german-wind-farm-operator-confirms-cybersecurity-incident-after-ransomware-group/", "https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape", "https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group", "https://www.crowdstrike.com/blog/falcon-overwatch-contributes-to-blackcat-protection/", "https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware", "https://www.ic3.gov/Media/News/2022/220420.pdf", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/", "https://www.microsoft.com/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/", "https://www.sentinelone.com/labs/crimeware-trends-ransomware-developers-turn-to-intermittent-encryption-to-evade-detection/", "https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf", "https://www.trendmicro.com/en_us/research/22/d/an-investigation-of-the-blackcat-ransomware.html", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-by-the-numbers/lockbit-conti-and-blackcat-lead-pack-amid-rise-in-active-raas-and-extortion-groups-ransomware-in-q1-2022", "https://www.ransomlook.io/group/alphv" ], "synonyms": [ "ALPHV", "Noberus" ] }, "related": [ { "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "2acf44aa-542f-4366-b4eb-55ef5747759c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "0a5231ec-41af-4a35-83d0-6bdf11f28c65", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "4cbc6a62-9e34-4f94-8a19-5c1a11392a49", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "40597f16-0963-4249-bf4c-ac93b7fb9807", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "d74c4a7e-ffbf-432f-9365-7ebf1f787cab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" }, { "dest-uuid": "d74c4a7e-ffbf-432f-9365-7ebf1f787cab", "tags": [ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" } ], "uuid": "e6c09b63-a424-4d9e-b7f7-b752cbbca02a", "value": "BlackCat" }, { "description": "Ransomware", "meta": { "links": [ "http://mountnewsokhwilx.onion" ], "refs": [ "https://www.cyclonis.com/mount-locker-ransomware-more-dangerous", "https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-joins-the-multi-million-dollar-ransom-game", "https://www.securitymagazine.com/articles/94954-sophos-identifies-connection-between-mount-locker-and-astro-locker-team-ransomware", "https://www.ransomlook.io/group/mount-locker" ], "synonyms": [ "Mount-Locker" ] }, "uuid": "1da28691-684a-4cd2-b2f8-e80a123e150c", "value": "Mount Locker" }, { "description": "Ransomware", "meta": { "refs": [ "https://threatpost.com/mount-locker-ransomware-changes-tactics/165559/", "https://news.sophos.com/en-us/2021/03/31/sophos-mtr-in-real-time-what-is-astro-locker-team/" ] }, "uuid": "9932a2e9-08e3-4594-ac95-78de246de811", "value": "Astro Locker" }, { "description": "Ransomware", "meta": { "links": [ "http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion/" ], "refs": [ "https://twitter.com/malwrhunterteam/status/1501857263493001217", "https://dissectingmalwa.re/blog/pandora", "https://blog.cyble.com/2022/03/15/deep-dive-analysis-pandora-ransomware/", "https://cloudsek.com/technical-analysis-of-emerging-sophisticated-pandora-ransomware-group/", "https://dissectingmalwa.re/blog/pandora/", "https://kienmanowar.wordpress.com/2022/03/21/quicknote-analysis-of-pandora-ransomware/", "https://www.fortinet.com/blog/threat-research/Using-emulation-against-anti-reverse-engineering-techniques", "https://www.fortinet.com/blog/threat-research/looking-inside-pandoras-box", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/", "https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader", "https://www.ransomlook.io/group/pandora" ] }, "uuid": "4d37a857-fef2-496d-9992-49f6da11e3cb", "value": "Pandora" }, { "description": "Ransomware", "meta": { "links": [ "http://gamol6n6p2p4c3ad7gxmx3ur7wwdwlywebo2azv3vv5qlmjmole2zbyd.onion" ], "refs": [ "https://www.sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk", "https://twitter.com/techyteachme/status/1464317136944435209", "https://blog.cyble.com/2022/03/15/deep-dive-analysis-pandora-ransomware/", "https://chuongdong.com/reverse%20engineering/2022/01/06/RookRansomware/", "https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit/NightSky_Ransomware%E2%80%93just_a_Rook_RW_fork_in_VMProtect_suit.md", "https://seguranca-informatica.pt/rook-ransomware-analysis/", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/", "https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader", "https://www.sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk/", "https://www.ransomlook.io/group/rook" ] }, "uuid": "bb6d933f-7b6d-4694-853d-1ca400f6bd8f", "value": "Rook" }, { "description": "HelloXD is a ransomware family performing double extortion attacks that surfaced in November 2021. During our research we observed multiple variants impacting Windows and Linux systems. Unlike other ransomware groups, this ransomware family doesn’t have an active leak site; instead it prefers to direct the impacted victim to negotiations through TOX chat and onion-based messenger instances.", "meta": { "date": "Nov. 30, 2021", "extensions": [ "hello" ], "ransomnotes-filenames": [ "Hello.txt" ], "ransomnotes-refs": [ "https://unit42.paloaltonetworks.com/wp-content/uploads/2022/06/image13.png" ], "refs": [ "https://unit42.paloaltonetworks.com/helloxd-ransomware/" ] }, "uuid": "5617e6fa-4e6a-4011-9385-6b1165786563", "value": "HelloXD" }, { "description": "Maui ransomware stand out because of a lack of several key features commonly seen with tooling from RaaS providers, such as an embedded ransom note to provide recovery instructions or automated means of transmitting encryption keys to attackers. Instead, it is believed that Maui is manually operated, in which operators will specify which files to encrypt when executing it and then exfiltrate the resulting runtime artifacts. There are many aspects to Maui ransomware that are unknown, including usage context.", "meta": { "refs": [ "https://stairwell.com/wp-content/uploads/2022/07/Stairwell-Threat-Report-Maui-Ransomware.pdf", "https://www.cisa.gov/uscert/ncas/alerts/aa22-187a" ] }, "uuid": "995c3772-dbda-4a2a-9e28-c47740d599a3", "value": "Maui ransomware" }, { "description": "Lorenz is a ransomware group that has been active since at least February 2021 and like many ransomware groups, performs double-extortion by exfiltrating data before encrypting systems.", "meta": { "links": [ "http://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion/" ], "ransomnotes-refs": [ "https://marvel-b1-cdn.bc0a.com/f00000000241276/arcticwolf.com/wp-content/uploads/2022/09/Screen-Shot-2022-09-12-at-11.18.04-AM-1024x246.png" ], "refs": [ "https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/" ] }, "uuid": "d513199e-7f21-43fd-9610-ed708c3f6409", "value": "Lorenz Ransomware" }, { "description": "First observed in June 2021, Hive ransomware was originally written in GoLang but recently, new Hive variants have been seen written in Rust. Targets Healthcare sector.", "meta": { "links": [ "http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/", "http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion", "http://hiveapi4nyabjdfz2hxdsr7otrcv6zq6m4rk5i2w7j64lrtny4b7vjad.onion/v1/companies/disclosed" ], "ransomnotes": [ "Your network has been breached and all data were encrypted.\nPersonal data, financial reports and important documents are ready to disclose.\n\n To decrypt all the data and to prevent exfiltrated files to be disclosed at \nhttp://hive[REDACTED].onion/\nyou will need to purchase our decryption software.\n \nPlease contact our sales department at:v \n http://hive[REDACTED].onion/\n \n Login: [REDACTED]\n Password: [REDACTED]\n \nTo get an access to .onion websites download and install Tor Browser at:\n https://www.torproject.org/ (Tor Browser is not related to us)\n \n \nFollow the guidelines below to avoid losing your data:\n \n- Do not modify, rename or delete *.key.abc12 files. Your data will be \n undecryptable.\n- Do not modify or rename encrypted files. You will lose them.\n- Do not report to the Police, FBI, etc. They don't care about your business.\n They simply won't allow you to pay. As a result you will lose everything.\n- Do not hire a recovery company. They can't decrypt without the key. \n They also don't care about your business. They believe that they are \n good negotiators, but it is not. They usually fail. So speak for yourself.\n- Do not reject to purchase. Exfiltrated files will be publicly disclosed.", "Your network has been breached and all data were encrypted.\nPersonal data, financial reports and important documents are ready to disclose.\n\n To decrypt all the data and to prevent exfiltrated files to be disclosed at \nhttp://hive[REDACTED].onion/\nyou will need to purchase our decryption software.\n \nPlease contact our sales department at:\n \n http://hive[REDACTED].onion/\n \n Login: test_hive_username\n Password: test_hive_password\n \nTo get an access to .onion websites download and install Tor Browser at:\n https://www.torproject.org/ (Tor Browser is not related to us)\n \n \nFollow the guidelines below to avoid losing your data:\n \n- Do not delete or reinstall VMs. There will be nothing to decrypt.\n- Do not modify, rename or delete *.key files. Your data will be \n undecryptable.\n- Do not modify or rename encrypted files. You will lose them.\n- Do not report to the Police, FBI, etc. They don't care about your business.\n They simply won't allow you to pay. As a result you will lose everything.\n- Do not hire a recovery company. They can't decrypt without the key. \n They also don't care about your business. They believe that they are \n good negotiators, but it is not. They usually fail. So speak for yourself.\n- Do not reject to purchase. Exfiltrated files will be publicly disclosed" ], "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.hive", "https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/787/original/ransomware-chats.pdf", "https://www.sentinelone.com/labs/hive-attacks-analysis-of-the-human-operated-ransomware-targeting-healthcare/", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-hive", "https://www.microsoft.com/en-us/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust/", "https://yoroi.company/wp-content/uploads/2022/07/Yoroi-On-The-Footsteps-of-Hive-Ransomware.pdf", "https://www.varonis.com/blog/hive-ransomware-analysis", "https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/", "https://inf.news/en/tech/c28d9382ab78a5ac3d8fc802f3f0f1e0.html", "https://www.healthcareitnews.com/news/fbi-issues-alert-about-hive-ransomware", "https://arxiv.org/pdf/2202.08477.pdf", "https://blog.group-ib.com/hive", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://github.com/rivitna/Malware/tree/main/Hive", "https://lifars.com/2022/02/how-to-decrypt-the-files-encrypted-by-the-hive-ransomware/", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf", "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v", "https://securityaffairs.co/wordpress/128232/security/recover-files-hive-ransomware.html", "https://thehackernews.com/2022/02/master-key-for-hive-ransomware.html", "https://therecord.media/academics-publish-method-for-recovering-data-encrypted-by-the-hive-ransomware/", "https://therecord.media/hive-ransomware-shuts-down-california-health-care-organization/", "https://twitter.com/ESETresearch/status/1454100591261667329", "https://twitter.com/malwrhunterteam/status/1455628865229950979", "https://www.bleepingcomputer.com/news/security/hive-ransomware-ports-its-linux-vmware-esxi-encryptor-to-rust/", "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-april-1st-2022-i-can-fight-with-a-keyboard/", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.threatstop.com/blog/first-conti-then-hive-costa-rica-gets-hit-with-ransomware-again", "https://yoroi.company/research/on-the-footsteps-of-hive-ransomware/", "https://blog.talosintelligence.com/2022/05/conti-and-hive-ransomware-operations.html", "https://labs.sentinelone.com/hive-attacks-analysis-of-the-human-operated-ransomware-targeting-healthcare/", "https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/787/original/ransomware-chats.pdf?1651576098", "https://securelist.com/modern-ransomware-groups-ttps/106824/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker", "https://unit42.paloaltonetworks.com/emerging-ransomware-groups/", "https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape", "https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group", "https://www.bleepingcomputer.com/news/security/hive-ransomware-uses-new-ipfuscation-trick-to-hide-payload/", "https://www.connectwise.com/resources/hive-profile", "https://www.ic3.gov/Media/News/2021/210825.pdf", "https://www.incibe-cert.es/sites/default/files/contenidos/estudios/doc/incibe-cert_estudio_analisis_hive_2021_v1.pdf", "https://www.microsoft.com/security/blog/2022/07/05/hive-ransomware-gets-upgrades-in-rust/", "https://www.netskope.com/blog/hive-ransomware-actively-targeting-hospitals", "https://www.scmagazine.com/brief/breach/novel-obfuscation-leveraged-by-hive-ransomware", "https://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/", "https://www.sentinelone.com/labs/nokoyawa-ransomware-new-karma-nemty-variant-wears-thin-disguise/", "https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf", "https://www.ransomlook.io/group/hive" ] }, "uuid": "8ce915d3-8c6d-4841-b509-18379d7a8999", "value": "Hive" }, { "description": "", "meta": { "links": [ "http://quantum445bh3gzuyilxdzs5xdepf3b7lkcupswvkryf3n7hgzpxebid.onion/", "http://quantum445bh3gzuyilxdzs5xdepf3b7lkcupswvkryf3n7hgzpxebid.onion" ], "ransomnotes-refs": [ "https://www.guidepointsecurity.com/wp-content/uploads/2021/04/Anonymized-Ransom-Note-1-1024x655.png" ], "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.mount_locker", "https://securityscorecard.pathfactory.com/research/quantum-ransomware", "https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-joins-the-multi-million-dollar-ransom-game/", "https://www.bleepingcomputer.com/news/security/mount-locker-ransomware-now-targets-your-turbotax-tax-returns/", "https://dissectingmalwa.re/between-a-rock-and-a-hard-place-exploring-mount-locker-ransomware.html", "https://blogs.blackberry.com/en/2020/12/mountlocker-ransomware-as-a-service-offers-double-extortion-capabilities-to-affiliates", "https://github.com/Finch4/Malware-Analysis-Reports/tree/master/MountLocker", "https://chuongdong.com/reverse%20engineering/2021/05/23/MountLockerRansomware/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-virtual-machines", "https://kienmanowar.wordpress.com/2021/08/04/quicknote-mountlocker-some-pseudo-code-snippets/", "https://www.cybereason.com/blog/cybereason-vs.-quantum-locker-ransomware", "https://thedfirreport.com/2022/04/25/quantum-ransomware/", "https://www.ransomlook.io/group/quantum" ], "synonyms": [ "Quantum", "Mount Locker", "DagonLocker" ] }, "related": [ { "dest-uuid": "7513650c-ba09-49bf-b011-d2974c7ae023", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "201eff54-d41e-4f70-916c-5dfb9301730a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "successor-of" } ], "uuid": "0ca6ac54-ad2b-4945-9580-ac90e702fd2c", "value": "QuantumLocker" }, { "description": "Black Basta is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.", "meta": { "extensions": [ ".basta" ], "links": [ "https://stniiomyjliimcgkvdszvgen3eaaoz55hreqqx6o77yvmpwt7gklffqd.onion/", "https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion", "http://stniiomyjliimcgkvdszvgen3eaaoz55hreqqx6o77yvmpwt7gklffqd.onion/" ], "ransomnotes": [ "Your data are stolen and encrypted\nThe data will be published on TOR website if you do not pay the ransom\nYou can contact us and decrypt one file for free on this TOR site (you should download and install TOR browser first https://torproject.org) https://aazsbsgya565y1u2c6Lay6yfiebkcbtvvcytyolt33s77xypi7nypxyd.onion/ \n\nYour company id for log in: [REDACTED]" ], "ransomnotes-filenames": [ "readme.txt" ], "ransomnotes-refs": [ "https://www.bleepstatic.com/images/news/ransomware/b/black-basta/wallpaper.jpg", "https://www.bleepstatic.com/images/news/ransomware/b/black-basta/ransom-note.jpg", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/e/examining-the-black-basta-ransomwares-infection-routine/blackbasta07PII.PNG", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/e/examining-the-black-basta-ransomwares-infection-routine/blackbasta08PII.PNG" ], "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta", "https://www.bleepingcomputer.com/news/security/american-dental-association-hit-by-new-black-basta-ransomware/", "https://www.bleepingcomputer.com/news/security/new-black-basta-ransomware-springs-into-action-with-a-dozen-breaches/", "https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html", "https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape", "https://securityintelligence.com/posts/black-basta-ransomware-group-besting-network/", "https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware", "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/", "https://gbhackers.com/black-basta-ransomware/", "https://www.trendmicro.com/en_us/research/22/f/black-basta-ransomware-operators-expand-their-attack-arsenal-wit.html", "https://securelist.com/luna-black-basta-ransomware/106950/", "https://securityscorecard.com/research/a-deep-dive-into-black-basta-ransomware", "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbasta", "https://www.sentinelone.com/labs/crimeware-trends-ransomware-developers-turn-to-intermittent-encryption-to-evade-detection/", "https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/", "https://www.cynet.com/blog/orion-threat-alert-qakbot-ttps-arsenal-and-the-black-basta-ransomware/", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://www.ransomlook.io/group/blackbasta" ] }, "related": [ { "dest-uuid": "201eff54-d41e-4f70-916c-5dfb9301730a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "successor-of" }, { "dest-uuid": "421a3805-7741-4315-82c2-6c9aa30d0953", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "uses" } ], "uuid": "9db5f425-fe49-4137-8598-840e7290ed0f", "value": "BlackBasta" }, { "description": "BlackByte is recently discovered Ransomware with a .NET DLL core payload wrapped in JavaScript. It employs heavy obfuscation both in its JavaScript wrapper and .NET DLL core.\n\nOnce the JavaScript wrapper is executed, the malware will de-obfuscate the core payload and execute it in memory. The core .DLL is loaded and BlackByte will check the installed operating system language and terminate if an eastern European language is found.\n\nIt will proceed to check for the presence of several anti-virus and sandbox-related .DLLs, attempt to bypass AMSI, delete system shadow-copies in order to hinder system recovery, and modify several other system services (including Windows Firewall) in order to “prep” the system for encryption. Once the system is “ready” for encryption, it will download a symmetric key-file which will be used to encrypt files on the system. If this file is not found, the malware will terminate.\n\nUnlike most Ransomware today, BlackByte uses a single symmetric encryption key, and does not generate a unique encryption key for each victim system, meaning the same key can be used to decrypt all files encrypted by the malware.\n\nThis makes for substantially easier key-management for the actors behind BlackByte at the cost of a weaker encryption scheme and easier victim system recovery (as there is only a single online point with a single key to maintain).\n\nAs with most Ransomware today, BlackByte has worming capabilities and can infect additional endpoints on the same network.", "meta": { "links": [ "http://6iaj3efye3q62xjgfxyegrufhewxew7yt4scxjd45tlfafyja6q4ctqd.onion", "http://f5uzduboq4fa2xkjloprmctk7ve3dm46ff7aniis66cbekakvksxgeqd.onion", "http://dlyo7r3n4qy5fzv4645nddjwarj7wjdd6wzckomcyc7akskkxp4glcad.onion", "http://fl3xpz5bmgzxy4fmebhgsbycgnz24uosp3u4g33oiln627qq3gyw37ad.onion", "http://jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion/", "http://53d5skw4ypzku4bfq2tk2mr3xh5yqrzss25sooiubmjz67lb3gdivcad.onion/" ], "ransomnotes": [ "BLACKBYTE \n\nAll your files have been encrypted, your confidential data has been stolen, in order to decrypt files and avoid leakage, you must follow our steps.\n\n1) Download and install TOR browser from this site: https://torproject.org/ \n\n2) Paste the URL in TOR browser and you will be redirected to our chat with all information that you need. \n\n3) If you won't contact with us within 4 days, your access to our chat will be removed and you wont be able to restore your system. \n\nYour URL: [LINK]\n\nYour Key: [KEY]", "BLACKBYTE\n\nAll your files have been encrypted, your confidential data has been stolen, \nin order to decrypt files and avoid leakage, you must follow our steps.\n\n\n\n1) Download and install TOR Browser from this site: https://torproject.org/\n\n2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need.\n\n3) If you do not contact us within 3 days, your chat access key won't be valid.\nAlso, your company will be posted on our blog, darknet and hacker forums,\nwhich will attract unnecessary attention from Journalists and not only them.\nYou are given 3 days to think over the situation, and take reasonable actions on your part.\n\n\nWarning! Connurtcation with us occurs only through this link, or through our mail on our blog.\nWe also strongly DO NOT recommend using third-party tools to decrypt files,\nas this will simply kill them completely without the possibility of recovery.\nI repeat, in this case, no one can help you!\n\n\n\nYour URL: [LINK]\n\nYour Key to access the chat: [PASSW]\n\nFind our blog here (TOR Browser): http://dlyo7r3n4qy5fzv4645nddjwarj7wjdd6wzckomcyc7akskkxp4glcad.onion/" ], "ransomnotes-refs": [ "https://lh5.googleusercontent.com/sw0iG6WGVHRRM7NQsTjmt1ut60TH-_VPe1Fo57XuYeBOMw9PrvI4lCqyCPueiEXvbAZ-ks3KHXmnS81JvGYaMf31tSL1Eejx-BZ973EctAqjb-u3R6k-9UC0GqhkLQxgMC6lqtp7", "https://lh5.googleusercontent.com/sw0iG6WGVHRRM7NQsTjmt1ut60TH-_VPe1Fo57XuYeBOMw9PrvI4lCqyCPueiEXvbAZ-ks3KHXmnS81JvGYaMf31tSL1Eejx-BZ973EctAqjb-u3R6k-9UC0GqhkLQxgMC6lqtp7" ], "refs": [ "https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape", "https://redcanary.com/blog/blackbyte-ransomware/", "https://www.ic3.gov/Media/News/2022/220211.pdf", "https://therecord.media/san-francisco-49ers-confirm-ransomware-attack/", "https://www.bleepingcomputer.com/news/security/fbi-blackbyte-ransomware-breached-us-critical-infrastructure/", "https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure", "https://www.trellix.com/en-us/about/newsroom/stories/research/trellix-global-defenders-analysis-and-protections-for-blackbyte-ransomware.html", "https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group", "https://www.zscaler.com/blogs/security-research/analysis-blackbyte-ransomwares-go-based-variants", "https://www.advintel.io/post/hydra-with-three-heads-blackbyte-the-future-of-ransomware-subsidiary-groups", "https://blog.talosintelligence.com/the-blackbyte-ransomware-group-is/", "https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape", "https://securelist.com/modern-ransomware-groups-ttps/106824/", "https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/", "https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/", "https://blog.talosintelligence.com/2022/05/the-blackbyte-ransomware-group-is.html", "https://de.darktrace.com/blog/detecting-the-unknown-revealing-uncategorised-ransomware-using-darktrace", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf", "https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-hive-ransomware/", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/trellix-global-defenders-analysis-and-protections-for-blackbyte-ransomware.html", "https://www.trendmicro.com/vinfo/my/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte", "https://www.ransomlook.io/group/blackbyte" ] }, "related": [ { "dest-uuid": "201eff54-d41e-4f70-916c-5dfb9301730a", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "successor-of" } ], "uuid": "1c43524e-0f2e-4468-b6b6-8a37f1d0ea87", "value": "BlackByte" }, { "description": "Ransomware", "meta": { "links": [ "http://blog2hkbm6gogpv2b3uytzi3bj5d5zmc4asbybumjkhuqhas355janyd.onion/" ], "refs": [ "https://www.ransomlook.io/group/redalert" ] }, "uuid": "549c9766-b45d-4d14-86e8-e6a74d69d067", "value": "RedAlert" }, { "description": "Ransomware", "uuid": "00638cb0-d8c5-46c2-9c57-39d93d5bfa36", "value": "Cheerscrypt" }, { "description": "Ransomware", "uuid": "b4d24c48-c2f7-4ae7-a708-8b321b98075a", "value": "GwisinLocker" }, { "description": "Ransomware", "uuid": "2950977b-59bb-464a-8dd8-21728887f72f", "value": "Luna Ransomware" }, { "description": "In March 2022, the FBI and the U.S. Treasury Financial Crimes Enforcement Network released a joint advisory addressing AvosLocker and their activity targeting organizations across several critical infrastructure sectors. The RaaS gang deploys ransomware onto their victim’s networks and systems, then threatens to leak their files on the dark web if they don’t pay up. AvosLocker is both the name of the RaaS gang, as well as the name of the ransomware itself.\n\nIn May 2022, AvosLocker took responsibility for attacking and stealing data from the Texas-based healthcare organization, CHRISTUS Health. CHRISTUS Health runs hundreds of healthcare facilities across Mexico, the U.S., and South America. The group stole information from a cancer patient registry which included names, social security numbers, diagnoses, dates of birth, and other medical information. The nonprofit Catholic health system has more than 600 healthcare facilities in Texas, Louisiana, New Mexico, and Arkansas. There are also facilities in Columbia, Mexico, and Chile.\n\nFortunately, the ransomware attack was quickly identified and was limited. While other healthcare organizations have not been as fortunate with ransomware attacks, the AvosLocker attack didn’t impact CHRISTUS Health’s patient care or clinical operations. CHRISTUS Health didn’t reveal whether or not the security incident included ransomware, data exfiltration or extortion, but due to AvosLocker’s reputation, it is more than likely that the incident included at least one of the three.", "meta": { "links": [ "http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion/", "http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion", "http://avos2fuj6olp6x36.onion" ], "ransomnotes": [ "AvosLocker\n\nAttention!\nYour systems have been encrypted, and your confidential documents were downloaded.\nIn order to restore your data, you must pay for the decryption key & application.\nYou may do so by visiting us at http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion.\nThis is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/\nDetails such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website.\nContact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly.\nThe corporations whom don't pay or fail to respond in a swift manner have their data leaked in our blog, accessible at http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion" ], "ransomnotes-filenames": [ "GET_YOUR_FILES_BACK.TXT" ], "ransomnotes-refs": [ "https://blog.talosintelligence.com/content/images/AVvXsEhKEpexiVYKoELvESd2mP0ZXLbQYgWcVJaE5VB9--yD3vS6FTVNfNbPkAHtJp3KjN1ANKVLa4zWvuEFN68QaepAj_xF3j9TrzqUMoOwvQXx_zIOH9Ar31JgWYX4mlpUIPLaLi76aWawvifF56qKZ1mgXncCRwAmu_fjqmD_PTWu_84E_uTqnW2qZIPM/s16000/image4.png" ], "refs": [ "https://www.avertium.com/resources/threat-reports/in-depth-look-at-avoslocker-ransomware", "https://unit42.paloaltonetworks.com/atoms/avoslocker-ransomware/", "https://www.kroll.com/en/insights/publications/cyber/avoslocker-ransomware-update", "https://www.picussecurity.com/resource/avos-locker-ransomware-group", "https://brandefense.io/blog/ransomware/in-depth-analysis-of-avoslocker-ransomware/", "https://blog.talosintelligence.com/avoslocker-new-arsenal/", "https://www.techrepublic.com/article/avos-ransomware-updates-attack/", "https://www.tripwire.com/state-of-security/avoslocker-ransomware-what-you-need-to-know", "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-avoslocker", "https://malpedia.caad.fkie.fraunhofer.de/details/elf.avoslocker", "https://malpedia.caad.fkie.fraunhofer.de/details/win.avos_locker", "https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html", "https://blogs.blackberry.com/en/2022/04/threat-thursday-avoslocker-prompts-advisory-from-fbi-and-fincen", "https://www.ic3.gov/Media/News/2022/220318.pdf", "https://blog.qualys.com/vulnerabilities-threat-research/2022/03/06/avoslocker-ransomware-behavior-examined-on-windows-linux", "https://blog.lexfo.fr/Avoslocker.html", "https://blogs.vmware.com/security/2022/02/avoslocker-modern-linux-ransomware-threats.html", "https://blog.cyble.com/2022/01/17/avoslocker-ransomware-linux-version-targets-vmware-esxi-servers/", "https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners", "https://unit42.paloaltonetworks.com/emerging-ransomware-groups/", "https://news.sophos.com/en-us/2021/12/22/avos-locker-remotely-accesses-boxes-even-running-in-safe-mode/", "https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker", "https://cdn.pathfactory.com/assets/10555/contents/400686/13f4424c-05b4-46db-bb9c-6bf9b5436ec4.pdf", "https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html", "https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape", "https://blog.cyble.com/2021/07/23/deep-dive-analysis-avoslocker-ransomware", "https://blog.malwarebytes.com/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners", "https://blog.malwarebytes.com/threat-analysis/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners/", "https://blog.talosintelligence.com/2022/06/avoslocker-new-arsenal.html", "https://www.ransomlook.io/group/avoslocker", "https://www.ransomlook.io/group/avos" ], "synonyms": [ "Avos" ] }, "uuid": "73d3d8f8-83cc-4fdc-a645-d03b9a7b5a9b", "value": "AvosLocker" }, { "description": "Ransomware", "meta": { "links": [ "http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion", "http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion" ] }, "uuid": "fec32bbf-c4f8-499d-8e2a-743bcdd071e7", "value": "PLAY Ransomware" }, { "description": "Ransomware", "uuid": "1d8cadb9-501c-493e-b89b-b5574ed3f722", "value": "Qyick Ransomware" }, { "description": "Ransomware", "uuid": "9796a1a4-b2d7-4e68-bfb4-57093fd32fef", "value": "Agenda Ransomware" }, { "description": "Ransomware", "meta": { "links": [ "https://3f7nxkjway3d223j27lyad7v5cgmyaifesycvmwq7i7cbs23lb6llryd.onion/", "https://www.karanews.live", "https://karakurt.tech", "https://karaleaks.com" ], "refs": [ "https://www.ransomlook.io/group/karakurt" ] }, "uuid": "a7623a1b-4551-4e5a-a622-2b91dea16b42", "value": "Karakurt" }, { "description": "0mega, a new ransomware operation, has been observed targeting organizations around the world. The ransomware operators are launching double-extortion attacks and demanding millions of dollars as ransom.\n\n0mega ransomware operation launched in May and has already claimed multiple victims.\n0mega maintains a dedicated data leak site that the attackers use to post stolen data if the demanded ransom is not paid.\nThe leak site currently hosts 152 GB of data stolen from an electronics repair firm in an attack that happened in May.\nHowever, an additional victim has since been removed, implying that they might have paid the ransom to the 0mega group.\n\nHow does it work?\nHackers add the .0mega extension to the encrypted file’s names and create ransom notes (DECRYPT-FILES[.]txt).\nThe ransom note has a link to a Tor payment negotiation site with a support chat to reach out to the ransomware group.\nTo log in to this site, the victims are asked to upload their ransom notes with a unique Base64-encoded blob identity.", "meta": { "extensions": [ ".0mega " ], "links": [ "http://omegalock5zxwbhswbisc42o2q2i54vdulyvtqqbudqousisjgc7j7yd.onion/", "https://0mega.cc/" ], "ransomnotes-filenames": [ "DECRYPT-FILES.txt" ], "refs": [ "https://www.bleepingcomputer.com/news/security/new-0mega-ransomware-targets-businesses-in-double-extortion-attacks/", "https://cyware.com/news/new-0mega-ransomware-joins-the-double-extortion-threat-landscape-158fb321", "https://www.ransomlook.io/group/0mega" ] }, "uuid": "91a085dc-9667-4dcd-9434-8cbb53e592fe", "value": "0Mega" }, { "description": "Abraham's Ax announced their existence and mission through social media channels such as Twitter posts on November 8, 2022.\nAbraham's Ax use a WordPress blog as the basis for their leak sites. Abraham's Ax site is available in Hebrew, Farsi, and English. The site also provides versions available via Tor websites, although it appeared to be under construction at the time of analysis. Used domain is registered with EgenSajt.se", "meta": { "links": [ " http://abrahamm32umasogaqojib3ey2w2nwoafffrguq43tsyke4s3fz3w4yd.onion/ ", "http://abrahamm32umasogaqojib3ey2w2nwoafffrguq43tsyke4s3fz3w4yd.onion/" ], "refs": [ "https://www.secureworks.com/blog/abrahams-ax-likely-linked-to-moses-staff", "https://www.ransomlook.io/group/abrahams_ax" ], "synonyms": [ "Abrahams_Ax" ] }, "uuid": "72892710-57ef-4bbb-8b80-752e036797f3", "value": "Abraham's Ax" }, { "description": "Ransomware", "meta": { "links": [ "http://hitlerransomware[.]000webhostapp[.]com/", "http://hitleransomware[.]cf/", "http://hitleransomware.cf" ], "refs": [ "https://raw.githubusercontent.com/stamparm/maltrail/master/trails/static/malware/hitler_ransomware.txt", "https://twitter.com/fr0s7_/status/1460229982278541315", "https://www.ransomlook.io/group/agl0bgvycg" ] }, "related": [ { "dest-uuid": "8807752b-bd26-45a7-ba34-c8ddd8e5781d", "tags": [ "estimative-language:likelihood-probability=\"unlikely\"" ], "type": "similar" } ], "uuid": "71b02418-6b06-48e3-8636-32287f8e0b1d", "value": "aGl0bGVyCg" }, { "description": "Once installed, Ako will attempt to delete Volume Shadow Copies and disable recovery services. It will then begin to encrypt all files that do not match a hard-coded list using an unknown algorithm. Whilst this is happening, Ako will scan the affected network for any connected devices or drives for it to propagate to.", "meta": { "extensions": [ ".A4Wz1b", ".861C7c", ".jJNm9j" ], "links": [ " http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion", "http://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion" ], "ransomnotes": [ "Your network have been locked.\n\nAll your files, documents, photos, databases and other important data are encrypted and have the extension: *******\n\nBackups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover.\nFrom this moment, it will be impossible to use files until they are decrypted.\n\nThe only method of recovering files is to purchase an unique private key.\nOnly we can give you this key and only we can recovery your files.\n\nTo get info (decrypt your files) follow this steps:\n1) Download and install Tor Browser: hxxps://www.torproject.org/download/\n2) Open our website in TOR: hxxp://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2th cw5gz75qncv7rbhyad.onion/I8VC6PIEQL8JFKHM\n3) Paste your ID in form (you can find your ID below)\n\n!! ATTENTION !!\n!! Any third - party software may damage encrypted data but not recover.\n!! DO NOT MODIFY ENCRYPTED FILES\n!! DO NOT CHANGE YOUR ID\n!! DO NOT REMOVE YOUR ID.KEY FILE\n\n --- BEGIN PERSONAL ID ---\n\n --- END PERSONAL ID ---", "Your network have been locked.\n\nAll your files, documents, photos, databases and other important data are encrypted and have the extension: ******\n\nBackups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover.\nFrom this moment, it will be impossible to use files until they are decrypted.\n\nThe only method of recovering files is to purchase an unique private key.\nOnly we can give you this key and only we can recovery your files.\n\nTo get info (decrypt your files) contact us at (email)\ndavidgoldman@cock.li or portedhiggens@firemail.cc\n\nAnd send me your ID\n\n!!ATTENTION !!\n!!Any third - party software may damage encrypted data but not recover.\n!!DO NOT MODIFY ENCRYPTED FILES\n!!DO NOT CHANGE YOUR KEY\n\n--- YOUR ID ---\n-\n--- YOUR ID ---", "Your network has been hacked and locked.\n\nAll files on each host in the network have been encrypted with a strong algorithm.\n\nBackups were either encrypted or deleted or backup disks were formatted.\nShadow copies also removed. Any 3rd party software may damage encrypted data but not recover.\n\nWe have decryption software for your situation.\nNo decryption software is available in the public.\n\nDO NOT RESET OR SHUTDOWN - files may be damaged.\nDO NOT RENAME OR MOVE the encrypted and readme files.\nDO NOT DELETE readme files.\n\nTo get info (decrypt your files) follow this instructions:\n1) [Recommended] via Tor Browser:\na) Download and install Tor Browser: hxxps://www.torproject.org/download/\nb) Open our website in TOR: hxxp://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion/AXYIRRUPSQTS3AHT\n\n2) If you have any problems connecting or using TOR network:\na) Open our website: hxxps://buydecrypt.hk/AXYIRRUPSQTS3AHT\nb) Follow the instructions on the site.\n\nThe faster you get in contact - the lower price you can expect.\n\nExt: .A4Wz1b\nWhen you open our page, paste this key in form:\n\n-", "Your network has been hacked and locked.\n\nAll files on each host in the network have been encrypted with a strong algorithm.\nDo not worry, we have decryption software for your situation.\n\nWe have also downloaded a lot of sensitive information from your network, so in case of not paying this data will be released.\nIf you dont believe we have any data you can contact us and ask a proof.\nDont forget about GDPR.\n\nWhen you pay us the data will be removed from our disks and decryptor will be given to you, so you can restore all your files.\n\nTo get info (decrypt your files) contact us at and send your key (see it below):\n\ndtddecrypt@protonmail.com or dtddesht@tutanota.com\n\nTo confirm our honest intentions, you can decrypt any file for free.\nThe faster you get in contact - the lower price you can expect.\n\nDecryption of your files with the help of third-party company may cause increased price. (they add their fee to our)\nDo not reset or shutdown - files may be damaged.\nDo not rename or move the encrypted and readme files.\nDo not delete readme files.\n\nMachine ID: .861C7c\nYour key:\n\n-", "To get info (decrypt your files) contact us at (email) and send your key (see it below)\ndtddecrypt@protonmail.com or dtddesht@tutanota.com\n\n\nThe faster you get in contact - the lower price you can expect.\n\nMachine ID: .861C7c\nKey:\n\n-", "--- We apologize! ---\nYour network have been locked.\n\n------------------------------\n| Whats happened?\n------------------------------\n\nAll your files, documents, photos, databases and other important data are encrypted and have the extension: .jJNm9j\n\nBackups and shadow copies also encrypted or removed. Any third-party software may damage encrypted data but not recover.\nFrom this moment, it will be impossible to use files until they are decrypted.\n\nThe only method of recovering files is to purchase an unique private key.\nOnly we can give you this key and only we can recovery your files.\n\n------------------------------\n| Guarantees?\n------------------------------\n\nAs you read above, files can be decrypted only using our private key and a special program.\nThe only guarantees we can give are decryption of your any file.\nSo you can decrypt any file from your system for free on our website.\nWe guarantee that you can recovery all your files. But you have not so enough time.\n\n------------------------------\n| How to recovery my files?\n------------------------------\n\nTo get info (decrypt your files) you have 1 way:\n\n1) [Recommended] via Tor Browser:\na) Download and install Tor Browser: hxxps://www.torproject.org/download/\nb) Open our website in TOR: hxxp://kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2 thcw5gz75qncv7rbhyad.onion/I8VC6PIEQL8JFKHM\n\nWhen you open our website, put the following key in the input form:\n\n-\n\n!! ATTENTION !!\n!! Any third - party software may damage encrypted data but not recover. !!\n!! DO NOT MODIFY ENCRYPTED FILES !!\n!! DO NOT CHANGE YOUR ID !!\n!! DO NOT REMOVE YOUR ID.KEY FILE !!\n" ], "ransomnotes-filenames": [ "ako-readme.txt" ], "ransomnotes-refs": [ "https://www.pcrisk.com/images/stories/screenshots202001/ako-ransom-note.jpg" ], "refs": [ "https://digital.nhs.uk/cyber-alerts/2020/cc-3345", "https://www.pcrisk.com/removal-guides/16737-ako-ransomware", "https://www.pcrisk.com/images/stories/screenshots202001/ako-ransom-note-second_variant.jpg", "https://www.pcrisk.com/images/stories/screenshots202004/ako-ransomware-update-2020-04-09-text-file.jpg", "https://www.pcrisk.com/images/stories/screenshots202004/ako-update-2020-04-21-text-file.jpg", "https://www.pcrisk.com/images/stories/screenshots202004/ako-update-2020-04-21-html-file.jpg", "https://www.pcrisk.com/images/stories/screenshots202010/ako-ransomware-update-2020-10-15-text-file.gif", "https://www.ransomlook.io/group/ako" ], "synonyms": [ "MedusaReborn" ] }, "uuid": "7de070ce-4b63-4d3c-be73-1ede22565faf", "value": "Ako" }, { "description": "Arvin Club is a popular Ransomware group with a widespread Telegram presence, which includes personal group chats, and official channels.\nThe group recently launched their official TOR/ Onion website to update their status and release details of their latest attacks and data breaches.\nTheir latest target is Kendriya Vidyala, a chain of Schools in India. The group has exposed the Personally Identifiable Information (PII) of some students.", "meta": { "links": [ "http://3kp6j22pz3zkv76yutctosa6djpj4yib2icvdqxucdaxxedumhqicpad.onion/", "http://arvinc7prj6ln5wpd6yydfqulsyepoc7aowngpznbn3lrap2aib6teid.onion/" ], "refs": [ "http://t.me/arvin_club", "https://www.ransomlook.io/group/arvinclub" ], "synonyms": [ "Arvin Club" ] }, "uuid": "2dfc1668-e338-47f0-ba6c-b4bc3046881e", "value": "Arvinclub" }, { "description": "AtomSilo is a new Ransomware recently seen in September 2021 during one of their attacks by exploiting a recently revealed vulnerability (CVE-2021-26084) in Atlassian’s Confluence Collaboration Software for initial access. The Ransomware used the double extortion method which is gaining popularity among ransomware threat actors where they first, exfiltrate the confidential information and as a second step encrypt the system files.", "meta": { "extensions": [ ".ATOMSILO" ], "links": [ "http://mhdehvkomeabau7gsetnsrhkfign4jgnx3wajth5yb5h6kvzbd72wlqd.onion", "http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion/list.html" ], "ransomenotes-files": [ "README-FILE-#COMPUTER-NAME#-#CREATION-TIME#.hta" ], "ransomnotes": [ "Atom Slio\nInstructions\nWARNING! YOUR FILES ARE ENCRYPTED AND LEAKED!\n\n--------------------------------------\nWe are AtomSilo.Sorry to inform you that your files has been obtained and encrypted by us.\n\nBut don’t worry, your files are safe, provided that you are willing to pay the ransom.\n\nAny forced shutdown or attempts to restore your files with the thrid-party software will be damage your files permanently!\n\nThe only way to decrypt your files safely is to buy the special decryption software from us.\n\nThe price of decryption software is 1000000 dollars.\nIf you pay within 48 hours, you only need to pay 500000 dollars. No price reduction is accepted.\n\nWe only accept Bitcoin payment,you can buy it from bitpay,coinbase,binance or others.\n\nYou have five days to decide whether to pay or not. After a week, we will no longer provide decryption tools and publish your files\n\n--------------------------------------\n\nTime starts at 0:00 on September 11\n--------------------------------------\nSurvival time： 1 Day 14 Hour 26 Min 59 Sec\n\n--------------------------------------\n\nYou can contact us with the following email:\n\nEmail:arvato@atomsilo.com\nIf this email can't be contacted, you can find the latest email address on the following website:\n\nhxxp://mhdehvkomeabau7gsetnsrhkfign4jgnx3wajth5yb5h6kvzbd72wlqd.onion\n\n--------------------------------------\n\nIf you don’t know how to open this dark web site, please follow the steps below to installation and use TorBrowser:\n\nrun your Internet browser\nenter or copy the address hxxps://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER\nwait for the site loading\non the site you will be offered to download TorBrowser; download and run it, follow the installation instructions, wait until the installation is completed\nrun TorBrowser\nconnect with the button \"Connect\" (if you use the English version)\na normal Internet browser window will be opened after the initialization\ntype or copy the address in this browser address bar and press ENTER\nthe site should be loaded; if for some reason the site is not loading wait for a moment and try again.\nIf you have any problems during installation or use of TorBrowser, please, visit hxxps://www.youtube.com and type request in the search bar \"Install TorBrowser Windows\" and you will find a lot of training videos about TorBrowser installation and use.\n\n--------------------------------------\n\nAdditional information:\n\nYou will find the instructions (\"README-FILE-#COMPUTER#-#TIME#.hta\") for restoring your files in any folder with your encrypted files.\n\nThe instructions \"README-FILE-#COMPUTER#-#TIME#.hta\" in the folders with your encrypted files are not viruses! The instructions \"README-FILE-#COMPUTER#-#TIME#.hta\" will help you to decrypt your files.\n\nRemember! The worst situation already happened and now the future of your files depends on your determination and speed of your actions." ], "ransomnotes-refs": [ "https://www.cyfirma.com/media/2021/10/Fig-2.png", "https://www.cyfirma.com/media/2021/10/Fig-2-B.png", "https://www.pcrisk.com/images/stories/screenshots202109/atomsilo-ransomware-ransom-note-in-gif-image.gif" ], "refs": [ "https://www.cyfirma.com/outofband/malware-research-on-atomsilo-ransomware/", "https://www.zscaler.com/blogs/security-research/atomsilo-ransomware-enters-league-double-extortion", "https://twitter.com/siri_urz/status/1437664046556274694", "https://news.sophos.com/en-us/2021/10/04/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack/", "https://chuongdong.com/reverse%20engineering/2021/10/13/AtomSiloRansomware/", "https://decoded.avast.io/threatintel/decryptor-for-atomsilo-and-lockfile-ransomware/", "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader", "https://malpedia.caad.fkie.fraunhofer.de/details/win.atomsilo", "https://chuongdong.com//reverse%20engineering/2021/10/13/AtomSiloRansomware/", "https://twitter.com/siri_urz/status/1437664046556274694?s=20", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.ransomlook.io/group/atomsilo" ] }, "uuid": "a322f03f-4bc8-455f-b302-e8724c46f80c", "value": "Atomsilo" }, { "description": "Avaddon is a ransomware malware targeting Windows systems often spread via malicious spam. The first known attack where Avaddon ransomware was distributed was in February 2020. Avaddon encrypts files using the extension .avdn and uses a TOR payment site for the ransom payment.", "meta": { "links": [ " http://avaddongun7rngel.onion ", "http://avaddongun7rngel.onion" ], "refs": [ "https://heimdalsecurity.com/blog/avaddon-ransomware/", "https://atos.net/en/lp/securitydive/avaddon-ransomware-analysis", "https://www.acronis.com/en-us/articles/avaddon-ransomware", "https://www.cyber.gov.au/sites/default/files/2021-05/2021-003%20Ongoing%20campaign%20using%20Avaddon%20Ransomware%20-%2020210508.pdf", "https://arxiv.org/pdf/2102.04796.pdf", "https://awakesecurity.com/blog/threat-hunting-for-avaddon-ransomware/", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/", "https://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage/", "https://medium.com/s2wlab/quick-analysis-of-haron-ransomware-feat-avaddon-and-thanos-1ebb70f64dc4", "https://medium.com/s2wlab/w4-jan-en-story-of-the-week-ransomware-on-the-darkweb-7595544363b1", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://therecord.media/avaddon-ransomware-operation-shuts-down-and-releases-decryption-keys/", "https://therecord.media/darkside-ransomware-gang-says-it-lost-control-of-its-servers-money-a-day-after-biden-threat/", "https://threatconnect.com/blog/threatconnect-research-roundup-probable-sandworm-infrastructure", "https://twitter.com/Securityinbits/status/1271065316903120902", "https://twitter.com/dk_samper/status/1348560784285167617", "https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/", "https://www.advanced-intel.com/post/the-rise-demise-of-multi-million-ransomware-business-empire", "https://www.bleepingcomputer.com/news/security/another-ransomware-now-uses-ddos-attacks-to-force-victims-to-pay/", "https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/", "https://www.connectwise.com/resources/avaddon-profile", "https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound", "https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware", "https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/", "https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/", "https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/", "https://www.hornetsecurity.com/en/security-information/avaddon-from-seeking-affiliates-to-in-the-wild-in-2-days/", "https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/", "https://www.mandiant.com/resources/chasing-avaddon-ransomware", "https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html", "https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html", "https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf", "https://www.swascan.com/it/avaddon-ransomware/", "https://www.tgsoft.it/files/report/download.asp?id=568531345", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted", "https://www.welivesecurity.com/la-es/2021/05/31/ransomware-avaddon-principales-caracteristicas/", "https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/", "https://www.ransomlook.io/group/avaddon" ] }, "uuid": "fdfbe721-abd1-4760-8e52-f23306f6cb80", "value": "Avaddon" }, { "meta": { "links": [ "http://avos2fuj6olp6x36.onion" ] }, "related": [ { "dest-uuid": "73d3d8f8-83cc-4fdc-a645-d03b9a7b5a9b", "tags": [ "estimative-language:likelihood-probability=\"very-likely\"" ], "type": "similar" } ], "uuid": "ba42ab03-9d29-40c3-b3d4-c2045e47dc07", "value": "Avos" }, { "meta": { "links": [ "http://anewset3pcya3xvk73hj7yunuamutxxsm5sohkdi32blhmql55tvgqad.onion" ], "refs": [ "https://www.ransomlook.io/group/aztroteam" ] }, "uuid": "9850bffb-8cc6-45c7-9e6a-4c77fd5093c3", "value": "Aztroteam" }, { "meta": { "links": [ "http://nq4zyac4ukl4tykmidbzgdlvaboqeqsemkp4t35bzvjeve6zm2lqcjid.onion/#section-3" ], "refs": [ "https://www.bleepingcomputer.com/news/security/leaked-babuk-locker-ransomware-builder-used-in-new-attacks", "https://www.bleepingcomputer.com/news/security/babuk-ransomwares-full-source-code-leaked-on-hacker-forum", "https://blog.cyberint.com/babuk-locker", "https://www.ransomlook.io/group/babuk-locker" ] }, "related": [ { "dest-uuid": "c52a65d5-9bea-4a09-a81b-7f789ab48ce0", "tags": [ "estimative-language:likelihood-probability=\"very-likely\"" ], "type": "similar" } ], "uuid": "05be1a86-92a9-48e1-8be1-9c1014dfd1cd", "value": "Babuk-Locker" }, { "meta": { "extension": [ ".babyduck" ], "links": [ "http://babydovegkmhbontykziyq7qivwzy33mu4ukqefe4mqpiiwd3wibnjqd.onion" ], "ransomnotes": [ "Ducky has got your flies encrypted!\n\nThis happened because you were not paying attention to your security.\n\nDucky will give you your files back if you pay him a bit of crypto.\n\nUse TOR browser (https://www.torproject.org/download/) apnd follow this link \n\n\nDon't worry, if you behave and pay - you'll get your files back;)\n\nYOUR KEY IS " ], "ransomnotes-files": [ "#README.babyduck" ], "ransomnotes-refs": [ "https://digitalrecovery.com/wp-content/uploads/2022/12/Ransomware-Baby-Duck.webp" ], "refs": [ "https://twitter.com/PolarToffee/status/1445873002801889280/photo/3", "https://www.ransomlook.io/group/babyduck" ] }, "uuid": "18e67723-a0de-4adf-aa28-f3e0b0d6d8ab", "value": "Babyduck" }, { "description": "BianLian used subtle techniques to exploit, enumerate, and move laterally in victim networks to remain undetected and aggressively worked to counter Endpoint Detection & Response (EDR) protections during the encryption phase of their operations. The group has displayed signs of being new to the practical business aspects of ransomware and associated logistics. Generally they seemed to be experiencing the growing pains of a group of talented hackers new to this aspect of criminal extortion.\n\nInfrastructure associated with the BianLian group first appeared online in December 2021 and their toolset appears to have been under active development since then. Finally, we have observed the BianLian threat actor tripling their known command and control (C2) infrastructure in the month of August, suggesting a possible increase in the actor’s operational tempo.", "meta": { "links": [ "http://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion/" ], "ransomnotes": [ "Your network systems were attacked and encrypted. Contact us in order to restore your data. Don't make any changes in your file structure: touch no files, don't try to recover by yourself, that may lead to it's complete loss.\n\nTo contact us you have to download \"tox\" messenger: https://qtox.github.io/\n\nAdd user with the following ID to get your instructions: \nA4B3B0845DA242A64BF17E0DB4278EDF85855739667D3E2AE8B89D5439015F07E81D12D767FC\n\nAlternative way: swikipedia@onionmail.org\n\nYour ID: wU1VC460GC \n\nYou should know that we have been downloading data from your network for a significant time before the attack: financial, client, business, post, technical and personal files.\nIn 10 days — it will be posted at our site http://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion with links send to your clients, partners, competitors and news agencies, that will lead to a negative impact on your company: potential financial, business and reputational loses." ], "ransomnotes-files": [ "Look at this instruction.txt" ], "ransomnotes-refs": [ "https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/v8_screenshot.png", "https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/v28_screenshot.png", "https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/10/bianlian-fig05.png" ], "refs": [ "https://blog.cyble.com/2022/08/18/bianlian-new-ransomware-variant-on-the-rise/", "https://blogs.blackberry.com/en/2022/10/bianlian-ransomware-encrypts-files-in-the-blink-of-an-eye", "https://cryptax.medium.com/android-bianlian-payload-61febabed00a", "https://cryptax.medium.com/bianlian-c-c-domain-name-4f226a29e221", "https://cryptax.medium.com/creating-a-safe-dummy-c-c-to-test-android-bots-ffa6e7a3dce5", "https://cryptax.medium.com/multidex-trick-to-unpack-android-bianlian-ed52eb791e56", "https://cryptax.medium.com/quick-look-into-a-new-sample-of-android-bianlian-bc5619efa726", "https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/", "https://rhisac.org/threat-intelligence/bianlian-ransomware-expanding-c2-infrastructure-and-operational-tempo/", "https://twitter.com/malwrhunterteam/status/1558548947584548865", "https://www.fortinet.com/blog/threat-research/new-wave-bianlian-malware", "https://www.threatfabric.com/blogs/bianlian_from_rags_to_riches_the_malware_dropper_that_had_a_dream.html", "https://www.virusbulletin.com/uploads/pdf/conference/vb2022/slides/VB2022-Hunting-the-Android-BianLian-botnet.pdf", "https://www.virusbulletin.com/uploads/pdf/conference/vb2022/papers/VB2022-Hunting-the-Android-BianLian-botnet.pdf", "https://www.youtube.com/watch?v=DPFcvSy4OZk", "https://www.fortinet.com/blog/threat-research/new-wave-bianlian-malware.html", "https://www.ransomlook.io/group/bianlian" ], "synonyms": [ "Hydra" ] }, "related": [ { "dest-uuid": "2e4f26d6-f220-4877-be0e-45059b0f8eeb", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "2019d150-6073-4e3f-b6a5-64b919a87ce9", "value": "Bianlian" }, { "meta": { "links": [ "http://544corkfh5hwhtn4.onion", "http://blackshadow.cc" ], "refs": [ "https://www.ransomlook.io/group/blackshadow" ] }, "uuid": "d9561bfc-08a0-4e9f-9189-d079bae4f9b7", "value": "Blackshadow" }, { "meta": { "links": [ "http://bl%40ckt0r:bl%40ckt0r@bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid.onion/0x00/data-breach.html" ], "refs": [ "https://www.ransomlook.io/group/blacktor" ] }, "uuid": "25bd46bf-b4f5-4c34-b451-90a7809fa03a", "value": "Blacktor" }, { "description": "Ransomware.", "meta": { "links": [ "http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion" ], "refs": [ "https://unit42.paloaltonetworks.com/bluesky-ransomware/", "https://www.sentinelone.com/blog/bluesky-ransomware-ad-lateral-movement-evasion-and-fast-encryption-puts-threat-on-the-radar/", "https://yoroi.company/research/dissecting-bluesky-ransomware-payload/", "https://www.ransomlook.io/group/bluesky" ] }, "uuid": "1f369229-a68d-4e08-aee4-f251111fa186", "value": "Bluesky" }, { "meta": { "links": [ "http://bonacifryrxr4siz6ptvokuihdzmjzpveruklxumflz5thmkgauty2qd.onion" ], "refs": [ "https://www.ransomlook.io/group/bonacigroup" ] }, "uuid": "ef47092c-d86e-4db5-b0bf-e7676e85873f", "value": "Bonacigroup" }, { "meta": { "links": [ "http://rwiajgajdr4kzlnrj5zwebbukpcbrjhupjmk6gufxv6tg7myx34iocad.onion/" ], "refs": [ "https://www.ransomlook.io/group/cheers" ] }, "uuid": "eac9a5d5-509b-421a-a2d2-d91f7b27383a", "value": "Cheers" }, { "description": "previous clearnet domain coomingproject.com", "meta": { "links": [ "http://z6mikrtphid5fmn52nbcbg25tj57sowlm3oc25g563yvsfmygkcxqbyd.onion", "http://teo7aj5mfgzxyeme.onion" ], "refs": [ "https://www.ransomlook.io/group/cooming" ] }, "uuid": "4ecf9aa9-69c8-4347-a9c6-cb4a5481ac8c", "value": "Cooming" }, { "description": "", "meta": { "links": [ "http://d57uremugxjrafyg.onion" ], "refs": [ "https://bartblaze.blogspot.com/2016/02/vipasana-ransomware-new-ransom-on-block.html", "https://blog.checkpoint.com/2015/11/04/offline-ransomware-encrypts-your-data-without-cc-communication/", "https://hackmag.com/security/ransomware-russian-style/", "https://ke-la.com/the-ideal-ransomware-victim-what-attackers-are-looking-for/", "https://securelist.com/cis-ransomware/104452/", "https://securelist.com/the-return-of-fantomas-or-how-we-deciphered-cryakl/86511/", "https://securelist.ru/shifrovalshhik-cryakl-ili-fantomas-razbushevalsya/24070/", "https://twitter.com/albertzsigovits/status/1217866089964679174", "https://twitter.com/bartblaze/status/1305197264332369920", "https://twitter.com/demonslay335/status/971164798376468481", "https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Cryakl-B/detailed-analysis.aspx", "https://www.telekom.com/en/blog/group/article/lockdata-auction-631300", "https://www.ransomlook.io/group/crylock" ], "synonyms": [ "Cryakl" ] }, "uuid": "e7b3c590-78a7-4318-8607-69d53dc7dfbf", "value": "Crylock" }, { "description": "Ransomware.", "meta": { "links": [ "http://cuba4mp6ximo2zlo.onion", "http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/" ], "refs": [ "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf", "https://digital.nhs.uk/cyber-alerts/2021/cc-3855", "https://blog.group-ib.com/hancitor-cuba-ransomware", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://id-ransomware.blogspot.com/2019/12/cuba-ransomware.html", "https://lab52.io/blog/cuba-ransomware-analysis/", "https://shared-public-reports.s3-eu-west-1.amazonaws.com/Cuba+Ransomware+Group+-+on+a+roll.pdf", "https://unit42.paloaltonetworks.com/cuba-ransomware-tropical-scorpius/", "https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/", "https://www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-cuba-ransomware/", "https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis", "https://www.elastic.co/security-labs/cuba-ransomware-malware-analysis", "https://www.fortinet.com/blog/threat-research/ransomware-roundup-gwisin-kriptor-cuba-and-more", "https://www.guidepointsecurity.com/blog/using-hindsight-to-close-a-cuba-cold-case/", "https://www.ic3.gov/Media/News/2021/211203-2.pdf", "https://www.it-connect.fr/le-ransomware-cuba-sen-prend-aux-serveurs-exchange/", "https://www.mandiant.com/resources/unc2596-cuba-ransomware", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-threat-report-a-quick-primer-on-cuba-ransomware", "https://www.trendmicro.com/en_us/research/22/f/cuba-ransomware-group-s-new-variant-found-using-optimized-infect.html", "https://www.ransomlook.io/group/cuba" ], "synonyms": [ "COLDDRAW" ] }, "related": [ { "dest-uuid": "2a95f6b9-3ce7-40b9-bda8-0832e0d9d07f", "tags": [ "estimative-language:likelihood-probability=\"very-likely\"" ], "type": "similar" } ], "uuid": "82ed1669-89ba-4432-bc97-148a25c15fdf", "value": "Cuba" }, { "meta": { "links": [ "http://7ukmkdtyxdkdivtjad57klqnd3kdsmq6tp45rrsxqnu76zzv3jvitlqd.onion/" ], "refs": [ "https://www.ransomlook.io/group/daixin" ] }, "uuid": "a1a445c4-708e-42f2-afdf-6d904328dafb", "value": "Daixin" }, { "meta": { "links": [ "http://powerj7kmpzkdhjg4szvcxxgktgk36ezpjxvtosylrpey7svpmrjyuyd.onion/" ], "refs": [ "https://www.ransomlook.io/group/dark power" ] }, "uuid": "64d155a9-8e33-4c3f-8f58-0a483475c65d", "value": "Dark Power" }, { "meta": { "links": [ "https://wemo2ysyeq6km2nqhcrz63dkdhez3j25yw2nvn7xba2z4h7v7gyrfgid.onion/" ], "refs": [ "https://www.ransomlook.io/group/darkangel" ] }, "uuid": "5276ed20-c9fa-4028-9272-3f5c0e4bc9b6", "value": "Darkangel" }, { "meta": { "links": [ "http://iw6v2p3cruy7tqfup3yl4dgt4pfibfa3ai4zgnu5df2q3hus3lm7c7ad.onion", "http://iw6v2p3cruy7tqfup3yl4dgt4pfibfa3ai4zgnu5df2q3hus3lm7c7ad.onion/support/" ], "refs": [ "https://www.ransomlook.io/group/darkbit01" ] }, "uuid": "69e2ce57-67bb-4d53-a8c4-00b3501f45a3", "value": "Darkbit01" }, { "meta": { "links": [ "http://woqjumaahi662ka26jzxyx7fznbp4kg3bsjar4b52tqkxgm2pylcjlad.onion/", "http://woqjumaahi662ka26jzxyx7fznbp4kg3bsjar4b52tqkxgm2pylcjlad.onion/atom.xml" ], "refs": [ "https://www.ransomlook.io/group/dataleak" ] }, "uuid": "80a634ae-519f-46e3-8e24-8eb733dfd22f", "value": "Dataleak" }, { "description": "A ransomware with potential ties to Wizard Spider.", "meta": { "links": [ "https://7ypnbv3snejqmgce4kbewwvym4cm5j6lkzf2hra2hyhtsvwjaxwipkyd.onion" ], "refs": [ "https://arcticwolf.com/resources/blog/karakurt-web", "https://chuongdong.com/reverse%20engineering/2021/12/17/DiavolRansomware/", "https://heimdalsecurity.com/blog/is-diavol-ransomware-connected-to-wizard-spider/", "https://medium.com/walmartglobaltech/diavol-resurfaces-91dd93c7d922", "https://medium.com/walmartglobaltech/diavol-the-enigma-of-ransomware-1fd78ffda648", "https://securityintelligence.com/posts/analysis-of-diavol-ransomware-link-trickbot-gang/", "https://thedfirreport.com/2021/12/13/diavol-ransomware/", "https://www.binarydefense.com/threat_watch/new-ransomware-diavol-being-dropped-by-trickbot/", "https://www.bleepingcomputer.com/news/security/diavol-ransomware-sample-shows-stronger-connection-to-trickbot-gang/", "https://www.bleepingcomputer.com/news/security/fbi-links-diavol-ransomware-to-the-trickbot-cybercrime-group/", "https://www.bleepingcomputer.com/news/security/trickbot-gang-developer-arrested-when-trying-to-leave-korea/", "https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider", "https://www.ic3.gov/Media/News/2022/220120.pdf", "https://www.scythe.io/library/adversary-emulation-diavol-ransomware-threatthursday", "https://www.ransomlook.io/group/diavol" ] }, "uuid": "6c4b88a4-64d6-4fa2-a552-99974794de16", "value": "Diavol" }, { "meta": { "links": [ "https://sbc2zv2qnz5vubwtx3aobfpkeao6l4igjegm3xx7tk5suqhjkp5jxtqd.onion/", "https://doq32rjiuomfghm5a4lyf3lwwakt2774tkv4ppsos6ueo5mhx7662gid.onion", "http://sbc2zv2qnz5vubwtx3aobfpkeao6l4igjegm3xx7tk5suqhjkp5jxtqd.onion/", "http://dk4mkfzqai6ure62oukzgtypedmwlfq57yj2fube7j5wsoi6tuia7nyd.onion/index.php?" ], "refs": [ "https://www.ransomlook.io/group/donutleaks" ] }, "uuid": "50fdc311-e6c5-4843-9b91-24d66afbdb8d", "value": "Donutleaks" }, { "meta": { "links": [ "http://h44jyyfomcbnnw5dha7zgwgkvpzbzbdyx2onu4fxaa5smxrgbjgq7had.onion/" ], "refs": [ "https://www.ransomlook.io/group/endurance" ] }, "uuid": "14658178-6fea-43bb-ae11-4ae5c2f14560", "value": "Endurance" }, { "description": "Entropy is a ransomware first seen in 1st quarter of 2022, is being used in conjunction of Dridex infection. The ransomware uses a custom packer to pack itself which has been seen in some early dridex samples. ", "meta": { "links": [ "http://leaksv7sroztl377bbohzl42i3ddlfsxopcb6355zc7olzigedm5agad.onion/posts" ], "refs": [ "https://killingthebear.jorgetesta.tech/actors/evil-corp", "https://news.sophos.com/en-us/2022/02/23/dridex-bots-deliver-entropy-ransomware-in-recent-attacks/", "https://news.sophos.com/en-us/2022/02/23/dridex-bots-deliver-entropy-ransomware-in-recent-attacks/?cmp=30728", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://www.ransomlook.io/group/entropy" ] }, "uuid": "11a458b9-df9c-486f-8556-2ae662df2802", "value": "Entropy" }, { "meta": { "links": [ "http://dg5fyig37abmivryrxlordrczn6d6r5wzcfe2msuo5mbbu2exnu46fid.onion" ], "refs": [ "https://www.ransomlook.io/group/ep918" ] }, "uuid": "3a074223-6c97-48ca-b019-50a16a37e956", "value": "Ep918" }, { "description": "", "meta": { "links": [ "http://ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion/" ], "refs": [ "https://www.reuters.com/article/us-usa-products-colonial-pipeline-ransom/more-ransomware-websites-disappear-in-aftermath-of-colonial-pipeline-hack-idUSKCN2CX0KT", "https://www.ransomlook.io/group/everest" ] }, "uuid": "3c2835b1-53de-4755-ac0f-48dff1e53745", "value": "Everest" }, { "meta": { "links": [ "http://gcbejm2rcjftouqbxuhimj5oroouqcuxb2my4raxqa7efkz5bd5464id.onion/" ], "refs": [ "https://www.ransomlook.io/group/freecivilian" ] }, "uuid": "34c540d5-70ad-44cc-b5a2-cd8ec7e2efd6", "value": "Freecivilian" }, { "meta": { "links": [ "http://hkk62og3s2tce2gipcdxg3m27z4b62mrmml6ugctzdxs25o26q3a4mid.onion/" ], "refs": [ "https://www.ransomlook.io/group/fsteam" ] }, "uuid": "29408532-b5d3-47ab-9b31-1ea63a084e45", "value": "Fsteam" }, { "description": "captcha prevents indexing", "meta": { "links": [ "http://griefcameifmv4hfr3auozmovz5yi6m3h3dwbuqw7baomfxoxz4qteid.onion/" ], "refs": [ "https://heimdalsecurity.com/blog/doppelpaymer-gets-a-rebranding", "https://www.ransomlook.io/group/grief" ] }, "uuid": "506716cf-7e60-46e5-a853-c8a67fe696f9", "value": "Grief" }, { "meta": { "links": [ "http://ws3dh6av66sjbxxkjpw5ao3wqzmtejnkzheswm4dz5rrwvular7xvkqd.onion/" ], "refs": [ "https://intel471.com/blog/groove-gang-ransomware-babuk-revil-blackmatter", "https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates", "https://www.ransomlook.io/group/groove" ] }, "uuid": "267b7b61-ed82-4809-aafe-9d2487c56f19", "value": "Groove" }, { "description": "login page, no posts", "meta": { "links": [ "http://ft4zr2jzlqoyob7yg4fcpwyt37hox3ajajqnfkdvbfrkjioyunmqnpad.onion/login.php", "http://midasbkic5eyfox4dhnijkzc7v7e4hpmsb2qgux7diqbpna4up4rtdad.onion/blog.php" ], "refs": [ "https://therecord.media/new-haron-ransomware-gang-emerges-borrowing-from-avaddon-and-thanos", "https://threatpost.com/ransomware-gangs-haron-blackmatter/168212", "https://www.ransomlook.io/group/haron" ] }, "uuid": "949fe61d-6df6-4f36-996b-c58bbbc5140f", "value": "Haron" }, { "meta": { "links": [ "http://r6d636w47ncnaukrpvlhmtdbvbeltc6enfcuuow3jclpmyga7cz374qd.onion" ], "refs": [ "https://www.ransomlook.io/group/hotarus" ] }, "uuid": "3c5832ae-3961-423e-8331-218a7aa6e5db", "value": "Hotarus" }, { "meta": { "links": [ "http://kf6x3mjeqljqxjznaw65jixin7dpcunfxbbakwuitizytcpzn4iy5bad.onion/board/leak_list/", "http://7kstc545azxeahkduxmefgwqkrrhq3mzohkzqvrv7aekob7z3iwkqvyd.onion/board/victim_list/" ], "refs": [ "https://www.ransomlook.io/group/icefire" ] }, "uuid": "deea56de-1237-46bf-9ea7-4e1a3b3acd10", "value": "Icefire" }, { "meta": { "links": [ "https://justice-blade.io" ], "refs": [ "https://www.ransomlook.io/group/justice_blade" ] }, "uuid": "71a6edfe-9764-4c9b-b528-e0ee7b73c110", "value": "Justice_Blade" }, { "meta": { "links": [ "https://kelvinsecteamcyber.wixsite.com/my-site/items" ], "refs": [ "https://www.ransomlook.io/group/kelvin security" ] }, "uuid": "3c61d677-a2a6-40fb-aadd-72974f68e62c", "value": "Kelvin Security" }, { "meta": { "links": [ "https://t.me/minsaudebr" ], "refs": [ "https://www.ransomlook.io/group/lapsus$" ] }, "uuid": "e2e035aa-eb95-48af-98a7-f18ddfcc347b", "value": "Lapsus$" }, { "description": "", "meta": { "links": [ "http://yeuajcizwytgmrntijhxphs6wn5txp2prs6rpndafbsapek3zd4ubcid.onion/" ], "refs": [ "https://blog.cyble.com/2022/07/12/new-ransomware-groups-on-the-rise/", "https://blog.trendmicro.com/trendlabs-security-intelligence/operation-endtrade-finding-multi-stage-backdoors-that-tick/", "https://github.com/werkamsus/Lilith", "https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf", "https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf?1625657388", "https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/592/original/Hashes_IOCs_for_coverage.txt", "https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/594/original/Network_IOCs_list_for_coverage.txt?1625657479", "https://www.trendmicro.com/en_us/research/21/l/collecting-in-the-dark-tropic-trooper-targets-transportation-and-government-organizations.html", "https://yoroi.company/research/a-deep-dive-into-eternity-group-a-new-emerging-cyber-threat/", "https://www.ransomlook.io/group/lilith" ] }, "uuid": "7dea3669-5ec4-4bdf-898f-c3a9f796365e", "value": "Lilith" }, { "meta": { "links": [ "http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion/", "http://zqaflhty5hyziovsxgqvj2mrz5e5rs6oqxzb54zolccfnvtn5w2johad.onion", "http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion", "http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion", "http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion", "http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion", "http://yq43odyrmzqvyezdindg2tokgogf3pn6bcdtvgczpz5a74tdxjbtk2yd.onion", "http://oyarbnujct53bizjguvolxou3rmuda2vr72osyexngbdkhqebwrzsnad.onion", "http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion", "http://lockbitapt.uz", "http://yq43odyrmzqvyezdindg2tokgogf3pn6bcdtvgczpz5a74tdxjbtk2yd.onion", "http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion", "http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion", "http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion", "http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion", "http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion", "http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion", "http://lockbit7z2jwcskxpbokpemdxmltipntwlkmidcll2qirbu7ykg46eyd.onion", "http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion", "http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/", "http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/", "http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion", "http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion", "http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion", "http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion", "http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion" ], "refs": [ "https://threatpost.com/lockbit-ransomware-proliferates-globally/168746", "https://www.trendmicro.com/en_us/research/21/h/lockbit-resurfaces-with-version-2-0-ransomware-detections-in-chi.html", "https://www.ransomlook.io/group/lockbit3" ] }, "related": [ { "dest-uuid": "8eda8bf1-db5a-412d-8511-45e2f7621d51", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "c09f73fd-c3c3-42b1-b355-b03ca4941110", "value": "Lockbit3" }, { "meta": { "links": [ "http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion", "http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion", "http://nclen75pwlgebpxpsqhlcnxsmdvpyrr7ogz36ehhatfmkvakeyden6ad.onion", "http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/" ], "refs": [ "https://www.ransomlook.io/group/lolnek" ] }, "uuid": "9886732d-76a2-4fbb-86b7-9e6a80669fb5", "value": "Lolnek" }, { "description": "parser needs to be built", "meta": { "links": [ "http://rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion/", "http://4qbxi3i2oqmyzxsjg4fwe4aly3xkped52gq5orp6efpkeskvchqe27id.onion/" ], "refs": [ "https://www.secureworks.com/research/lv-ransomware", "https://securityaffairs.co/wordpress/119306/malware/lv-ransomware-repurposed-revil-binary.html", "https://www.ransomlook.io/group/lv" ] }, "uuid": "46d56775-5f8c-411e-adbe-2acd07bf99ac", "value": "Lv" }, { "meta": { "links": [ "http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion" ], "refs": [ "https://www.ransomlook.io/group/mallox" ] }, "uuid": "95891bae-09a4-4d02-990e-2477cb09b9c2", "value": "Mallox" }, { "meta": { "links": [ "http://xembshruusobgbvxg4tcjs3jpdnks6xrr6nbokfxadcnlc53yxir22ad.onion" ], "refs": [ "https://www.ransomlook.io/group/mbc" ] }, "uuid": "7ecd6452-d521-4095-8fd7-eecdeb6c8d96", "value": "Mbc" }, { "description": "This malware written in C# is a variant of the Thanos ransomware family and emerged in October 2021 and is obfuscated using SmartAssembly. In 2022, ThreatLabz analysed a report of Midas ransomware was slowly deployed over a two month period (ZScaler). This ransomware features also its own data leak site as part of its double extortion strategy.", "meta": { "links": [ "http://midasbkic5eyfox4dhnijkzc7v7e4hpmsb2qgux7diqbpna4up4rtdad.onion/blog.php" ], "refs": [ "https://news.sophos.com/en-us/2022/01/25/windows-services-lay-the-groundwork-for-a-midas-ransomware-attack/", "https://securityboulevard.com/2022/03/midas-ransomware-tracing-the-evolution-of-thanos-ransomware-variants/", "https://www.zscaler.com/blogs/security-research/midas-ransomware-tracing-evolution-thanos-ransomware-variants", "https://www.ransomlook.io/group/midas" ] }, "uuid": "c0ce34c6-13b9-41ef-847c-840b090f2bfc", "value": "Midas" }, { "meta": { "links": [ "http://moishddxqnpdxpababec6exozpl2yr7idfhdldiz5525ao25bmasxhid.onion" ], "refs": [ "https://www.ransomlook.io/group/moisha" ] }, "uuid": "b2e44cc2-2df9-4210-a0ee-9ae913278c00", "value": "Moisha" }, { "meta": { "links": [ "http://monteoamwxlutyovf7oxeviwjlbu3vbgdmkncecl2ydteqncrmcv67yd.onion/", "http://monteoamwxlutyovf7oxeviwjlbu3vbgdmkncecl2ydteqncrmcv67yd.onion/catalog/" ], "refs": [ "https://www.ransomlook.io/group/monte" ] }, "uuid": "814f656d-7107-41d3-a934-1667e427ad8a", "value": "Monte" }, { "meta": { "links": [ "http://4s4lnfeujzo67fy2jebz2dxskez2gsqj2jeb35m75ktufxensdicqxad.onion/", "http://mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion/" ], "refs": [ "https://www.ransomlook.io/group/monti" ] }, "uuid": "0ea4daa9-0b83-4acb-bc54-420635b7bfea", "value": "Monti" }, { "meta": { "links": [ "http://58b87e60649ccc808ac8mstiejnj.5s4ixqul2enwxrqv.onion" ], "refs": [ "https://www.ransomlook.io/group/mydecryptor" ] }, "uuid": "8b726e6a-ed85-4a5b-a501-6bc06dab288d", "value": "Mydecryptor" }, { "meta": { "links": [ "http://n3twormruynhn3oetmxvasum2miix2jgg56xskdoyihra4wthvlgyeyd.onion" ], "refs": [ "https://www.ransomlook.io/group/n3tworm" ] }, "uuid": "815b13b2-2b94-4ea9-adc2-8193936a1c61", "value": "N3Tworm" }, { "description": "", "meta": { "links": [ "http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion" ], "refs": [ "https://threatpost.com/netwalker-ransomware-suspect-charged/163405", "https://www.cybereason.com/blog/cybereason-vs.-netwalker-ransomware", "https://www.ncsc.org/trends/monthly-trends-articles/2020/netwalker-ransomware", "https://0x00-0x7f.github.io/Netwalker-from-Powershell-reflective-loader-to-injected-Dll/", "https://blog.talosintelligence.com/2020/09/CTIR-quarterly-trends-Q4-2020.html", "https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/", "https://blogs.blackberry.com/en/2021/03/zerologon-to-ransomware", "https://cert-agid.gov.it/news/netwalker-il-ransomware-che-ha-beffato-lintera-community/", "https://cti-league.com/wp-content/uploads/2021/02/CTI-League-Darknet-Report-2021.pdf", "https://danusminimus.github.io/Zero2Auto-Netwalker-Walkthrough/", "https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3", "https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf", "https://go.crowdstrike.com/rs/281-OBQ-266/images/ReportCSIT-20081e.pdf", "https://ics-cert.kaspersky.com/media/KASPERSKY_H1_2020_ICS_REPORT_EN.pdf", "https://id-ransomware.blogspot.com/2019/09/koko-ransomware.html", "https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/", "https://ke-la.com/to-attack-or-not-to-attack-targeting-the-healthcare-sector-in-the-underground-ecosystem/", "https://krebsonsecurity.com/2021/01/arrest-seizures-tied-to-netwalker-ransomware", "https://lopqto.me/posts/automated-dynamic-import-resolving", "https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/", "https://s3.documentcloud.org/documents/21199896/vachon-desjardins-court-docs.pdf", "https://seguranca-informatica.pt/netwalker-ransomware-full-analysis/", "https://sites.temple.edu/care/ci-rw-attacks/", "https://tccontre.blogspot.com/2020/05/netwalker-ransomware-api-call.html", "https://thedfirreport.com/2020/08/31/netwalker-ransomware-in-1-hour/", "https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/", "https://therecord.media/ransomwhere-project-wants-to-create-a-database-of-past-ransomware-payments/", "https://www.advanced-intel.com/post/netwalker-ransomware-group-enters-advanced-targeting-game", "https://www.bleepingcomputer.com/news/security/darkside-ransomware-made-90-million-in-just-nine-months/", "https://www.bleepingcomputer.com/news/security/enel-group-hit-by-ransomware-again-netwalker-demands-14-million", "https://www.bleepingcomputer.com/news/security/enel-group-hit-by-ransomware-again-netwalker-demands-14-million/", "https://www.bleepingcomputer.com/news/security/mailto-netwalker-ransomware-targets-enterprise-networks/", "https://www.bleepingcomputer.com/news/security/michigan-state-university-network-breached-in-ransomware-attack/", "https://www.bleepingcomputer.com/news/security/netwalker-ransomware-affiliate-sentenced-to-80-months-in-prison/", "https://www.bleepingcomputer.com/news/security/netwalker-ransomware-infecting-users-via-coronavirus-phishing/", "https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound", "https://www.crowdstrike.com/blog/analysis-of-ecrime-menu-style-toolkits/", "https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/", "https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/", "https://www.deepinstinct.com/2021/05/26/deep-dive-packing-software-cryptone/", "https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/", "https://www.ic3.gov/media/news/2020/200929-2.pdf", "https://www.incibe-cert.es/blog/ransomware-netwalker-analisis-y-medidas-preventivas", "https://www.justice.gov/opa/pr/department-justice-launches-global-action-against-netwalker-ransomware", "https://www.justice.gov/usao-mdfl/press-release/file/1360846/download", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/take-a-netwalk-on-the-wild-side/", "https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/", "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-ransomware-threat-report-2021.pdf", "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/paas-or-how-hackers-evade-antivirus-software/", "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf", "https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/an-in-depth-look-at-mailto-ransomware-part-one-of-three/", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/an-in-depth-look-at-mailto-ransomware-part-three-of-three/", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/an-in-depth-look-at-mailto-ransomware-part-two-of-three/", "https://www.ucsf.edu/news/2020/06/417911/update-it-security-incident-ucsf", "https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf", "https://www.youtube.com/watch?v=q8of74upT_g", "https://www.zeit.de/digital/2021-06/cybercrime-extortion-internet-spyware-ransomware-police-prosecution-hackers", "https://zengo.com/bitcoin-ransomware-detective-ucsf/", "https://zero2auto.com/2020/05/19/netwalker-re/", "https://www.ransomlook.io/group/netwalker" ] }, "uuid": "a449e5a4-a835-419e-af3e-d223c74d0536", "value": "Netwalker" }, { "meta": { "links": [ "http://nevcorps5cvivjf6i2gm4uia7cxng5ploqny2rgrinctazjlnqr2yiyd.onion/", "http://nevbackvzwfu5yu3gszap77bg66koadds6eln37gxdhdk4jdsbkayrid.onion/", "http://nevaffcwswjosddmw55qhn4u4secw42wlppzvf26k5onrlxjevm6avad.onion/" ], "refs": [ "https://www.ransomlook.io/group/nevada" ] }, "uuid": "9c517547-8002-4a9a-a360-8d836d2fe3e3", "value": "Nevada" }, { "description": "", "meta": { "links": [ "http://gg5ryfgogainisskdvh4y373ap3b2mxafcibeh2lvq5x7fx76ygcosad.onion" ], "refs": [ "https://twitter.com/cglyer/status/1480734487000453121", "https://twitter.com/cglyer/status/1480742363991580674", "https://www.bleepingcomputer.com/news/security/night-sky-is-the-latest-ransomware-targeting-corporate-networks/", "https://www.cynet.com/attack-techniques-hands-on/threats-looming-over-the-horizon/", "https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation", "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself", "https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader", "https://www.youtube.com/watch?v=Yzt_zOO8pDM", "https://www.ransomlook.io/group/nightsky" ] }, "uuid": "886a2d59-2e8d-4357-b70f-a6dd3d034dfd", "value": "Nightsky" }, { "description": "", "meta": { "links": [ "http://lirncvjfmdhv6samxvvlohfqx7jklfxoxj7xn3fh7qeabs3taemdsdqd.onion", "http://lirncvjfmdhv6samxvvlohfqx7jklfxoxj7xn3fh7qeabs3taemdsdqd.onion/", "http://6yofnrq7evqrtz3tzi3dkbrdovtywd35lx3iqbc5dyh367nrdh4jgfyd.onion/", "http://nokoleakb76znymx443veg4n6fytx6spck6pc7nkr4dvfuygpub6jsid.onion/" ], "refs": [ "https://www.ransomlook.io/group/nokoyawa" ] }, "uuid": "2b2f2e07-f764-4cc2-86ac-cc087a953cbb", "value": "Nokoyawa" }, { "meta": { "links": [ "http://5mvifa3xq5m7sou3xzaajfz7h6eserp5fnkwotohns5pgbb5oxty3zad.onion" ], "refs": [ "https://www.ransomlook.io/group/onepercent" ] }, "uuid": "e9e810e3-a919-4417-85d0-fcab700e45de", "value": "Onepercent" }, { "description": "", "meta": { "links": [ "http://vbmisqjshn4yblehk2vbnil53tlqklxsdaztgphcilto3vdj4geao5qd.onion/" ], "refs": [ "https://cyberintelmag.com/malware-viruses/payloadbin-ransomware-attributed-to-evil-corp", "https://www.bleepingcomputer.com/news/security/new-evil-corp-ransomware-mimics-payloadbin-gang-to-evade-us-sanctions/", "https://www.ransomlook.io/group/payloadbin" ] }, "uuid": "fd2161a9-cd88-4d12-94d9-52b93b28eb5b", "value": "Payloadbin" }, { "description": "Ransomware written in .NET, apparently derived from the codebase of win.hakbit (Thanos) ransomware.", "meta": { "links": [ "http://promethw27cbrcot.onion/blog/" ], "refs": [ "https://therecord.media/decryptor-released-for-prometheus-ransomware-victims", "https://unit42.paloaltonetworks.com/prometheus-ransomwar", "https://id-ransomware.blogspot.com/2021/05/prometheus-ransomware.html", "https://medium.com/cycraft/prometheus-decryptor-6933e7bac1ea", "https://medium.com/cycraft/the-road-to-ransomware-resilience-c1ca37036efd", "https://medium.com/s2wlab/prometheus-x-spook-prometheus-ransomware-rebranded-spook-ransomware-6f93bd8ab5dd", "https://securityintelligence.com/posts/ransomware-encryption-goes-wrong/", "https://therecord.media/decryptor-released-for-prometheus-ransomware-victims/", "https://twitter.com/inversecos/status/1441252744258461699?s=20", "https://unit42.paloaltonetworks.com/prometheus-ransomware/", "https://www.cybereason.com/blog/cybereason-vs.-prometheus-ransomware", "https://www.sentinelone.com/labs/spook-ransomware-prometheus-derivative-names-those-that-pay-shames-those-that-dont/", "https://www.ransomlook.io/group/prometheus" ] }, "uuid": "bcf0a9da-dca3-42c0-b875-59d434564fbb", "value": "Prometheus" }, { "meta": { "links": [ "http://ozsxj4hwxub7gio347ac7tyqqozvfioty37skqilzo2oqfs4cw2mgtyd.onion/", "http://24kckepr3tdbcomkimbov5nqv2alos6vmrmlxdr76lfmkgegukubctyd.onion", "http://wlh3dpptx2gt7nsxcor37a3kiyaiy6qwhdv7o6nl6iuniu5ycze5ydid.onion/blog", "http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion/" ], "refs": [ "https://www.ransomlook.io/group/qilin" ] }, "uuid": "d5b3ce3d-59e2-4e56-a29a-42fb8b733a51", "value": "Qilin" }, { "description": "login page, no posts", "meta": { "links": [ "http://gvka2m4qt5fod2fltkjmdk4gxh5oxemhpgmnmtjptms6fkgfzdd62tad.onion", "http://gvka2m4qt5fod2fltkjmdk4gxh5oxemhpgmnmtjptms6fkgfzdd62tad.onion/" ], "refs": [ "https://www.ransomlook.io/group/qlocker" ] }, "uuid": "065110c5-574a-4466-a336-e6c5f3ef86c4", "value": "Qlocker" }, { "meta": { "links": [ "http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion", "http://rampjcdlqvgkoz5oywutpo6ggl7g6tvddysustfl6qzhr5osr24xxqqd.onion", "http://ramp4u5iz4xx75vmt6nk5xfrs5mrmtokzszqxhhkjqlk7pbwykaz7zid.onion" ], "refs": [ "https://www.ransomlook.io/group/ramp" ] }, "uuid": "824f225c-7cd9-47e3-9f5b-c3194e4a26ea", "value": "Ramp" }, { "meta": { "links": [ "http://u67aylig7i6l657wxmp274eoilaowhp3boljowa6bli63rxyzfzsbtyd.onion/" ], "refs": [ "https://www.ransomlook.io/group/ransomcartel" ] }, "uuid": "62e56597-01c8-4721-abd2-c7efa37fb566", "value": "Ransomcartel" }, { "meta": { "links": [ "http://xw7au5pnwtl6lozbsudkmyd32n6gnqdngitjdppybudan3x3pjgpmpid.onion", "http://zohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onion/" ], "refs": [ "https://www.ransomlook.io/group/ransomhouse" ] }, "uuid": "00a6fc79-8a29-417b-a298-adc8e17d8aba", "value": "Ransomhouse" }, { "meta": { "links": [ "http://37rckgo66iydpvgpwve7b2el5q2zhjw4tv4lmyewufnpx4lhkekxkoqd.onion" ], "refs": [ "https://www.ransomlook.io/group/ranzy" ] }, "uuid": "840d5e7b-e96f-426d-8cf0-a5a10f5e4a46", "value": "Ranzy" }, { "meta": { "links": [ "http://relic5zqwemjnu4veilml6prgyedj6phs7de3udhicuq53z37klxm6qd.onion" ], "refs": [ "https://www.ransomlook.io/group/relic" ] }, "uuid": "f4340cdb-ed0c-411e-ae11-b14ee151886a", "value": "Relic" }, { "meta": { "links": [ "http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion", "http://royal4ezp7xrbakkus3oofjw6gszrohpodmdnfbe5e4w3og5sm7vb3qd.onion" ], "refs": [ "https://www.ransomlook.io/group/royal" ] }, "uuid": "9a970739-24e3-4eb5-9154-d0ac6b2c378d", "value": "Royal" }, { "meta": { "links": [ "http://t2tqvp4pctcr7vxhgz5yd5x4ino5tw7jzs3whbntxirhp32djhi7q3id.onion" ], "refs": [ "https://www.ransomlook.io/group/rransom" ] }, "uuid": "470306b5-5a3b-4b63-9c02-0dc917584e72", "value": "Rransom" }, { "meta": { "links": [ "http://54bb47h5qu4k7l4d7v5ix3i6ak6elysn3net4by4ihmvrhu7cvbskoqd.onion/blog", "http://54bb47h.blog" ], "refs": [ "https://www.mandiant.com/resources/sabbath-ransomware-affiliate", "https://www.ransomlook.io/group/sabbath" ] }, "uuid": "efdf315c-e85c-4d87-b816-ec29dbea67b5", "value": "Sabbath" }, { "description": "Ransomware, written in .NET.", "meta": { "links": [ "http://solidb2jco63vbhx4sfimnqmwhtdjk4jbbgq7a24cmzzkfse4rduxgid.onion/login" ], "refs": [ "https://www.trendmicro.com/en_us/research/22/h/solidbit-ransomware-enters-the-raas-scene-and-takes-aim-at-gamer.html", "https://www.ransomlook.io/group/solidbit" ] }, "uuid": "70719914-dc82-4ab0-b925-da837b337c89", "value": "Solidbit" }, { "meta": { "links": [ "http://zj2ex44e2b2xi43m2txk4uwi3l55aglsarre7repw7rkfwpj54j46iqd.onion" ], "refs": [ "https://www.ransomlook.io/group/sparta" ] }, "uuid": "ce4eb745-e341-4f5d-be93-2af23b9ad756", "value": "Sparta" }, { "meta": { "links": [ "http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/blog/" ], "refs": [ "https://www.ransomlook.io/group/spook" ] }, "uuid": "0d4a8359-d607-4e5a-b85c-c8248cfa520a", "value": "Spook" }, { "description": "", "meta": { "links": [ "http://3slz4povugieoi3tw7sblxoowxhbzxeju427cffsst5fo2tizepwatid.onion", "http://h3reihqb2y7woqdary2g3bmk3apgtxuyhx4j2ftovbhe3l5svev7bdyd.onion", "http://h3reihqb2y7woqdary2g3bmk3apgtxuyhx4j2ftovbhe3l5svev7bdyd.onion/stm.html", "http://pdcizqzjitsgfcgqeyhuee5u6uki6zy5slzioinlhx6xjnsw25irdgqd.onion" ], "refs": [ "https://www.ransomlook.io/group/stormous" ] }, "uuid": "6e20bdd2-31ac-4429-8aa7-4ce8cb7dc7b5", "value": "Stormous" }, { "meta": { "links": [ "http://tdoe2fiiamwkiadhx2a4dfq56ztlqhzl2vckgwmjtoanfaya4kqvvvyd.onion" ], "refs": [ "https://www.ransomlook.io/group/unknown" ] }, "uuid": "0e2d3ead-3de9-4089-b7a3-10790b6f70f2", "value": "Unknown" }, { "meta": { "links": [ "http://unsafeipw6wbkzzmj7yqp7bz6j7ivzynggmwxsm6u2wwfmfqrxqrrhyd.onion/" ], "refs": [ "https://www.ransomlook.io/group/unsafe" ] }, "uuid": "df2b1358-b3f1-4af4-8153-02f4fc018b03", "value": "Unsafe" }, { "meta": { "links": [ "http://test.cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion" ], "refs": [ "https://www.ransomlook.io/group/v is vendetta" ] }, "related": [ { "dest-uuid": "731e4a5e-35f2-47b1-80ba-150b95fdc14d", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" }, { "dest-uuid": "7fd558de-1dfe-432a-834b-3e2691ee7283", "tags": [ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" } ], "uuid": "f4b870cb-8c61-40ab-865b-b8304a120ba5", "value": "V Is Vendetta" }, { "meta": { "links": [ "http://vfokxcdzjbpehgit223vzdzwte47l3zcqtafj34qrr26htjo4uf3obid.onion", "http://746pbrxl7acvrlhzshosye3b3udk4plurpxt2pp27pojfhkkaooqiiqd.onion" ], "refs": [ "https://www.ransomlook.io/group/vfokx" ] }, "uuid": "465828ea-6e81-4851-b02c-458d696629c1", "value": "Vfokx" }, { "meta": { "links": [ "http://4hzyuotli6maqa4u.onion", "http://vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad.onion", "http://ml3mjpuhnmse4kjij7ggupenw34755y4uj7t742qf7jg5impt5ulhkid.onion/", "http://ssq4zimieeanazkzc5ld4v5hdibi2nzwzdibfh5n5w4pw5mcik76lzyd.onion/", "http://wmp2rvrkecyx72i3x7ejhyd3yr6fn5uqo7wfus7cz7qnwr6uzhcbrwad.onion" ], "refs": [ "https://blog.talosintelligence.com/2021/08/vice-society-ransomware-printnightmare.html", "https://www.ransomlook.io/group/vicesociety" ] }, "uuid": "41979767-bfb8-4633-af1f-3946a599f922", "value": "Vicesociety" }, { "description": "aka Onix/Onyx", "meta": { "links": [ "http://mrdxtxy6vqeqbmb4rvbvueh2kukb3e3mhu3wdothqn7242gztxyzycid.onion/" ], "refs": [ "https://www.ransomlook.io/group/vsop" ] }, "uuid": "8b2e6391-05b4-439e-b318-1c3ace388c2d", "value": "Vsop" }, { "description": "xing use a custom mountlocker exe", "meta": { "links": [ "http://xingnewj6m4qytljhfwemngm7r7rogrindbq7wrfeepejgxc3bwci7qd.onion/" ], "refs": [ "https://www.izoologic.com/2021/06/19/xing-locker-team-ransomgroup-is-on-a-roll-they-recently-hit-sharafi-group-investments", "https://itsecuritywire.com/quick-bytes/xinglocker-spreading-worm-using-mountlocker", "https://www.ransomlook.io/group/xinglocker" ] }, "uuid": "e92d5c00-81ae-4909-9994-74bf48180f22", "value": "Xinglocker" }, { "meta": { "links": [ "http://wj3b2wtj7u2bzup75tzhnso56bin6bnvsxcbwbfcuvzpc4vcixbywlid.onion" ], "refs": [ "https://www.ransomlook.io/group/xinof" ] }, "uuid": "64b7dc11-a627-43b2-91cd-38608784c53f", "value": "Xinof" }, { "description": "Ransomware.", "meta": { "links": [ "http://jukswsxbh3jsxuddvidrjdvwuohtsy4kxg2axbppiyclomt2qciyfoad.onion/" ], "refs": [ "https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html", "https://github.com/albertzsigovits/malware-notes/tree/master/Ransomware-Windows-Yanluowang", "https://securelist.com/how-to-recover-files-encrypted-by-yanlouwang/106332/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-targeted-ransomware", "https://www.bleepingcomputer.com/news/security/free-decryptor-released-for-yanluowang-ransomware-victims/", "https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf", "https://www.ransomlook.io/group/yanluowang" ] }, "uuid": "476de1fe-d9b7-441a-8cb9-e6648189be3b", "value": "Yanluowang" }, { "meta": { "links": [ "https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/", "https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/n", "https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/" ], "refs": [ "https://www.ransomlook.io/group/akira" ] }, "uuid": "74f4aa81-d494-41b0-90dd-b5958fa4a822", "value": "Akira" }, { "description": "", "meta": { "links": [ "http://eraleignews.com/", "http://wn6vonooq6fggjdgyocp7bioykmfjket7sbp47cwhgubvowwd7ws5pyd.onion/" ], "refs": [ "https://www.ransomlook.io/group/eraleign (apt73)" ], "synonyms": [ "Apt73" ] }, "uuid": "8855d8b5-7082-5504-aca4-24a83eca1197", "value": "Eraleign" }, { "meta": { "links": [ "http://zhuobnfsddn2myfxxdqtpxk367dqnntjf3kq7mrzdgienfxjyllq4rqd.onion/" ], "refs": [ "https://www.ransomlook.io/group/zero tolerance gang (ztg)" ], "synonyms": [ "Ztg" ] }, "uuid": "82bd1c85-fa32-53ca-984b-9f4e5830beb9", "value": "Zero Tolerance Gang" }, { "meta": { "links": [ "http://gookie256cvccntvenyxrvn7ht73bs6ss3oj2ocfkjt5y6vq6gfi2tad.onion/" ], "refs": [ "https://www.ransomlook.io/group/hellogookie" ] }, "uuid": "95cd32e5-4679-5871-a0ce-a0ecb361443d", "value": "hellogookie" }, { "meta": { "links": [ "http://nn5ua7gc7jkllpoztymtfcu64yjm7znlsriq3a6v5kw7l6jvirnczyyd.onion", "http://krjv3wondknwdrlvzp6ktqcqkrlvpme2xjt3fu7ojqpaqgl3sm33bdqd.onion/" ], "refs": [ "https://www.ransomlook.io/group/lambda" ] }, "uuid": "8d65309c-a3f8-514a-bc24-de3056dc3e16", "value": "lambda" }, { "meta": { "links": [ "http://wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion/" ], "refs": [ "https://www.ransomlook.io/group/darkrace" ] }, "uuid": "b6aa46b3-46f5-522f-931f-b1ac57e8aadc", "value": "darkrace" }, { "description": "", "meta": { "links": [ "http://metacrptmytukkj7ajwjovdpjqzd7esg5v3sg344uzhigagpezcqlpyd.onion/" ], "refs": [ "https://www.ransomlook.io/group/metaencryptor" ] }, "uuid": "be0414f6-efd9-5fb7-9383-8f9caf75d965", "value": "metaencryptor" }, { "meta": { "links": [ "http://toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion/" ], "refs": [ "https://www.ransomlook.io/group/clop torrents" ] }, "uuid": "a25db83a-0467-52f8-8eee-2f871607d982", "value": "clop torrents" }, { "meta": { "links": [ "https://hunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onion", "https://hunters33mmcwww7ek7q5ndahul6nmzmrsumfs6aenicbqon6mxfiqyd.onion/login" ], "refs": [ "https://www.ransomlook.io/group/hunters" ] }, "uuid": "97979d5f-2ab0-530a-b578-cb6b4ad381eb", "value": "hunters" }, { "meta": { "links": [ "http://33zo6hifw4usofzdnz74fm2zmhd3zsknog5jboqdgblcbwrmpcqzzbid.onion/" ], "refs": [ "https://www.ransomlook.io/group/red ransomware" ] }, "uuid": "9fa719ee-cc7b-5565-b510-8ea31f3e113d", "value": "red ransomware" }, { "meta": { "links": [ "http://mydatae2d63il5oaxxangwnid5loq2qmtsol2ozr6vtb7yfm5ypzo6id.onion/blog" ], "refs": [ "https://www.ransomlook.io/group/mydata" ] }, "uuid": "b3162bc6-9f24-5da8-9473-e9a63448d342", "value": "mydata" }, { "meta": { "links": [ "http://nv5p2mmpctvyqdyyi5zwh4gnifq2uxdx4etvnmaheqlrw6ordrjwxryd.onion/" ], "refs": [ "https://www.ransomlook.io/group/siegedsec" ] }, "uuid": "89e5aab9-7d2d-5291-9f44-15001f97b981", "value": "siegedsec" }, { "description": "Ransomware.", "meta": { "links": [ "http://3nvzqyo6l4wkrzumzu5aod7zbosq4ipgf7ifgj3hsvbcr5vcasordvqd.onion" ], "refs": [ "https://www.ransomlook.io/group/karma", "https://blog.cyble.com/2021/08/24/a-deep-dive-analysis-of-karma-ransomware/", "https://blogs.blackberry.com/en/2021/11/threat-thursday-karma-ransomware", "https://news.sophos.com/en-us/2022/02/28/conti-and-karma-actors-attack-healthcare-provider-at-same-time-through-proxyshell-exploits/?cmp=30728", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://www.sentinelone.com/labs/karma-ransomware-an-emerging-threat-with-a-hint-of-nemty-pedigree/", "https://www.sentinelone.com/labs/nokoyawa-ransomware-new-karma-nemty-variant-wears-thin-disguise/", "https://www.symantec.broadcom.com/hubfs/SED/SED_Threat_Hunter_Reports_Alerts/SED_FY22Q2_SES_Ransomware-Threat-Landscape_WP.pdf", "https://www.youtube.com/watch?v=hgz5gZB3DxE" ] }, "uuid": "b2fb8726-0274-5d51-b0eb-58a9351dc10b", "value": "karma" }, { "meta": { "links": [ "http://2c7nd54guzi6xhjyqrj5kdkrq2ngm2u3e6oy4nfhn3wm3r54ul2utiqd.onion/" ], "refs": [ "https://www.ransomlook.io/group/dan0n" ] }, "uuid": "3e099540-9fe5-5e2e-9a48-ed0ec8b35828", "value": "dan0n" }, { "meta": { "links": [ "http://dfi7ynmrugokn4fgvpbz5unt4d6k2i5abyez7wnoxxa2ifaw6s5puzqd.onion/", "http://dfi7ynmrugokn4fgvpbz5unt4d6k2i5abyez7wnoxxa2ifaw6s5puzqd.onion/TOPDz/data/" ], "refs": [ "https://www.ransomlook.io/group/lulzsec muslims" ] }, "uuid": "2492a6db-3f8c-5429-a5c0-c0dcc08aa000", "value": "lulzsec muslims" }, { "meta": { "links": [ "http://cloak7jpvcb73rtx2ff7kaw2kholu7bdiivxpzbhlny4ybz75dpxckqd.onion" ], "refs": [ "https://www.ransomlook.io/group/cloak" ] }, "uuid": "c4a19468-e34d-527f-a88c-32f75419bf8f", "value": "cloak" }, { "meta": { "links": [ "http://basemmnnqwxevlymli5bs36o5ynti55xojzvn246spahniugwkff2pad.onion/", "http://xb6q2aggycmlcrjtbjendcnnwpmmwbosqaugxsqb4nx6cmod3emy7sad.onion" ], "refs": [ "https://www.ransomlook.io/group/8base" ] }, "uuid": "1cc6ada3-a632-54a4-9df1-f41287e3f566", "value": "8base" }, { "meta": { "links": [ "http://noescaperjh3gg6oy7rck57fiefyuzmj7kmvojxgvlmwd5pdzizrb7ad.onion/login", "http://noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion/", "http://noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion/archive" ], "refs": [ "https://www.ransomlook.io/group/noescape" ] }, "uuid": "1f016089-b996-5695-81b0-4a93eacb5b6d", "value": "noescape" }, { "description": "", "meta": { "links": [ "http://weg7sdx54bevnvulapqu6bpzwztryeflq3s23tegbmnhkbpqz637f2yd.onion" ], "refs": [ "https://www.ransomlook.io/group/black suit" ] }, "uuid": "300f682f-707f-590f-9202-87f0ce6c1a04", "value": "black suit" }, { "description": "", "meta": { "links": [ "https://werewolves.pro", "https://weerwolven.biz/en/ " ], "refs": [ "https://www.ransomlook.io/group/werewolves" ] }, "uuid": "3b35ff68-a503-54a1-9bc0-d7664340a5da", "value": "werewolves" }, { "meta": { "links": [ "http://kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion/" ], "refs": [ "https://www.ransomlook.io/group/killsec" ] }, "uuid": "f2eeb8ab-160c-5e4a-bf04-bc93cff90622", "value": "killsec" }, { "meta": { "links": [ "http://z5jixbfejdu5wtxd2baliu6hwzgcitlspnttr7c2eopl5ccfcjrhkqid.onion" ], "refs": [ "https://www.ransomlook.io/group/rabbit hole" ] }, "uuid": "10f83e56-37f2-56ec-84c7-b9c80a3dcfee", "value": "rabbit hole" }, { "meta": { "links": [ "http://f6amq3izzsgtna4vw24rpyhy3ofwazlgex2zqdssavevvkklmtudxjad.onion/", "http://f6amq3izzsgtna4vw24rpyhy3ofwazlgex2zqdssavevvkklmtudxjad.onion/market.html", "https://ransomed.vc/market.html", "https://ransomed.vc/" ], "refs": [ "https://www.ransomlook.io/group/raznatovic" ] }, "uuid": "9f8fb586-8511-5baf-a74f-f8d224beac4c", "value": "raznatovic" }, { "meta": { "links": [ "http://3ev4metjirohtdpshsqlkrqcmxq6zu3d7obrdhglpy5jpbr7whmlfgqd.onion" ], "refs": [ "https://www.ransomlook.io/group/abyss-data" ] }, "uuid": "77e2a547-8288-58f0-ba41-b3c2eb57f24a", "value": "abyss-data" }, { "meta": { "links": [ "http://cryptr3fmuv4di5uiczofjuypopr63x2gltlsvhur2ump4ebru2xd3yd.onion", "http://blog6zw62uijolee7e6aqqnqaszs3ckr5iphzdzsazgrpvtqtjwqryid.onion/" ], "refs": [ "https://www.ransomlook.io/group/cryptnet" ] }, "uuid": "e5cc7cd8-3b03-592e-aaed-7a9807647857", "value": "cryptnet" }, { "meta": { "links": [ "http://hscr6cjzhgoybibuzn2xud7u4crehuoo4ykw3swut7m7irde74hdfzyd.onion/" ], "refs": [ "https://www.ransomlook.io/group/losttrust" ] }, "uuid": "a494c749-5902-5aa7-b0da-16de28230b1c", "value": "losttrust" }, { "meta": { "links": [ "http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/", "http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/archive.php", "http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/archive.php?auction", "http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion/" ], "refs": [ "https://www.ransomlook.io/group/rhysida" ] }, "uuid": "00cfde20-21c2-547c-ae07-ff42da937b38", "value": "rhysida" }, { "meta": { "links": [ "http://j3qxmk6g5sk3zw62i2yhjnwmhm55rfz47fdyfkhaithlpelfjdokdxad.onion/" ], "refs": [ "https://www.ransomlook.io/group/c3rb3r" ] }, "uuid": "80e280df-1cbd-5188-a938-0777db06741d", "value": "c3rb3r" }, { "meta": { "links": [ "http://6n5tfadusp4sarzuxntz34q4ohspiaya2mc6aw6uhlusfqfsdomavyyd.onion", "http://trigonax2zb3fw34rbaap4cqep76zofxs53zakrdgcxzq6xzt24l5lqd.onion", "http://trigonax2zb3fw34rbaap4cqep76zofxs53zakrdgcxzq6xzt24l5lqd.onion/api", "http://krsbhaxbki6jr4zvwblvkaqzjkircj7cxf46qt3na5o5sj2hpikbupqd.onion", "http://krsbhaxbki6jr4zvwblvkaqzjkircj7cxf46qt3na5o5sj2hpikbupqd.onion/api", "http://zp6la4xdki3irsenq3t7z7pu2nnaktqgob6aizlzjkdiyw6azjeuhzqd.onion" ], "refs": [ "https://www.ransomlook.io/group/trigona" ] }, "uuid": "6f03f532-e311-5ef8-bb1c-fe157419ec97", "value": "trigona" }, { "meta": { "links": [ "http://malas2urovbyyavjzaezkt5ohljvyd5lt7vv7mnsgbf2y4bwlh72doqd.onion/posts/", "http://malas2urovbyyavjzaezkt5ohljvyd5lt7vv7mnsgbf2y4bwlh72doqd.onion/atom.xml" ], "refs": [ "https://www.ransomlook.io/group/malas" ] }, "uuid": "b57a280c-73c5-5e74-b760-32a7caa3bdda", "value": "malas" }, { "meta": { "links": [ "http://5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion/" ], "refs": [ "https://www.ransomlook.io/group/space bears" ] }, "uuid": "65e46714-046c-51d9-bae8-c5aa6e967017", "value": "space bears" }, { "meta": { "links": [ "http://lc65fb3wrvox6xlyn4hklwjcojau55diqxxylqs4qsfng23ftzijnxad.onion" ], "refs": [ "https://www.ransomlook.io/group/shadow" ] }, "uuid": "346b5835-aae4-5093-bc4f-bdf5c63d3de7", "value": "shadow" }, { "description": "", "meta": { "links": [ "http://medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion", "http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion", "http://dlmfciajg5s4vliyo5dhs5jyzhi2xr2fnkebul46lpf4xudtqiue4nid.onion/" ], "refs": [ "https://www.ransomlook.io/group/medusa", "https://twitter.com/ThreatFabric/status/1285144962695340032", "https://www.threatfabric.com/blogs/partners-in-crime-medusa-cabassous.html", "https://www.threatfabric.com/blogs/the-rage-of-android-banking-trojans.html", "https://news.drweb.com/show/?i=10302&lng=en", "https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf", "https://www.arbornetworks.com/blog/asert/medusahttp-ddos-slithers-back-spotlight/", "https://zerophagemalware.com/2017/10/13/rig-ek-via-malvertising-drops-a-miner/" ] }, "uuid": "620c3817-320a-5772-acf1-008cc8852b0f", "value": "medusa" }, { "meta": { "links": [ "http://dkgn45pinr7nwvdaehemcrpgcjqf4fooit3c4gjw6dhzrp443ctvnoad.onion", "http://dkgn45pinr7nwvdaehemcrpgcjqf4fooit3c4gjw6dhzrp443ctvnoad.onion/leaks.html" ], "refs": [ "https://www.ransomlook.io/group/mogilevich" ] }, "uuid": "323fb0b1-b27d-5bd7-aaa0-ab31df49f3b7", "value": "mogilevich" }, { "meta": { "links": [ "https://malekteam.ac", "http://195.14.123.2/" ], "refs": [ "https://www.ransomlook.io/group/malek team" ] }, "uuid": "5feb8180-266f-5971-ab50-58f3eb7c321c", "value": "malek team" }, { "meta": { "links": [ "http://pa32ymaeu62yo5th5mraikgw5fcvznnsiiwti42carjliarodltmqcqd.onion", "http://hkpomcx622gnqp2qhenv4ceyrhwvld3zwogr4mnkdeudq2txf55keoad.onion", "http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion" ], "refs": [ "https://www.ransomlook.io/group/ra group" ] }, "uuid": "f75e53c0-e8c9-55d0-a419-c69272a645e8", "value": "ra group" }, { "meta": { "links": [ "http://3ytm3d25hfzvbylkxiwyqmpvzys5of7l4pbosm7ol7czlkplgukjq6yd.onion" ], "refs": [ "https://www.ransomlook.io/group/slug" ] }, "uuid": "5045afba-9ed7-590f-8db9-c9aedb5b7a76", "value": "slug" }, { "description": "Tesorion describes Lorenz as a ransomware with design and implementation flaws, leading to impossible decryption with tools provided by the attackers. A free decryptor for 2021 versions was made available via the NoMoreRansom initiative. A new version of the malware was discovered in March 2022, for which again was provided a free decryptor, while the ransomware operators are not able to provide tools to decrypt affected files.", "meta": { "links": [ "http://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion/" ], "refs": [ "https://www.ransomlook.io/group/lorenz", "https://www.zdnet.com/article/lorenz-ransomware-attack-victims-can-now-retrieve-their-files-for-free-with-this-decryption-tool", "https://www.cybertalk.org/the-worst-outcomes-lorenz-ransomware-a-new-double-extortion-strategy", "https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/", "https://therecord.media/free-decrypter-available-for-lorenz-ransomware/", "https://twitter.com/AltShiftPrtScn/status/1423190900516302860?s=20", "https://www.bleepingcomputer.com/news/security/meet-lorenz-a-new-ransomware-gang-targeting-the-enterprise/", "https://www.cybereason.com/blog/cybereason-vs.-lorenz-ransomware", "https://www.tesorion.nl/en/posts/lorenz-ransomware-analysis-and-a-free-decryptor/", "https://www.tesorion.nl/en/posts/lorenz-ransomware-rebound-corruption-and-irrecoverable-files/" ] }, "uuid": "b87375f3-fa83-5a36-af3a-801ca589cd49", "value": "lorenz" }, { "meta": { "links": [ "http://undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion", "http://ehehqyhw3iev2vfso4vqs7kcrzltfebe5vbimq62p2ja7pslczs3q6qd.onion/auth/login", "http://47glxkuxyayqrvugfumgsblrdagvrah7gttfscgzn56eyss5wg3uvmqd.onion/" ], "refs": [ "https://www.ransomlook.io/group/team underground" ] }, "uuid": "517cc412-6624-5daa-8539-1271c51d78b0", "value": "team underground" }, { "meta": { "links": [ "http://threeamkelxicjsaf2czjyz2lc4q3ngqkxhhlexyfcp2o6raw4rphyad.onion" ], "refs": [ "https://www.ransomlook.io/group/3am" ] }, "uuid": "1c8af0c6-7b20-5878-909d-6ac14429a9ed", "value": "3am" }, { "meta": { "links": [ "http://crosslock5cwfljbw4v37zuzq4talxxhyavjm2lufmjwgbpfjdsh56yd.onion/" ], "refs": [ "https://www.ransomlook.io/group/crosslock" ] }, "uuid": "e203cc8c-6df9-5561-b7f3-ab65ee4a8e6b", "value": "crosslock" }, { "meta": { "links": [ "http://nt3rrzq5hcyznvdkpslvqbbc2jqecqrinhi5jtwoae2x7psqtcb6dcad.onion/" ], "refs": [ "https://www.ransomlook.io/group/cyclops" ] }, "uuid": "e4b7ba12-79b7-5728-a4db-1f718959c81c", "value": "cyclops" }, { "meta": { "links": [ "http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog" ], "refs": [ "https://www.ransomlook.io/group/dragonforce" ] }, "uuid": "9cd58774-1f45-52dd-9c00-0050151cb093", "value": "dragonforce" }, { "description": "", "meta": { "links": [ "http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion/", "http://mjmru3yz65o5szsp4rmkmh4adlezcpy5tqjjc4y5z6lozk3nnz2da2ad.onion/" ], "refs": [ "https://www.ransomlook.io/group/ransomhub" ] }, "uuid": "9a1bfbf8-e07c-55d0-9ca5-3bcfa67f2468", "value": "ransomhub" }, { "meta": { "links": [ "http://et22fibzuzfyzgurm35sttm52qbzvdgzy5qhzy46a3gmkrrht3lec5ad.onion/", "http://h3txev6jev7rcm6p2qkxn2vctybi4dvochr3inymzgif53n2j2oqviqd.onion/", "http://wx3djgl4cacl6y4x7r4e4mbqrrub24ectue7ixyix2du25nfowtvfiyd.onion" ], "refs": [ "https://www.ransomlook.io/group/la piovra" ] }, "uuid": "590734bf-3e26-5c67-8a9d-ddb1a62a0bed", "value": "la piovra" }, { "meta": { "links": [ "https://discord.com/invite/jjZQdDNnG" ], "refs": [ "https://www.ransomlook.io/group/wiper leak" ] }, "uuid": "d4362ac0-1dcc-5df4-a890-1d1d3505425e", "value": "wiper leak" }, { "description": "Ransomware", "meta": { "links": [ "http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion", "http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion" ], "refs": [ "https://www.ransomlook.io/group/play", "https://chuongdong.com/reverse%20engineering/2022/09/03/PLAYRansomware/", "https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html", "https://www.sentinelone.com/labs/crimeware-trends-ransomware-developers-turn-to-intermittent-encryption-to-evade-detection/" ] }, "uuid": "353be17b-d108-55e9-a0f1-2f4829183df0", "value": "play" }, { "description": "Also known as MedusaLocker", "meta": { "links": [ "http://z6wkgghtoawog5noty5nxulmmt2zs7c3yvwr22v4czbffdoly2kl4uad.onion", "http://qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion/ " ], "refs": [ "https://www.ransomlook.io/group/ransomware blog" ] }, "uuid": "7b4a7253-b508-56c8-aec8-981e087d1b34", "value": "ransomware blog" }, { "meta": { "links": [ "http://orfc3joknhrzscdbuxajypgrvlcawtuagbj7f44ugbosuvavg3dc3zid.onion/victim.html#", "http://orfc3joknhrzscdbuxajypgrvlcawtuagbj7f44ugbosuvavg3dc3zid.onion/", "http://pkk4gbz7lsbgeja6s6iwsan2ce364sqioici65swwt65uhicke65uyid.onion/", "http://5qmw6mv5ucbeskd3rv6vgn5dqgsuectmtqvz4paukmvhtlazzkuxuwqd.onion/", "http://5qmw6mv5ucbeskd3rv6vgn5dqgsuectmtqvz4paukmvhtlazzkuxuwqd.onion/victim.html", "http://pkk4gbz7lsbgeja6s6iwsan2ce364sqioici65swwt65uhicke65uyid.onion/victim.html" ], "refs": [ "https://www.ransomlook.io/group/trisec" ] }, "uuid": "654d3f47-e30f-593c-9581-885c8d0ef7d5", "value": "trisec" }, { "meta": { "links": [ "http://62brsjf2w77ihz5paods33cdgqnon54gjns5nmag3hmqv6fcwamtkmad.onion/" ], "refs": [ "https://www.ransomlook.io/group/qiulong" ] }, "uuid": "2b57c176-af54-5165-afb6-845d88049b18", "value": "qiulong" }, { "meta": { "links": [ "https://cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion", "https://cactus5dqnqkppa5ayckiyk6dttpqwczdqphv5mxh4dkk5ct544q5aad.onion/" ], "refs": [ "https://www.ransomlook.io/group/cactus" ] }, "uuid": "e888321e-c84a-5fa7-8761-dd2aaef691b8", "value": "cactus" }, { "meta": { "links": [ "http://ciphbitqyg26jor7eeo6xieyq7reouctefrompp6ogvhqjba7uo4xdid.onion/" ], "refs": [ "https://www.ransomlook.io/group/ciphbit" ] }, "uuid": "4ca1395f-a6c2-5351-8c93-f746f7562e56", "value": "ciphbit" }, { "description": "", "meta": { "links": [ "http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion", "http://incapt.blog/", "http://incapt.su/blog/leaks", "http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures" ], "refs": [ "https://www.ransomlook.io/group/inc ransom" ] }, "uuid": "382c9986-8a55-5917-b04e-b0bf2e495320", "value": "inc ransom" }, { "description": "", "meta": { "links": [ "http://arcuufpr5xxbbkin4mlidt7itmr6znlppk63jbtkeguuhszmc5g7qdyd.onion" ], "refs": [ "https://www.ransomlook.io/group/arcus media" ] }, "uuid": "30179cca-34c6-5cec-bc66-cc4e404c7d82", "value": "arcus media" }, { "meta": { "links": [ "http://jos666vxenlqp4xpnsxehovnaumi4c3q4bmvhpgdyz7bsk3ho3caokad.onion/" ], "refs": [ "https://www.ransomlook.io/group/jo of satan" ] }, "uuid": "8f0a410b-a73f-552b-8a05-6c5725eda76d", "value": "jo of satan" }, { "meta": { "links": [ "http://ze677xuzard4lx4iul2yzf5ks4gqqzoulgj5u4n5n4bbbsxjbfr7eayd.onion/" ], "refs": [ "https://www.ransomlook.io/group/rancoz" ] }, "uuid": "68b2f074-abf9-5a9b-b2a2-b804129acb31", "value": "rancoz" }, { "meta": { "links": [ "http://p66slxmtum2ox4jpayco6ai3qfehd5urgrs4oximjzklxcol264driqd.onion/index.html" ], "refs": [ "https://www.ransomlook.io/group/dunghill" ] }, "uuid": "5eadcdf1-b21b-5e62-867d-332cd9bfac68", "value": "dunghill" }, { "meta": { "links": [ "http://contiuevxdgdhn3zl2kubpajtfgqq4ssj2ipv6ujw7fwhggev3rk6hqd.onion" ], "refs": [ "https://www.ransomlook.io/group/u-bomb" ] }, "uuid": "48fa0281-81fd-5f46-a6ea-55ae3f92f243", "value": "u-bomb" }, { "meta": { "links": [ "http://crypuglupv3bsqnbt5ruu5lgwrwoaojscwhuoccbmbzmcidft5kiccqd.onion" ], "refs": [ "https://www.ransomlook.io/group/cryptbb" ] }, "uuid": "caf4f04c-bbc1-56a6-993e-e1a297985cb9", "value": "cryptbb" }, { "meta": { "links": [ "http://noname2j6zkgnt7ftxsjju5tfd3s45s4i3egq5bqtl72kgum4ldc6qyd.onion", "https://www.lockbitblog.info/" ], "refs": [ "https://www.ransomlook.io/group/noname" ] }, "uuid": "23052672-401c-5e1e-89da-2697144ce984", "value": "noname" }, { "description": "", "meta": { "links": [ "http://knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion/" ], "refs": [ "https://www.ransomlook.io/group/knight" ] }, "uuid": "9de51a68-32b5-562d-9ebb-4727d910550e", "value": "knight" }, { "meta": { "links": [ "http://zeonrefpbompx6rwdqa5hxgtp2cxgfmoymlli3azoanisze33pp3x3yd.onion" ], "refs": [ "https://www.ransomlook.io/group/zeon" ] }, "uuid": "70badbdc-33fd-5849-a04d-382229713027", "value": "zeon" }, { "meta": { "links": [ "http://nv5lbsrr4rxmewzmpe25nnalowe4ga7ki6yfvit3wlpu7dfc36pyh4ad.onion/", "http://gfksiwpsqudibondm6o2ipxymaonehq3l26qpgqr3nh4jvcyayvogcid.onion/", "http://gfksiwpsqudibondm6o2ipxymaonehq3l26qpgqr3nh4jvcyayvogcid.onion/Insane.html", "http://nv5lbsrr4rxmewzmpe25nnalowe4ga7ki6yfvit3wlpu7dfc36pyh4ad.onion/Insane.html", "http://r2ad4ayrgpf7og673lhrw5oqyvqg4em2fpialk7l7gxkasvqkqow4qad.onion/", "http://r2ad4ayrgpf7og673lhrw5oqyvqg4em2fpialk7l7gxkasvqkqow4qad.onion/Insane.html" ], "refs": [ "https://www.ransomlook.io/group/insane ransomware" ] }, "uuid": "b90acd97-b7f3-5523-9344-5fe5ebc2f05f", "value": "insane ransomware" }, { "meta": { "links": [ "https://ransomed.vc/", "http://k63fo4qmdnl4cbt54sso3g6s5ycw7gf7i6nvxl3wcf3u6la2mlawt5qd.onion", "http://f6amq3izzsgtna4vw24rpyhy3ofwazlgex2zqdssavevvkklmtudxjad.onion/" ], "refs": [ "https://www.ransomlook.io/group/ransomed" ] }, "uuid": "627ac5f6-55fe-5fe4-887c-d994ec9fc1c7", "value": "ransomed" }, { "meta": { "links": [ "http://sewo2yliwvgca3abz565nsnnx3khi6x7t5ccpbvvg6wgce4bk2jagiad.onion/" ], "refs": [ "https://www.ransomlook.io/group/ransom corp" ] }, "uuid": "4e96c839-70cf-5d5b-940f-168ff6285721", "value": "ransom corp" }, { "meta": { "links": [ "http://g3h3klsev3eiofxhykmtenmdpi67wzmaixredk5pjuttbx7okcfkftqd.onion" ], "refs": [ "https://www.ransomlook.io/group/donex" ] }, "uuid": "bc89266b-31d5-5627-9d1d-822ff84792be", "value": "donex" }, { "meta": { "links": [ "http://blogvl7tjyjvsfthobttze52w36wwiz34hrfcmorgvdzb6hikucb7aqd.onion" ], "refs": [ "https://www.ransomlook.io/group/money message" ] }, "uuid": "cd2de3e2-9e43-5f8d-89ec-6cd2c8bad1b8", "value": "money message" }, { "meta": { "links": [ "https://handala.to/" ], "refs": [ "https://www.ransomlook.io/group/handala" ] }, "uuid": "f7e8b3a4-755e-5328-8cb3-3786d330d95a", "value": "handala" }, { "description": "", "meta": { "links": [ "http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion" ], "refs": [ "https://www.ransomlook.io/group/embargo" ] }, "uuid": "1d275681-09a8-5c54-8736-5c0a1b8ae7eb", "value": "embargo" }, { "description": "", "meta": { "links": [ "http://mdhby62yvvg6sd5jmx5gsyucs7ynb5j45lvvdh4dsymg43puitu7tfid.onion" ], "refs": [ "https://www.ransomlook.io/group/darkvault" ] }, "uuid": "4f61f5f9-a00a-5390-8514-3510d84f0947", "value": "darkvault" }, { "description": "", "meta": { "links": [ "http://meow6xanhzfci2gbkn3lmbqq7xjjufskkdfocqdngt3ltvzgqpsg5mid.onion/" ], "refs": [ "https://www.ransomlook.io/group/meow" ] }, "uuid": "406205b7-bb95-5687-aea0-4e915e743f40", "value": "meow" }, { "meta": { "links": [ "https://apos.blog" ], "refs": [ "https://www.ransomlook.io/group/apos" ] }, "uuid": "ee97d01c-b8b9-5c36-9c27-134f8d2ee603", "value": "apos" } ], "version": 123 }