{"id":295,"date":"2023-09-29T19:41:44","date_gmt":"2023-09-30T02:41:44","guid":{"rendered":"http:\/\/improdango.com\/?page_id=295"},"modified":"2023-09-30T08:26:13","modified_gmt":"2023-09-30T15:26:13","slug":"dfir-report","status":"publish","type":"page","link":"http:\/\/improdango.com\/?page_id=295","title":{"rendered":"DFIR Report Dataset"},"content":{"rendered":"\n
\n
\n

↖ Data<\/a><\/p>\n<\/div>\n\n\n\n

<\/div>\n\n\n\n
\n

Intrusion Detection Evaluation Dataset ↗<\/a><\/p>\n<\/div>\n<\/div>\n\n\n\n

\"\"<\/figure>
\n
    \n
  • Accessed DFIR Report data via API to relevant report.\u200b<\/li>\n\n\n\n
  • Inserted results into a table.<\/li>\n\n\n\n
  • Table currently consists of 413 records.<\/li>\n<\/ul>\n<\/div><\/div>\n\n\n\n
    \n
    \n
    \n \n \n\n \n \n \n \n\n\n Description<\/th> Extensions<\/th> Extension Pattern<\/th> Ransom Note Filename(s)<\/th> Comment<\/th> Encryption Algorithm<\/th> Also known as<\/th> Date Added\/Modified<\/th> Decryptor<\/th> Info 1<\/th> Info 2<\/th> IOCs (Network Based Indicators)<\/th> IOCs (Host-Based Indicators)<\/th> <\/tr>\n<\/thead>\n \n\n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
    .CryptoHasYou.<\/td>\n .enc<\/td>\n <\/td>\n YOUR_FILES_ARE_LOCKED.txt<\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/CryptoHasYou.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    777<\/td>\n 0.777<\/td>\n ._[timestamp]_$[email]$.777\ne.g. ._14-05-2016-11-59-36_$ninja.gaiver@aol.com$.777<\/td>\n read_this_file.txt<\/td>\n <\/td>\n XOR<\/td>\n Sevleg<\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/777<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    7ev3n<\/td>\n .R4A\n.R5A<\/td>\n <\/td>\n FILES_BACK.txt<\/td>\n <\/td>\n <\/td>\n 7ev3n-HONE$T<\/td>\n <\/td>\n https:\/\/github.com\/hasherezade\/malware_analysis\/tree\/master\/7ev3n\nhttps:\/\/www.youtube.com\/watch?v=RDNbH5HDO1E&feature=youtu.be<\/td>\n http:\/\/www.nyxbone.com\/malware\/7ev3n-HONE$T.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    7h9r<\/td>\n .7h9r<\/td>\n <\/td>\n README_.TXT<\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/7h9r.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    8lock8<\/td>\n .8lock8<\/td>\n <\/td>\n READ_IT.txt<\/td>\n Based on HiddenTear<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/614025\/8lock8-help-support-topic-8lock8-read-ittxt\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    AiraCrop<\/td>\n ._AiraCropEncrypted<\/td>\n <\/td>\n How to decrypt your files.txt<\/td>\n related to TeamXRat<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/PolarToffee\/status\/796079699478900736<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Al-Namrood<\/td>\n .unavailable\n.disappeared<\/td>\n <\/td>\n Read_Me.Txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/al-namrood<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Alcatraz Locker<\/td>\n .Alcatraz<\/td>\n <\/td>\n ransomed.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/PolarToffee\/status\/792796055020642304<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    ALFA Ransomware<\/td>\n .bin<\/td>\n <\/td>\n README HOW TO DECRYPT YOUR FILES.HTML<\/td>\n Made by creators of Cerber<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/new-alfa-or-alpha-ransomware-from-the-same-devs-as-cerber\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Alma Ransomware<\/td>\n random<\/td>\n random(x5)<\/td>\n Unlock_files_randomx5.html<\/td>\n <\/td>\n AES(128)<\/td>\n <\/td>\n <\/td>\n https:\/\/cta-service-cms2.hubspot.com\/ctas\/v2\/public\/cs\/c\/?cta_guid=d4173312-989b-4721-ad00-8308fff353b3&placement_guid=22f2fe97-c748-4d6a-9e1e-ba3fb1060abe&portal_id=326665&redirect_url=APefjpGnqFjmP_xzeUZ1Y55ovglY1y1ch7CgMDLit5GTHcW9N0ztpnIE-ZReqqv8MDj687_4Joou7Cd2rSx8-De8uhFQAD_Len9QpT7Xvu8neW5drkdtTPV7hAaou0osAi2O61dizFXibewmpO60UUCd5OazCGz1V6yT_3UFMgL0x9S1VeOvoL_ucuER8g2H3f1EfbtYBw5QFWeUmrjk-9dGzOGspyn303k9XagBtF3SSX4YWSyuEs03Vq7Fxb04KkyKc4GJx-igK98Qta8iMafUam8ikg8XKPkob0FK6Pe-wRZ0QVWIIkM&hsutk=34612af1cd87864cf7162095872571d1&utm_referrer=https%3A%2F%2Finfo.phishlabs.com%2Fblog%2Falma-ransomware-analysis-of-a-new-ransomware-threat-and-a-decrypter&canon=https%3A%2F%2Finfo.phishlabs.com%2Fblog%2Falma-ransomware-analysis-of-a-new-ransomware-threat-and-a-decrypter&__hstc=61627571.34612af1cd87864cf7162095872571d1.1472135921345.1472140656779.1472593507113.3&__hssc=61627571.1.1472593507113&__hsfp=1114323283<\/td>\n https:\/\/info.phishlabs.com\/blog\/alma-ransomware-analysis-of-a-new-ransomware-threat-and-a-decrypter<\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/new-alma-locker-ransomware-being-distributed-via-the-rig-exploit-kit\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Alpha Ransomware<\/td>\n .encrypt<\/td>\n <\/td>\n Read Me (How Decrypt) !!!!.txt<\/td>\n <\/td>\n AES(256)<\/td>\n AlphaLocker<\/td>\n <\/td>\n http:\/\/download.bleepingcomputer.com\/demonslay335\/AlphaDecrypter.zip<\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/decrypted-alpha-ransomware-continues-the-trend-of-accepting-amazon-cards\/<\/td>\n https:\/\/twitter.com\/malwarebread\/status\/804714048499621888<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Alphabet<\/td>\n <\/td>\n <\/td>\n <\/td>\n Doesn't encrypt any files \/ provides you the key<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/PolarToffee\/status\/812331918633172992<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    AMBA<\/td>\n .amba<\/td>\n <\/td>\n \u041f\u0420\u041e\u0427\u0422\u0418_\u041c\u0415\u041d\u042f.txt\nREAD_ME.txt<\/td>\n Websites only\namba@riseup.net<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/benkow_\/status\/747813034006020096<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Angela Merkel<\/td>\n .angelamerkel<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/798268218364358656<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    AngleWare<\/td>\n .AngleWare<\/td>\n <\/td>\n READ_ME.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/844531418474708993<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Angry Duck<\/td>\n .adk<\/td>\n <\/td>\n <\/td>\n Demands 10 BTC<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/demonslay335\/status\/790334746488365057<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Anony<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Based on HiddenTear\nngocanh<\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/842047409446387714<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Anubis<\/td>\n .coded<\/td>\n <\/td>\n Decryption Instructions.txt<\/td>\n EDA2<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/nyxbone.com\/malware\/Anubis.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Apocalypse<\/td>\n .encrypted\n.SecureCrypted\n.FuckYourData\n.unavailable\n.bleepYourFiles\n.Where_my_files.txt<\/td>\n [filename].ID-*8characters+countrycode[cryptservice@inbox.ru].[random7characters]\n*filename*.ID-[A-F0-9]{8}+countrycode[cryptcorp@inbox.ru].[a-z0-9]{13}<\/td>\n *.How_To_Decrypt.txt\n*.Contact_Here_To_Recover_Your_Files.txt\n*.Where_my_files.txt\n*.Read_Me.Txt\n*md5*.txt<\/td>\n decryptionservice@mail.ru\nrecoveryhelp@bk.ru\nransomware.attack@list.ru\nesmeraldaencryption@mail.ru\ndr.compress@bk.ru<\/td>\n <\/td>\n Fabiansomeware<\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/apocalypse<\/td>\n http:\/\/blog.emsisoft.com\/2016\/06\/29\/apocalypse-ransomware-which-targets-companies-through-insecure-rdp\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    ApocalypseVM<\/td>\n .encrypted\n.locked<\/td>\n <\/td>\n *.How_To_Get_Back.txt<\/td>\n Apocalypse ransomware version which uses VMprotect<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/decrypter.emsisoft.com\/download\/apocalypsevm<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    ASN1<\/td>\n <\/td>\n <\/td>\n !!!!!readme!!!!!.htm<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/malwarebreakdown.com\/2017\/03\/02\/rig-ek-at-92-53-105-43-drops-asn1-ransomware\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    AutoLocky<\/td>\n .locky<\/td>\n <\/td>\n info.txt\ninfo.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/autolocky<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Aw3s0m3Sc0t7<\/td>\n .enc<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/828902907668000770<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    BadBlock<\/td>\n <\/td>\n <\/td>\n Help Decrypt.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/badblock<\/td>\n http:\/\/www.nyxbone.com\/malware\/BadBlock.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    BadEncript<\/td>\n .bript<\/td>\n <\/td>\n More.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/demonslay335\/status\/813064189719805952<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    BaksoCrypt<\/td>\n .adr<\/td>\n <\/td>\n <\/td>\n Based on my-Little-Ransomware<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/760482299007922176<\/td>\n https:\/\/0xc1r3ng.wordpress.com\/2016\/06\/24\/bakso-crypt-simple-ransomware\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Bandarchor<\/td>\n .id-1235240425_help@decryptservice.info<\/td>\n .id-[ID]_[EMAIL_ADDRESS]<\/td>\n HOW TO DECRYPT.txt<\/td>\n Files might be partially encrypted<\/td>\n AES(256)<\/td>\n Rakhni<\/td>\n <\/td>\n <\/td>\n https:\/\/reaqta.com\/2016\/03\/bandarchor-ransomware-still-active\/<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/new-bandarchor-ransomware-variant-spreads-via-malvertising-on-adult-sites\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    BarRax<\/td>\n .BarRax<\/td>\n <\/td>\n <\/td>\n Based on HiddenTear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/demonslay335\/status\/835668540367777792<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Bart<\/td>\n .bart.zip\n.bart\n.perl<\/td>\n <\/td>\n recover.txt\nrecover.bmp<\/td>\n Possible affiliations with RockLoader, Locky and Dridex<\/td>\n <\/td>\n BaCrypt<\/td>\n <\/td>\n http:\/\/now.avg.com\/barts-shenanigans-are-no-match-for-avg\/<\/td>\n http:\/\/phishme.com\/rockloader-downloading-new-ransomware-bart\/<\/td>\n https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/New-Bart-Ransomware-from-Threat-Actors-Spreading-Dridex-and-Locky<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    BitCryptor<\/td>\n .clf<\/td>\n <\/td>\n <\/td>\n Has a GUI.\nCryptoGraphic Locker family. Newer CoinVault variant.<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/noransom.kaspersky.com\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    BitStak<\/td>\n .bitstak<\/td>\n <\/td>\n <\/td>\n <\/td>\n Base64 + String Replacement<\/td>\n <\/td>\n <\/td>\n https:\/\/download.bleepingcomputer.com\/demonslay335\/BitStakDecrypter.zip<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    BlackShades Crypter<\/td>\n .Silent<\/td>\n <\/td>\n Hacked_Read_me_to_decrypt_files.html\nYourID.txt<\/td>\n <\/td>\n AES(256)<\/td>\n SilentShade<\/td>\n <\/td>\n <\/td>\n http:\/\/nyxbone.com\/malware\/BlackShades.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Blocatto<\/td>\n .blocatto<\/td>\n <\/td>\n <\/td>\n Based on HiddenTear<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/614456\/bloccato-ransomware-bloccato-help-support-leggi-questo-filetxt\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Booyah<\/td>\n <\/td>\n <\/td>\n <\/td>\n EXE was replaced to neutralize threat<\/td>\n <\/td>\n Salam!<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Brazilian<\/td>\n .lock<\/td>\n <\/td>\n MENSAGEM.txt<\/td>\n Based on EDA2<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/brazilianRansom.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Brazilian Globe<\/td>\n <\/td>\n .id-%ID%_garryweber@protonmail.ch<\/td>\n HOW_OPEN_FILES.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/821831437884211201<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    BrLock<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/ransomware-explosion-continues-cryptflle2-brlock-mm-locker-discovered<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Browlock<\/td>\n <\/td>\n <\/td>\n <\/td>\n no local encryption, browser only<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    BTCWare<\/td>\n .btcware<\/td>\n <\/td>\n #_HOW_TO_FIX_!.hta<\/td>\n Related to \/ new version of CryptXXX<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/845199679340011520<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Bucbi<\/td>\n <\/td>\n <\/td>\n <\/td>\n no file name change, no extension<\/td>\n GOST<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/researchcenter.paloaltonetworks.com\/2016\/05\/unit42-bucbi-ransomware-is-back-with-a-ukrainian-makeover\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    BuyUnlockCode<\/td>\n <\/td>\n (.*).encoded.([A-Z0-9]{9})<\/td>\n BUYUNLOCKCODE.txt<\/td>\n Does not delete Shadow Copies<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Central Security Treatment Organization<\/td>\n .cry<\/td>\n <\/td>\n !Recovery_[random_chars].html\n!Recovery_[random_chars].txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/625820\/central-security-treatment-organization-ransomware-help-topic-cry-extension\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Cerber<\/td>\n .cerber\n.cerber2\n.cerber3<\/td>\n <\/td>\n # DECRYPT MY FILES #.html\n# DECRYPT MY FILES #.txt\n# DECRYPT MY FILES #.vbs\n# README.hta\n_{RAND}_README.jpg\n_{RAND}_README.hta\n_HELP_DECRYPT_[A-Z0-9]{4-8}_.jpg\n_HELP_DECRYPT_[A-Z0-9]{4-8}_.hta\n_HELP_HELP_HELP_%random%.jpg\n_HELP_HELP_HELP_%random%.hta\n_HOW_TO_DECRYPT_[A-Z0-9]{4-8}_.jpg\n_HOW_TO_DECRYPT_[A-Z0-9]{4-8}_.hta<\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/blog.malwarebytes.org\/threat-analysis\/2016\/03\/cerber-ransomware-new-but-mature\/<\/td>\n https:\/\/community.rsa.com\/community\/products\/netwitness\/blog\/2016\/11\/04\/the-evolution-of-cerber-v410<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CerberTear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/795630452128227333<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Chimera<\/td>\n .crypt\n4 random characters, e.g., .PzZs, .MKJL<\/td>\n <\/td>\n YOUR_FILES_ARE_ENCRYPTED.HTML\nYOUR_FILES_ARE_ENCRYPTED.TXT\n.gif<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/chimera-ransomware-decryption-keys-released-by-petya-devs\/<\/td>\n https:\/\/blog.malwarebytes.org\/threat-analysis\/2015\/12\/inside-chimera-ransomware-the-first-doxingware-in-wild\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CHIP<\/td>\n .CHIP\n.DALE<\/td>\n <\/td>\n CHIP_FILES.txt\nDALE_FILES.TXT<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/malware-traffic-analysis.net\/2016\/11\/17\/index.html<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/rig-e-exploit-kit-now-distributing-new-chip-ransomware\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Click Me Game<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.youtube.com\/watch?v=Xe30kV4ip8w<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Clock<\/td>\n <\/td>\n <\/td>\n <\/td>\n Does not encrypt anything<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/794956809866018816<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CloudSword<\/td>\n <\/td>\n <\/td>\n Warning\u8b66\u544a.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/822653335681593345<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Cockblocker<\/td>\n .hannah<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/jiriatvirlab\/status\/801910919739674624<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CoinVault<\/td>\n .clf<\/td>\n <\/td>\n wallpaper.jpg<\/td>\n CryptoGraphic Locker family. \nHas a GUI.\nDo not confuse with CrypVault!<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/noransom.kaspersky.com\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Coverton<\/td>\n .coverton\n.enigma\n.czvxce<\/td>\n <\/td>\n !!!-WARNING-!!!.html\n!!!-WARNING-!!!.txt<\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/paying-the-coverton-ransomware-may-not-get-your-data-back\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Crptxxx<\/td>\n .crptxxx<\/td>\n <\/td>\n HOW_TO_FIX_!.txt<\/td>\n Uses @enigma0x3's UAC bypass<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/839467168760725508<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Cryaki<\/td>\n .{CRYPTENDBLACKDC}<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/viruses\/disinfection\/8547<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Crybola<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/viruses\/disinfection\/8547<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryFile<\/td>\n .criptiko\n.criptoko\n.criptokod\n.cripttt\n.aga<\/td>\n <\/td>\n SHTODELATVAM.txt\nInstructionaga.txt<\/td>\n <\/td>\n Moves bytes<\/td>\n <\/td>\n <\/td>\n http:\/\/virusinfo.info\/showthread.php?t=185396<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryLocker<\/td>\n .cry<\/td>\n <\/td>\n !Recovery_[random_chars].html\n!Recovery_[random_chars].txt<\/td>\n Identifies victim locations w\/Google Maps API<\/td>\n <\/td>\n Cry, CSTO, Central Security Treatment Organization<\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/the-crylocker-ransomware-communicates-using-udp-and-stores-data-on-imgur-com\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CrypMIC<\/td>\n <\/td>\n <\/td>\n README.TXT\nREADME.HTML\nREADME.BMP<\/td>\n CryptXXX clone\/spinoff<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/crypmic-ransomware-wants-to-follow-cryptxxx\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Crypren<\/td>\n .ENCRYPTED<\/td>\n <\/td>\n READ_THIS_TO_DECRYPT.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/github.com\/pekeinfo\/DecryptCrypren<\/td>\n http:\/\/www.nyxbone.com\/malware\/Crypren.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Crypt38<\/td>\n .crypt38<\/td>\n <\/td>\n <\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n https:\/\/download.bleepingcomputer.com\/demonslay335\/Crypt38Keygen.zip<\/td>\n https:\/\/blog.fortinet.com\/2016\/06\/17\/buggy-russian-ransomware-inadvertently-allows-free-decryption<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptConsole<\/td>\n random<\/td>\n decipher_ne@outlook.com_[encrypted_filename]\nunCrypte@outlook.com_[encrypted_filename]<\/td>\n How decrypt files.hta<\/td>\n Impersonates the Globe Ransomware\nWill not actually encrypt files<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/forums\/t\/638344\/cryptconsole-uncrypteoutlookcom-support-topic-how-decrypt-fileshta\/<\/td>\n https:\/\/twitter.com\/PolarToffee\/status\/824705553201057794<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Cryptear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n AES(256)<\/td>\n Hidden Tear<\/td>\n <\/td>\n http:\/\/www.utkusen.com\/blog\/dealing-with-script-kiddies-cryptear-b-incident.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Crypter<\/td>\n <\/td>\n <\/td>\n <\/td>\n Does not actually encrypt the files, but simply renames them<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/jiriatvirlab\/status\/802554159564062722<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptFIle2<\/td>\n .scl<\/td>\n id[_ID]email_xerx@usa.com.scl<\/td>\n <\/td>\n <\/td>\n RSA<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/ransomware-explosion-continues-cryptflle2-brlock-mm-locker-discovered<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptInfinite<\/td>\n .crinf<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoBit<\/td>\n <\/td>\n <\/td>\n OKSOWATHAPPENDTOYOURFILES.TXT<\/td>\n sekretzbel0ngt0us.KEY\ndo not confuse with CryptorBit<\/td>\n AES and RSA<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.pandasecurity.com\/mediacenter\/panda-security\/cryptobit\/<\/td>\n http:\/\/news.softpedia.com\/news\/new-cryptobit-ransomware-could-be-decryptable-503239.shtml<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoBlock<\/td>\n <\/td>\n <\/td>\n <\/td>\n RaaS<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/drProct0r\/status\/810500976415281154<\/td>\n https:\/\/blog.malwarebytes.com\/threat-analysis\/2017\/03\/cryptoblock-and-its-c2\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoDefense<\/td>\n <\/td>\n <\/td>\n HOW_DECRYPT.TXT\nHOW_DECRYPT.HTML\nHOW_DECRYPT.URL<\/td>\n no extension change<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoDevil<\/td>\n .devil<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/PolarToffee\/status\/843527738774507522<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoFinancial<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Ranscam<\/td>\n <\/td>\n <\/td>\n http:\/\/blog.talosintel.com\/2016\/07\/ranscam.html<\/td>\n https:\/\/nakedsecurity.sophos.com\/2016\/07\/13\/ransomware-that-demands-money-and-gives-you-back-nothing\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoFortress<\/td>\n .frtrss<\/td>\n <\/td>\n READ IF YOU WANT YOUR FILES BACK.html<\/td>\n Mimics Torrentlocker. Encrypts only 50% of each file up to 5 MB<\/td>\n AES(256), RSA (1024)<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoGraphic Locker<\/td>\n .clf<\/td>\n <\/td>\n wallpaper.jpg<\/td>\n Has a GUI.\nSubvariants: CoinVault\nBitCryptor<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoHost<\/td>\n <\/td>\n <\/td>\n <\/td>\n RAR's victim's files\nhas a GUI<\/td>\n AES(256) (RAR implementation)<\/td>\n Manamecrypt, Telograph, ROI Locker<\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/cryptohost-decrypted-locks-files-in-a-password-protected-rar-file\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoJacky<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/jiriatvirlab\/status\/838779371750031360<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoJoker<\/td>\n .crjoker<\/td>\n <\/td>\n README!!!.txt\nGetYouFiles.txt\ncrjoker.html<\/td>\n <\/td>\n AES-256<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoLocker<\/td>\n .encrypted \n.ENC<\/td>\n <\/td>\n <\/td>\n no longer relevant<\/td>\n RSA<\/td>\n <\/td>\n <\/td>\n https:\/\/www.fireeye.com\/blog\/executive-perspective\/2014\/08\/your-locker-of-information-for-cryptolocker-decryption.html<\/td>\n https:\/\/reaqta.com\/2016\/04\/uncovering-ransomware-distribution-operation-part-2\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoLocker 1.0.0<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/839747940122001408<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoLocker 5.1<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/782890104947867649<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoLuck \/ YafunnLocker<\/td>\n .[victim_id]_luck<\/td>\n [A-F0-9]{8}_luck<\/td>\n %AppData%\\@WARNING_FILES_ARE_ENCRYPTED.[victim_id].txt.<\/td>\n via RIG EK<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/cryptoluck-ransomware-being-malvertised-via-rig-e-exploit-kits\/<\/td>\n https:\/\/twitter.com\/malwareforme\/status\/798258032115322880<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoMix<\/td>\n .code\n.scl\n.rmd\n.lesli\n.rdmk\n.CRYPTOSHIELD\n.CRYPTOSHIEL<\/td>\n .id_(ID_MACHINE)_email_xoomx@dr.com_.code\n.id_*_email_zeta@dr.com\n.id_(ID_MACHINE)_email_anx@dr.com_.scl\n.email[supl0@post.com]id[\\[[a-z0-9]{16}\\]].lesli\n*filename*.email[*email*]_id[*id*].rdmk<\/td>\n HELP_YOUR_FILES.html (CryptXXX)\nHELP_YOUR_FILES.txt (CryptoWall 3.0, 4.0)\nINSTRUCTION RESTORE FILE.TXT<\/td>\n <\/td>\n <\/td>\n Zeta<\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/CryptoMix.html<\/td>\n https:\/\/www.cert.pl\/en\/news\/single\/technical-analysis-of-cryptomixcryptfile2-ransomware\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptON<\/td>\n _crypt\n.id-_locked\n.id-_locked_by_krec\n.id-_locked_by_perfect\n.id-_x3m\n.id-_r9oj\n.id-_garryweber@protonmail.ch\n.id-_steaveiwalker@india.com_\n.id-_julia.crown@india.com_\n.id-_tom.cruz@india.com_\n.id-_CarlosBoltehero@india.com_\n.id-_maria.lopez1@india.com_<\/td>\n name_crypt..extension<\/td>\n <\/td>\n <\/td>\n RSA, AES-256 and SHA-256<\/td>\n Nemesis\nX3M<\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/crypton<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/crypton-ransomware-is-here-and-its-not-so-bad-\/<\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/829353444632825856<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoRansomeware<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/817672617658347521<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Cryptorium<\/td>\n .ENC<\/td>\n <\/td>\n <\/td>\n Only renames files and does not encrypt them<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoRoger<\/td>\n .crptrgr<\/td>\n <\/td>\n !Where_are_my_files!.html<\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/new-ransomware-called-cryptoroger-that-appends-crptrgr-to-encrypted-files\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoShadow<\/td>\n .doomed<\/td>\n <\/td>\n LEER_INMEDIATAMENTE.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/821992610164277248<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoShield<\/td>\n .CRYPTOSHIELD<\/td>\n grfg.wct.CRYPTOSHIELD<\/td>\n # RESTORING FILES #.HTML\n# RESTORING FILES #.TXT<\/td>\n CryptoMix Variant<\/td>\n AES(256) \/ ROT-13<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/cryptomix-variant-named-cryptoshield-1-0-ransomware-distributed-by-exploit-kits\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoShocker<\/td>\n .locked<\/td>\n <\/td>\n ATTENTION.url<\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/617601\/cryptoshocker-ransomware-help-and-support-topic-locked-attentionurl\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoTorLocker2015<\/td>\n .CryptoTorLocker2015!<\/td>\n <\/td>\n HOW TO DECRYPT FILES.txt\n%Temp%\\.bmp<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/565020\/new-cryptotorlocker2015-ransomware-discovered-and-easily-decrypted\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoTrooper<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/news.softpedia.com\/news\/new-open-source-linux-ransomware-shows-infosec-community-divide-508669.shtml<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoWall 1<\/td>\n <\/td>\n no filename change<\/td>\n DECRYPT_INSTRUCTION.HTML\nDECRYPT_INSTRUCTION.TXT\nDECRYPT_INSTRUCTION.URL\nINSTALL_TOR.URL<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoWall 2<\/td>\n <\/td>\n no filename change<\/td>\n HELP_DECRYPT.TXT\nHELP_DECRYPT.PNG\nHELP_DECRYPT.URL\nHELP_DECRYPT.HTML<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoWall 3<\/td>\n <\/td>\n no filename change<\/td>\n HELP_DECRYPT.TXT\nHELP_DECRYPT.PNG\nHELP_DECRYPT.URL\nHELP_DECRYPT.HTML<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/blogs.technet.microsoft.com\/mmpc\/2015\/01\/13\/crowti-update-cryptowall-3-0\/<\/td>\n https:\/\/www.virustotal.com\/en\/file\/45317968759d3e37282ceb75149f627d648534c5b4685f6da3966d8f6fca662d\/analysis\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoWall 4<\/td>\n <\/td>\n ., e.g.,\n27p9k967z.x1nep<\/td>\n HELP_YOUR_FILES.HTML\nHELP_YOUR_FILES.PNG<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptoWire<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/791554654664552448<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/-proof-of-concept-cryptowire-ransomware-spawns-lomix-and-ultralocker-families\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptXXX<\/td>\n .crypt<\/td>\n <\/td>\n de_crypt_readme.bmp, .txt, .html<\/td>\n Comes with Bedep<\/td>\n <\/td>\n CryptProjectXXX<\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/viruses\/disinfection\/8547<\/td>\n http:\/\/www.bleepingcomputer.com\/virus-removal\/cryptxxx-ransomware-help-information<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptXXX 2.0<\/td>\n .crypt<\/td>\n <\/td>\n .txt, .html, .bmp<\/td>\n Locks screen. Ransom note names are an ID.\nComes with Bedep.<\/td>\n <\/td>\n CryptProjectXXX<\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/viruses\/disinfection\/8547<\/td>\n https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/cryptxxx2-ransomware-authors-strike-back-against-free-decryption-tool<\/td>\n http:\/\/blogs.cisco.com\/security\/cryptxxx-technical-deep-dive<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptXXX 3.0<\/td>\n .crypt\n.cryp1\n.crypz\n.cryptz\nrandom<\/td>\n <\/td>\n <\/td>\n Comes with Bedep<\/td>\n <\/td>\n UltraDeCrypter\nUltraCrypter<\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/viruses\/disinfection\/8547<\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/cryptxxx-updated-to-version-3-0-decryptors-no-longer-work\/<\/td>\n http:\/\/blogs.cisco.com\/security\/cryptxxx-technical-deep-dive<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryptXXX 3.1<\/td>\n .cryp1<\/td>\n <\/td>\n <\/td>\n StilerX credential stealing<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/viruses\/disinfection\/8547<\/td>\n https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/cryptxxx-ransomware-learns-samba-other-new-tricks-with-version3100<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CryPy<\/td>\n .cry<\/td>\n <\/td>\n README_FOR_DECRYPT.txt<\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Crysis<\/td>\n .bip<\/td>\n .id-[id].[email].bip<\/td>\n <\/td>\n Locks screen. Ransom note ask to contact 888@cock.email. Attack timeline shows machine was compromised by RDP bruteforce first then implant the ransomware as final step<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/new-arena-crysis-ransomware-variant-released\/<\/td>\n https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/brute-force-rdp-attacks-plant-crysis-ransomware\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CTB-Faker<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/ctb-faker-ransomware-does-a-poor-job-imitating-ctb-locker\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CTB-Locker<\/td>\n .ctbl<\/td>\n .([a-z]{6,7})<\/td>\n AllFilesAreLocked .bmp\nDecryptAllFiles .txt\n.html<\/td>\n <\/td>\n RSA(2048)<\/td>\n Citroni<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CTB-Locker WEB<\/td>\n <\/td>\n <\/td>\n <\/td>\n websites only<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/thisissecurity.net\/2016\/02\/26\/a-lockpicking-exercise\/<\/td>\n https:\/\/github.com\/eyecatchup\/Critroni-php<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    CuteRansomware<\/td>\n .\u5df2\u52a0\u5bc6\n.encrypted<\/td>\n <\/td>\n \u4f60\u7684\u6a94\u6848\u88ab\u6211\u5011\u52a0\u5bc6\u5566!!!.txt\nYour files encrypted by our friends !!! txt<\/td>\n Based on my-Little-Ransomware<\/td>\n AES(128)<\/td>\n my-Little-Ransomware<\/td>\n <\/td>\n https:\/\/github.com\/aaaddress1\/my-Little-Ransomware\/tree\/master\/decryptoTool<\/td>\n https:\/\/github.com\/aaaddress1\/my-Little-Ransomware<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Cyber SpLiTTer Vbs<\/td>\n <\/td>\n <\/td>\n <\/td>\n Based on HiddenTear<\/td>\n <\/td>\n CyberSplitter<\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/778871886616862720<\/td>\n https:\/\/twitter.com\/struppigel\/status\/806758133720698881<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Damage<\/td>\n .damage<\/td>\n <\/td>\n <\/td>\n Written in Delphi<\/td>\n Combination of SHA-1 and Blowfish<\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/damage<\/td>\n https:\/\/twitter.com\/demonslay335\/status\/835664067843014656<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Dharma<\/td>\n .dharma\n.wallet\n.zzzzz\n.adobe<\/td>\n ..(dharma|wallet|zzzzz)\n.id-%ID%.[moneymaker2@india.com].wallet<\/td>\n README.txt\nREADME.jpg\nInfo.hta<\/td>\n CrySiS variant<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/kaspersky-releases-decryptor-for-the-dharma-ransomware\/<\/td>\n https:\/\/www.bleepingcomputer.com\/forums\/t\/632389\/dharma-ransomware-filenameemailwalletbipcmbarena-support-topic\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Deadly for a Good Purpose<\/td>\n <\/td>\n <\/td>\n <\/td>\n Encrypts in 2017<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/785533373007728640<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Death Bitches<\/td>\n .locked<\/td>\n <\/td>\n READ_IT.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JaromirHorejsi\/status\/815555258478981121<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    DeCrypt Protect<\/td>\n .html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.malwareremovalguides.info\/decrypt-files-with-decrypt_mblblock-exe-decrypt-protect\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    DEDCryptor<\/td>\n .ded<\/td>\n <\/td>\n <\/td>\n Based on EDA2<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/617395\/dedcryptor-ded-help-support-topic\/<\/td>\n http:\/\/www.nyxbone.com\/malware\/DEDCryptor.html<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Demo<\/td>\n .encrypted<\/td>\n <\/td>\n HELP_YOUR_FILES.txt<\/td>\n only encrypts .jpg files<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/798573300779745281<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Depsex<\/td>\n .Locked-by-Mafia<\/td>\n <\/td>\n READ_ME.txt<\/td>\n Based on HiddenTear<\/td>\n <\/td>\n MafiaWare<\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/817069320937345024<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    DeriaLock<\/td>\n .deria<\/td>\n <\/td>\n unlock-everybody.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/new-derialock-ransomware-active-on-christmas-includes-an-unlock-all-command\/<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/new-derialock-ransomware-active-on-christmas-includes-an-unlock-all-command\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    DetoxCrypto<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n AES<\/td>\n Based on Detox:\nCalipso\nWe are all Pokemons\nNullbyte<\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/new-detoxcrypto-ransomware-pretends-to-be-pokemongo-or-uploads-a-picture-of-your-screen\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Digisom<\/td>\n <\/td>\n <\/td>\n Digisom Readme0.txt (0 to 9)<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/PolarToffee\/status\/829727052316160000<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    DirtyDecrypt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/demonslay335\/status\/752586334527709184<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    DMALocker<\/td>\n <\/td>\n <\/td>\n cryptinfo.txt\ndecrypting.txt\nstart.txt<\/td>\n no extension change\nEncrypted files have prefix:\nVersion 1: ABCXYZ11\nVersion 2: !DMALOCK\nVersion 3: !DMALOCK3.0\nVersion 4: !DMALOCK4.0<\/td>\n AES(256) in ECB mode, \nVersion 2-4 also RSA<\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/\nhttps:\/\/github.com\/hasherezade\/dma_unlocker\nhttps:\/\/drive.google.com\/drive\/folders\/0Bzb5kQFOXkiSMm94QzdyM3hCdDg<\/td>\n https:\/\/blog.malwarebytes.org\/threat-analysis\/2016\/02\/dma-locker-a-new-ransomware-but-no-reason-to-panic\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    DMALocker 3.0<\/td>\n <\/td>\n <\/td>\n <\/td>\n no extension change<\/td>\n AES(256)\nXPTLOCK5.0<\/td>\n <\/td>\n <\/td>\n https:\/\/drive.google.com\/drive\/folders\/0Bzb5kQFOXkiSMm94QzdyM3hCdDg<\/td>\n https:\/\/blog.malwarebytes.org\/threat-analysis\/2016\/02\/dma-locker-strikes-back\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    DNRansomware<\/td>\n .fucked<\/td>\n <\/td>\n <\/td>\n Code to decrypt: 83KYG9NW-3K39V-2T3HJ-93F3Q-GT<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/822500056511213568<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Domino<\/td>\n .domino<\/td>\n <\/td>\n README_TO_RECURE_YOUR_FILES.txt<\/td>\n Based on Hidden Tear<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/Domino.html<\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/the-curious-case-of-the-domino-ransomware-a-windows-crack-and-a-cow\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Donald Trump<\/td>\n .ENCRYPTED<\/td>\n <\/td>\n <\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/the-donald-trump-ransomware-tries-to-build-walls-around-your-files\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    DoNotChange<\/td>\n .id-7ES642406.cry\n.Do_not_change_the_filename<\/td>\n <\/td>\n HOW TO DECODE FILES!!!.txt\n\u041a\u0410\u041a \u0420\u0410\u0421\u0428\u0418\u0424\u0420\u041e\u0412\u0410\u0422\u042c \u0424\u0410\u0419\u041b\u042b!!!.txt<\/td>\n <\/td>\n AES(128)<\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/forums\/t\/643330\/donotchange-ransomware-id-7es642406cry-do-not-change-the-file-namecryp\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    DummyLocker<\/td>\n .dCrypt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/794108322932785158<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    DXXD<\/td>\n .dxxd<\/td>\n <\/td>\n ReadMe.TxT<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/forums\/t\/627831\/dxxd-ransomware-dxxd-help-support-readmetxt\/<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/the-dxxd-ransomware-displays-legal-notice-before-users-login\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    DynA-Crypt<\/td>\n .crypt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/dyna-crypt-not-only-encrypts-your-files-but-also-steals-your-info\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    EDA2 \/ HiddenTear<\/td>\n .locked<\/td>\n <\/td>\n <\/td>\n Open sourced C#<\/td>\n AES(256)<\/td>\n Cryptear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    EdgeLocker<\/td>\n .edgel<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/815392891338194945<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    EduCrypt<\/td>\n .isis\n.locked<\/td>\n <\/td>\n README.txt<\/td>\n Based on Hidden Tear<\/td>\n <\/td>\n EduCrypter<\/td>\n <\/td>\n http:\/\/www.filedropper.com\/decrypter_1<\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/747031171347910656<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    EiTest<\/td>\n .crypted<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BroadAnalysis\/status\/845688819533930497<\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/845652520202616832<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    El-Polocker<\/td>\n .ha3<\/td>\n <\/td>\n qwer.html\nqwer2.html \nlocked.bmp<\/td>\n Has a GUI<\/td>\n <\/td>\n Los Pollos Hermanos<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Encoder.xxxx<\/td>\n <\/td>\n <\/td>\n Instructions.html<\/td>\n Coded in GO<\/td>\n <\/td>\n Trojan.Encoder.6491<\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/the-week-in-ransomware-october-14-2016-exotic-lockydump-comrade-and-more\/<\/td>\n http:\/\/vms.drweb.ru\/virus\/?_is=1&i=8747343<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    encryptoJJS<\/td>\n .enc<\/td>\n <\/td>\n How to recover.enc<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Enigma<\/td>\n .enigma\n.1txt<\/td>\n <\/td>\n enigma.hta\nenigma_encr.txt\nenigma_info.txt<\/td>\n <\/td>\n AES(128)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/the-enigma-ransomware-targets-russian-speaking-users\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Enjey<\/td>\n <\/td>\n <\/td>\n <\/td>\n Based on RemindMe<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/839022018230112256<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    EnkripsiPC<\/td>\n .fucked<\/td>\n <\/td>\n <\/td>\n The encryption password is based on the computer name<\/td>\n <\/td>\n IDRANSOMv3\nManifestus<\/td>\n <\/td>\n https:\/\/twitter.com\/demonslay335\/status\/811343914712100872<\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/811264254481494016<\/td>\n https:\/\/twitter.com\/struppigel\/status\/811587154983981056<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Erebus<\/td>\n <\/td>\n Encrypt the extension using ROT-23<\/td>\n README.HTML<\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/erebus-ransomware-utilizes-a-uac-bypass-and-request-a-90-ransom-payment\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Evil<\/td>\n .file0locked\n.evillock<\/td>\n <\/td>\n <\/td>\n Coded in Javascript<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/jiriatvirlab\/status\/818443491713884161<\/td>\n https:\/\/twitter.com\/PolarToffee\/status\/826508611878793219<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Exotic<\/td>\n .exotic<\/td>\n random.exotic<\/td>\n <\/td>\n Also encrypts executables<\/td>\n AES(128)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/eviltwins-exotic-ransomware-targets-executable-files\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    FabSysCrypto<\/td>\n <\/td>\n <\/td>\n <\/td>\n Based on HiddenTear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/837565766073475072<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Fadesoft<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/829768819031805953<\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/838700700586684416<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Fairware<\/td>\n <\/td>\n <\/td>\n <\/td>\n Target Linux O.S.<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/new-fairware-ransomware-targeting-linux-computers\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Fakben<\/td>\n .locked<\/td>\n <\/td>\n READ ME FOR DECRYPT.txt<\/td>\n Based on Hidden Tear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/blog.fortinet.com\/post\/fakben-team-ransomware-uses-open-source-hidden-tear-code<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    FakeGlobe aka GlobeImposter<\/td>\n .crypt<\/td>\n <\/td>\n HOW_OPEN_FILES.hta<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/globeimposter<\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/809795402421641216<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    FakeCryptoLocker<\/td>\n .cryptolocker<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/PolarToffee\/status\/812312402779836416<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Fantom<\/td>\n .fantom\n.comrade<\/td>\n <\/td>\n DECRYPT_YOUR_FILES.HTML\nRESTORE-FILES![id]<\/td>\n Based on EDA2<\/td>\n AES(128)<\/td>\n Variants:\nComrade Circle<\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/fantom-ransomware-encrypts-your-files-while-pretending-to-be-windows-update\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    FenixLocker<\/td>\n .FenixIloveyou!!<\/td>\n <\/td>\n Help to decrypt.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/fenixlocker<\/td>\n https:\/\/twitter.com\/fwosar\/status\/777197255057084416<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    FILE FROZR<\/td>\n <\/td>\n <\/td>\n <\/td>\n RaaS<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/rommeljoven17\/status\/846973265650335744<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    FileLocker<\/td>\n .ENCR<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/jiriatvirlab\/status\/836616468775251968<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    FireCrypt<\/td>\n .firecrypt<\/td>\n <\/td>\n [random_chars]-READ_ME.html<\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/firecrypt-ransomware-comes-with-a-ddos-component\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Flyper<\/td>\n .locked<\/td>\n <\/td>\n <\/td>\n Based on EDA2 \/ HiddenTear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/773771485643149312<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Fonco<\/td>\n <\/td>\n <\/td>\n help-file-decrypt.enc\n\/pronk.txt<\/td>\n contact email safefiles32@mail.ru also as prefix in encrypted file contents<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    FortuneCookie<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/842302481774321664<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Free-Freedom<\/td>\n .madebyadam<\/td>\n <\/td>\n <\/td>\n Unlock code is: adam or adamdude9<\/td>\n <\/td>\n Roga<\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/812135608374226944<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    FSociety<\/td>\n .fs0ciety\n.dll<\/td>\n <\/td>\n fs0ciety.html\nDECRYPT_YOUR_FILES.HTML<\/td>\n Based on EDA2\nBased on RemindMe<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/forums\/t\/628199\/fs0ciety-locker-ransomware-help-support-fs0cietyhtml\/<\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/new-fsociety-ransomware-pays-homage-to-mr-robot\/<\/td>\n https:\/\/twitter.com\/siri_urz\/status\/795969998707720193<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Fury<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/viruses\/disinfection\/8547<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    GhostCrypt<\/td>\n .Z81928819<\/td>\n <\/td>\n <\/td>\n Based on Hidden Tear<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n https:\/\/download.bleepingcomputer.com\/demonslay335\/GhostCryptDecrypter.zip<\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/614197\/ghostcrypt-z81928819-help-support-topic-read-this-filetxt\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Gingerbread<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/ni_fi_70\/status\/796353782699425792<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Globe v1<\/td>\n .purge<\/td>\n <\/td>\n How to restore files.hta<\/td>\n <\/td>\n Blowfish<\/td>\n Purge<\/td>\n <\/td>\n https:\/\/success.trendmicro.com\/portal_kb_articledetail?solutionid=1114221<\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/the-globe-ransomware-wants-to-purge-your-files\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Globe v2<\/td>\n .lovewindows\n.openforyou@india.com<\/td>\n ..\ne.g.: .7076.docx.okean-1955@india.com.!dsvgdfvdDVGR3SsdvfEF75sddf#xbkNY45fg6}P{cg<\/td>\n <\/td>\n <\/td>\n Blowfish<\/td>\n Purge<\/td>\n <\/td>\n https:\/\/success.trendmicro.com\/portal_kb_articledetail?solutionid=1114221<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Globe v3<\/td>\n .[random].blt\n.[random].encrypted\n.[random].raid10\n.[mia.kokers@aol.com]\n.[random].globe\n.unlockvt@india.com\n.rescuers@india.com.3392cYAn548QZeUf.lock\n.locked\n.decrypt2017\n.hnumkhotep<\/td>\n <\/td>\n <\/td>\n Extesion depends on the config file. It seems Globe is a ransomware kit.<\/td>\n RC4\nAES(256)<\/td>\n Purge<\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/globe3<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    GNL Locker<\/td>\n .locked<\/td>\n .locked, e.g.,\nbill.!ID!8MMnF!ID!.locked<\/td>\n UNLOCK_FILES_INSTRUCTIONS.html and .txt<\/td>\n Only encrypts DE or NL country<\/td>\n AES (256)<\/td>\n Variants, from old to latest:\nZyklon Locker\nWildFire locker\nHades Locker<\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/611342\/gnl-locker-support-and-help-topic-locked-and-unlock-files-instructionshtml\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    GOG<\/td>\n .L0CKED<\/td>\n <\/td>\n DecryptFile.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/816112218815266816<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Gomasom<\/td>\n .crypt<\/td>\n !___[EMAILADDRESS]_.crypt<\/td>\n <\/td>\n no ransom note<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Goopic<\/td>\n <\/td>\n <\/td>\n Your files have been crypted.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/angler-shift-ek-landscape-new-crytpo-ransomware-activity\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Gopher<\/td>\n <\/td>\n <\/td>\n <\/td>\n OS X ransomware (PoC)<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Gremit<\/td>\n .rnsmwr<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/794444032286060544<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Guster<\/td>\n .locked<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/812131324979007492<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Hacked<\/td>\n .versiegelt\n.encrypted\n.payrmts\n.locked\n.Locked<\/td>\n <\/td>\n <\/td>\n Jigsaw Ransomware variant<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/demonslay335\/status\/806878803507101696<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    HappyDayzz<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n 3DES\nAES(128)\nAES(192)\nAES(256)\nDES\nRC2\nRC4<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/847114064224497666<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Harasom<\/td>\n .html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    HDDCryptor<\/td>\n <\/td>\n <\/td>\n <\/td>\n Uses https:\/\/diskcryptor.net for full disk encryption<\/td>\n Custom (net shares), XTS-AES (disk)<\/td>\n Mamba<\/td>\n <\/td>\n <\/td>\n https:\/\/www.linkedin.com\/pulse\/mamba-new-full-disk-encryption-ransomware-family-member-marinho<\/td>\n blog.trendmicro.com\/trendlabs-security-intelligence\/bksod-by-ransomware-hddcryptor-uses-commercial-tools-to-encrypt-network-shares-and-lock-hdds\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Heimdall<\/td>\n <\/td>\n <\/td>\n <\/td>\n File marker: \"Heimdall---\"<\/td>\n AES-128-CBC<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/heimdall-open-source-php-ransomware-targets-web-servers\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Help_dcfile<\/td>\n .XXX<\/td>\n <\/td>\n help_dcfile.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Herbst<\/td>\n .herbst<\/td>\n <\/td>\n <\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/blog.fortinet.com\/2016\/06\/03\/cooking-up-autumn-herbst-ransomware<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Hermes<\/td>\n <\/td>\n <\/td>\n DECRYPT_INFORMATION.html\nUNIQUE_ID_DO_NOT_REMOVE<\/td>\n Filemarker: \"HERMES\"<\/td>\n AES<\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/forums\/t\/642019\/hermes-ransomware-help-support-decrypt-informationhtml\/<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/hermes-ransomware-decrypted-in-live-video-by-emsisofts-fabian-wosar\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Hi Buddy!<\/td>\n .cry<\/td>\n <\/td>\n <\/td>\n Based on HiddenTear<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/hibuddy.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Hitler<\/td>\n <\/td>\n removes extensions<\/td>\n <\/td>\n Deletes files<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/development-version-of-the-hitler-ransomware-discovered\/<\/td>\n https:\/\/twitter.com\/jiriatvirlab\/status\/825310545800740864<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    HolyCrypt<\/td>\n (encrypted)<\/td>\n <\/td>\n <\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/new-python-ransomware-called-holycrypt-discovered\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    HTCryptor<\/td>\n <\/td>\n <\/td>\n <\/td>\n Includes a feature to disable the victim's windows firewall\nModified in-dev HiddenTear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/803288396814839808<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Hucky<\/td>\n .locky<\/td>\n [a-zA-Z0-9+_-]{1,}.[a-z0-9]{3,4}.locky<\/td>\n _Adatok_visszaallitasahoz_utasitasok.txt\n_locky_recover_instructions.txt<\/td>\n Based on Locky<\/td>\n AES, RSA (hardcoded)<\/td>\n Hungarian Locky (Hucky)<\/td>\n <\/td>\n <\/td>\n https:\/\/blog.avast.com\/hucky-ransomware-a-hungarian-locky-wannabe<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    HydraCrypt<\/td>\n <\/td>\n hydracrypt_ID_[\\w]{8}<\/td>\n README_DECRYPT_HYRDA_ID_[ID number].txt<\/td>\n CrypBoss Family<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/<\/td>\n http:\/\/www.malware-traffic-analysis.net\/2016\/02\/03\/index2.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    IFN643<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/791576159960072192<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    iLock<\/td>\n .crime<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/817085367144873985<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    iLockLight<\/td>\n .crime<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    International Police Association<\/td>\n <\/td>\n <6 random characters><\/td>\n %Temp%\\.bmp<\/td>\n CryptoTorLocker2015 variant<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/download.bleepingcomputer.com\/Nathan\/StopPirates_Decrypter.exe<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    iRansom<\/td>\n .Locked<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/demonslay335\/status\/796134264744083460<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Jack.Pot<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/791639214152617985<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    JagerDecryptor<\/td>\n !ENC<\/td>\n <\/td>\n Important_Read_Me.html<\/td>\n Prepends filenames<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/757873976047697920<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    JapanLocker<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Base64 encoding, ROT13, and top-bottom swapping<\/td>\n shc Ransomware\nSyNcryption<\/td>\n <\/td>\n https:\/\/github.com\/fortiguard-lion\/schRansomwareDecryptor\/blob\/master\/schRansomwarev1_decryptor.php<\/td>\n https:\/\/blog.fortinet.com\/2016\/10\/19\/japanlocker-an-excavation-to-its-indonesian-roots<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Jeiphoos<\/td>\n <\/td>\n <\/td>\n readme_liesmich_encryptor_raas.txt<\/td>\n Windows, Linux. Campaign stopped. Actor claimed he deleted the master key.<\/td>\n RC6 (files), RSA 2048 (RC6 key)<\/td>\n Encryptor RaaS, Sarento<\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/RaaS.html<\/td>\n http:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/the-rise-and-fall-of-encryptor-raas\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Jhon Woddy<\/td>\n .killedXXX<\/td>\n <\/td>\n <\/td>\n Same codebase as DNRansomware\nLock screen password is M3VZ>5BwGGVH<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/download.bleepingcomputer.com\/demonslay335\/DoNotOpenDecrypter.zip<\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/822509105487245317<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Jigsaw<\/td>\n .btc\n.kkk\n.fun\n.gws\n.porno\n.payransom\n.payms\n.paymst\n.AFD\n.paybtcs\n.epic\n.xyz\n.encrypted\n.hush\n.paytounlock\n.uk-dealer@sigaint.org\n.gefickt\n.nemo-hacks.at.sigaint.org<\/td>\n <\/td>\n <\/td>\n Has a GUI<\/td>\n AES(256)<\/td>\n CryptoHitMan (subvariant)<\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/jigsaw-ransomware-decrypted-will-delete-your-files-until-you-pay-the-ransom\/<\/td>\n https:\/\/www.helpnetsecurity.com\/2016\/04\/20\/jigsaw-crypto-ransomware\/<\/td>\n https:\/\/twitter.com\/demonslay335\/status\/795819556166139905<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Job Crypter<\/td>\n .locked\n.css<\/td>\n <\/td>\n Comment d\u00e9bloquer mes fichiers.txt\nReadme.txt<\/td>\n Based on HiddenTear, but uses TripleDES, decrypter is PoC<\/td>\n TripleDES<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/jobcrypter.html\nhttp:\/\/forum.malekal.com\/jobcrypter-geniesanstravaille-extension-locked-crypto-ransomware-t54381.html<\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/828914052973858816<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    JohnyCryptor<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Kaandsona<\/td>\n .kencf<\/td>\n <\/td>\n <\/td>\n Crashes before it encrypts<\/td>\n <\/td>\n K\u00e4\u00e4nds\u00f5na\nRansomTroll<\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/819927858437099520<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Kangaroo<\/td>\n .crypted_file<\/td>\n <\/td>\n filename.Instructions_Data_Recovery.txt<\/td>\n From the developer behind the Apocalypse Ransomware, Fabiansomware, and Esmeralda<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/the-kangaroo-ransomware-not-only-encrypts-your-data-but-tries-to-lock-you-out-of-windows\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Karma<\/td>\n .karma<\/td>\n <\/td>\n # DECRYPT MY FILES #.html\n# DECRYPT MY FILES #.txt<\/td>\n pretends to be a Windows optimization program called Windows-TuneUp<\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/researcher-finds-the-karma-ransomware-being-distributed-via-pay-per-install-network\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Karmen<\/td>\n .grt<\/td>\n <\/td>\n <\/td>\n RaaS\nBased on HiddenTear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/841747002438361089<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Kasiski<\/td>\n [KASISKI]<\/td>\n <\/td>\n INSTRUCCIONES.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/MarceloRivero\/status\/832302976744173570<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    KawaiiLocker<\/td>\n <\/td>\n <\/td>\n How Decrypt Files.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/safezone.cc\/resources\/kawaii-decryptor.195\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    KeRanger<\/td>\n .encrypted<\/td>\n <\/td>\n <\/td>\n OS X Ransomware<\/td>\n AES<\/td>\n <\/td>\n <\/td>\n http:\/\/news.drweb.com\/show\/?i=9877&lng=en&c=5<\/td>\n http:\/\/www.welivesecurity.com\/2016\/03\/07\/new-mac-ransomware-appears-keranger-spread-via-transmission-app\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    KeyBTC<\/td>\n keybtc@inbox_com<\/td>\n <\/td>\n DECRYPT_YOUR_FILES.txt\nREAD.txt\nreadme.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    KEYHolder<\/td>\n <\/td>\n <\/td>\n how_decrypt.gif\nhow_decrypt.html<\/td>\n via remote attacker.\ntuyuljahat@hotmail.com contact address<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/559463\/keyholder-ransomware-support-and-help-topic-how-decryptgifhow-decrypthtml<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    KillDisk<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/cyberx-labs.com\/en\/blog\/new-killdisk-malware-brings-ransomware-into-industrial-domain\/<\/td>\n http:\/\/www.welivesecurity.com\/2017\/01\/05\/killdisk-now-targeting-linux-demands-250k-ransom-cant-decrypt\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    KillerLocker<\/td>\n .rip<\/td>\n <\/td>\n <\/td>\n Possibly Portuguese dev<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/782232299840634881<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    KimcilWare<\/td>\n .kimcilware\n.locked<\/td>\n <\/td>\n <\/td>\n websites only<\/td>\n AES<\/td>\n <\/td>\n <\/td>\n https:\/\/blog.fortinet.com\/post\/kimcilware-ransomware-how-to-decrypt-encrypted-files-and-who-is-behind-it<\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/the-kimcilware-ransomware-targets-web-sites-running-the-magento-platform\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Kirk<\/td>\n .Kirked<\/td>\n <\/td>\n RANSOM_NOTE.txt<\/td>\n Payments in Monero<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.virustotal.com\/en\/file\/39a2201a88f10d81b220c973737f0becedab2e73426ab9923880fb0fb990c5cc\/analysis\/<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/star-trek-themed-kirk-ransomware-brings-us-monero-and-a-spock-decryptor\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Koolova<\/td>\n <\/td>\n <\/td>\n <\/td>\n With Italian text that only targets the Test folder on the user's desktop<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/koolova-ransomware-decrypts-for-free-if-you-read-two-articles-about-ransomware\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Korean<\/td>\n .\uc554\ud638\ud654\ub428<\/td>\n <\/td>\n ReadMe.txt<\/td>\n Based on HiddenTear<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/koreanRansom.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Kostya<\/td>\n .kostya<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/the-week-in-ransomware-october-14-2016-exotic-lockydump-comrade-and-more\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Kozy.Jozy<\/td>\n .31392E30362E32303136_[ID-KEY]_LSBJ1<\/td>\n .([0-9A-Z]{20})_([0-9]{2})_([A-Z0-9]{4,5})<\/td>\n w.jpg<\/td>\n Potential Kit\nselectedkozy.jozy@yahoo.com\nkozy.jozy@yahoo.com\nunlock92@india.com<\/td>\n RSA(2048)<\/td>\n QC<\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/KozyJozy.html<\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/617802\/kozyjozy-ransomware-help-support-wjpg-31392e30362e32303136-num-lsbj1\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Kraken<\/td>\n .kraken<\/td>\n [base64].kraken<\/td>\n _HELP_YOUR_FILES.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    KratosCrypt<\/td>\n .kratos<\/td>\n <\/td>\n README_ALL.html<\/td>\n kratosdimetrici@gmail.com<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/demonslay335\/status\/746090483722686465<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    KRider<\/td>\n .kr3<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/836995570384453632<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    KryptoLocker<\/td>\n <\/td>\n <\/td>\n KryptoLocker_README.txt<\/td>\n Based on HiddenTear<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    LambdaLocker<\/td>\n .lambda_l0cked<\/td>\n <\/td>\n READ_IT.hTmL<\/td>\n Python Ransomware<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    LanRan<\/td>\n <\/td>\n <\/td>\n @__help__@<\/td>\n Variant of open-source MyLittleRansomware<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/847689644854595584<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    LeChiffre<\/td>\n .LeChiffre<\/td>\n <\/td>\n How to decrypt LeChiffre files.html<\/td>\n Encrypts first 0x2000 and last 0x2000 bytes.\nVia remote attacker<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/lechiffre<\/td>\n https:\/\/blog.malwarebytes.org\/threat-analysis\/2016\/01\/lechiffre-a-manually-run-ransomware\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Lick<\/td>\n .Licked<\/td>\n <\/td>\n RANSOM_NOTE.txt<\/td>\n Variant of Kirk<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/842404866614038529<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Linux.Encoder<\/td>\n <\/td>\n <\/td>\n <\/td>\n Linux Ransomware<\/td>\n <\/td>\n Linux.Encoder.{0,3}<\/td>\n <\/td>\n https:\/\/labs.bitdefender.com\/2015\/11\/linux-ransomware-debut-fails-on-predictable-encryption-key\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    LK Encryption<\/td>\n <\/td>\n <\/td>\n <\/td>\n Based on HiddenTear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/845183290873044994<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    LLTP Locker<\/td>\n .ENCRYPTED_BY_LLTP\n.ENCRYPTED_BY_LLTPp<\/td>\n <\/td>\n LEAME.txt<\/td>\n Targeting Spanish speaking victims<\/td>\n AES-256<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/new-lltp-ransomware-appears-to-be-a-rewritten-venus-locker\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    LockCrypt<\/td>\n .lock<\/td>\n <\/td>\n ReadMe.TxT<\/td>\n <\/td>\n <\/td>\n <\/td>\n 09\/29\/2017<\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/forums\/t\/648384\/lockcrypt-lock-support-topic-readmetxt\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Locked-In<\/td>\n <\/td>\n <\/td>\n RESTORE_CORUPTED_FILES.HTML<\/td>\n Based on RemindMe<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/forums\/t\/634754\/locked-in-ransomware-help-support-restore-corupted-fileshtml\/<\/td>\n https:\/\/twitter.com\/struppigel\/status\/807169774098796544<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Locker<\/td>\n <\/td>\n <\/td>\n <\/td>\n no extension change\nhas GUI<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/577246\/locker-ransomware-support-and-help-topic\/page-32#entry3721545<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    LockLock<\/td>\n .locklock<\/td>\n <\/td>\n READ_ME.TXT<\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/forums\/t\/626750\/locklock-ransomware-locklock-help-support\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Locky<\/td>\n .locky\n.zepto\n.odin\n.shit\n.thor\n.aesir\n.zzzzz\n.osiris\n.DIABLO6\n.lukitus<\/td>\n ([A-F0-9]{32}).locky\n([A-F0-9]{32}).zepto\n([A-F0-9]{32}).odin\n([A-F0-9]{32}).shit\n([A-F0-9]{32}).thor\n([A-F0-9]{32}).aesir\n([A-F0-9]{32}).zzzzz\n([A-F0-9]{32}).osiris<\/td>\n _Locky_recover_instructions.txt\n_Locky_recover_instructions.bmp\n_HELP_instructions.txt\n_HELP_instructions.bmp\n_HOWDO_text.html\n_WHAT_is.html\n_INSTRUCTION.html\nDesktopOSIRIS.(bmp|htm)\nOSIRIS-[0-9]{4}.htm<\/td>\n Affiliations with Dridex and Necurs botnets\nIOCs: https:\/\/ghostbin.com\/paste\/7jm4j<\/td>\n AES(128)<\/td>\n <\/td>\n 08\/08\/2017 - Diablo6 Locky variant added\n09\/28\/2017 - Lukitus Locky varinat added<\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/new-locky-version-adds-the-zepto-extension-to-encrypted-files\/<\/td>\n WSF variant:\nhttp:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/new-locky-ransomware-spotted-in-the-brazilian-underground-market-uses-windows-script-files\/\n\nOdin:\nhttps:\/\/nakedsecurity.sophos.com\/2016\/10\/06\/odin-ransomware-takes-over-from-zepto-and-locky\/\n\nOSIRIS:\nhttps:\/\/www.bleepingcomputer.com\/news\/security\/locky-ransomware-switches-to-egyptian-mythology-with-the-osiris-extension\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Lock93<\/td>\n .lock93<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/789882488365678592<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Lomix<\/td>\n <\/td>\n <\/td>\n <\/td>\n Based on the idiotic open-source ransomware called CryptoWire<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/siri_urz\/status\/801815087082274816<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Lortok<\/td>\n .crime<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    LowLevel04<\/td>\n oor.<\/td>\n <\/td>\n <\/td>\n Prepends filenames<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    M4N1F3STO<\/td>\n <\/td>\n <\/td>\n <\/td>\n Does not encrypt\nUnlock code=suckmydicknigga<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/jiriatvirlab\/status\/808015275367002113<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Mabouia<\/td>\n <\/td>\n <\/td>\n <\/td>\n OS X ransomware (PoC)<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    MacAndChess<\/td>\n <\/td>\n <\/td>\n <\/td>\n Based on HiddenTear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Magic<\/td>\n .magic<\/td>\n <\/td>\n DECRYPT_ReadMe1.TXT\nDECRYPT_ReadMe.TXT<\/td>\n Based on EDA2<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    MaktubLocker<\/td>\n <\/td>\n [a-z]{4,6}<\/td>\n _DECRYPT_INFO_[extension pattern].html<\/td>\n <\/td>\n AES(256), RSA (2048)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/blog.malwarebytes.org\/threat-analysis\/2016\/03\/maktub-locker-beautiful-and-dangerous\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Marlboro<\/td>\n .oops<\/td>\n <\/td>\n _HELP_Recover_Files_.html<\/td>\n <\/td>\n XOR<\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/marlboro<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/marlboro-ransomware-defeated-in-one-day\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    MarsJoke<\/td>\n .a19\n.ap19<\/td>\n <\/td>\n !!! Readme For Decrypt !!!.txt\nReadMeFilesDecrypt!!!.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/securelist.ru\/blog\/issledovaniya\/29376\/polyglot-the-fake-ctb-locker\/<\/td>\n https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/MarsJoke-Ransomware-Mimics-CTB-Locker<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    MasterBuster<\/td>\n <\/td>\n <\/td>\n CreatesReadThisFileImportant.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/791943837874651136<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Matrix<\/td>\n <\/td>\n <\/td>\n [5 numbers]-MATRIX-README.RTF<\/td>\n <\/td>\n GnuPG<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/rommeljoven17\/status\/804251901529231360<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Meister<\/td>\n <\/td>\n <\/td>\n <\/td>\n Targeting French victims<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/siri_urz\/status\/840913419024945152<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Merry X-Mas!<\/td>\n .PEGS1\n.MRCR1\n.RARE1\n.MERRY\n.RMCM1<\/td>\n <\/td>\n YOUR_FILES_ARE_DEAD.HTA\nMERRY_I_LOVE_YOU_BRUCE.HTA<\/td>\n Written in Delphi<\/td>\n <\/td>\n MRCR<\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/mrcr<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/merry-christmas-ransomware-and-its-dev-comodosecurity-not-bringing-holiday-cheer\/<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/-merry-christmas-ransomware-now-steals-user-private-data-via-diamondfox-malware\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Meteoritan<\/td>\n <\/td>\n <\/td>\n where_are_your_files.txt\nreadme_your_files_have_been_encrypted.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/844614889620561924<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    MIRCOP<\/td>\n Lock.<\/td>\n <\/td>\n <\/td>\n Prepends files\nDemands 48.48 BTC<\/td>\n AES<\/td>\n Crypt888<\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/618457\/microcop-ransomware-help-support-lock-mircop\/\nhttps:\/\/www.avast.com\/ransomware-decryption-tools#!<\/td>\n http:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/instruction-less-ransomware-mircop-channels-guy-fawkes\/<\/td>\n http:\/\/www.nyxbone.com\/malware\/Mircop.html<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    MireWare<\/td>\n .fucked\n.fuck<\/td>\n <\/td>\n READ_IT.txt<\/td>\n Based on HiddenTear<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Mischa<\/td>\n <\/td>\n .([a-zA-Z0-9]{4})<\/td>\n YOUR_FILES_ARE_ENCRYPTED.HTML\nYOUR_FILES_ARE_ENCRYPTED.TXT<\/td>\n Packaged with Petya\nPDFBewerbungsmappe.exe<\/td>\n <\/td>\n \"Petya's little brother\"<\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/petya-is-back-and-with-a-friend-named-mischa-ransomware\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    MM Locker<\/td>\n .locked<\/td>\n <\/td>\n READ_IT.txt<\/td>\n Based on EDA2<\/td>\n AES(256)<\/td>\n Booyah<\/td>\n <\/td>\n <\/td>\n https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/ransomware-explosion-continues-cryptflle2-brlock-mm-locker-discovered<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Mobef<\/td>\n .KEYZ\n.KEYH0LES<\/td>\n <\/td>\n 4-14-2016-INFECTION.TXT\nIMPORTANT.README<\/td>\n <\/td>\n <\/td>\n Yakes\nCryptoBit<\/td>\n <\/td>\n <\/td>\n http:\/\/nyxbone.com\/malware\/Mobef.html<\/td>\n http:\/\/researchcenter.paloaltonetworks.com\/2016\/07\/unit42-cryptobit-another-ransomware-family-gets-an-update\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Mole<\/td>\n .mole\n.mole02<\/td>\n <\/td>\n INSTRUCTION_FOR_HELPING_FILE_RECOVERY.TXT<\/td>\n <\/td>\n <\/td>\n CryptoMix<\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/decryptor-released-for-the-mole02-cryptomix-ransomware-variant\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Monument<\/td>\n <\/td>\n <\/td>\n <\/td>\n Use the DarkLocker 5 porn screenlocker\nJigsaw variant<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/844826339186135040<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    MOTD<\/td>\n .enc<\/td>\n <\/td>\n motd.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/forums\/t\/642409\/motd-ransomware-help-support-topics-motdtxt-and-enc-extension\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    MSN CryptoLocker<\/td>\n <\/td>\n <\/td>\n RESTORE_YOUR_FILES.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/810766686005719040<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    n1n1n1<\/td>\n <\/td>\n <\/td>\n decrypt explanations.html<\/td>\n Filemaker: \"333333333333\"<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/demonslay335\/status\/790608484303712256<\/td>\n https:\/\/twitter.com\/demonslay335\/status\/831891344897482754<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    N-Splitter<\/td>\n .\u043a\u0438\u0431\u0435\u0440 \u0440\u0430\u0437\u0432\u0435\u0442\u0432\u0438\u0442\u0435\u043b\u044c<\/td>\n <\/td>\n <\/td>\n Russian Koolova Variant<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/815961663644008448<\/td>\n https:\/\/www.youtube.com\/watch?v=dAVMgX8Zti4&feature=youtu.be&list=UU_TMZYaLIgjsdJMwurHAi4Q<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Nagini<\/td>\n <\/td>\n <\/td>\n <\/td>\n Looks for C:\\Temp\\voldemort.horcrux<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/the-nagini-ransomware-sics-voldemort-on-your-files\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    NanoLocker<\/td>\n <\/td>\n <\/td>\n ATTENTION.RTF<\/td>\n no extension change\nhas a GUI<\/td>\n AES (256), RSA<\/td>\n <\/td>\n <\/td>\n http:\/\/github.com\/Cyberclues\/nanolocker-decryptor<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Nemucod<\/td>\n .crypted<\/td>\n <\/td>\n Decrypted.txt<\/td>\n 7zip (a0.exe) variant cannot be decrypted\nEncrypts the first 2048 Bytes<\/td>\n XOR(255)\n7zip<\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/nemucod\nhttps:\/\/github.com\/Antelox\/NemucodFR\nhttp:\/\/www.bleepingcomputer.com\/news\/security\/decryptor-released-for-the-nemucod-trojans-crypted-ransomware\/<\/td>\n https:\/\/blog.cisecurity.org\/malware-analysis-report-nemucod-ransomware\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Netix<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n AES(256)<\/td>\n RANSOM_NETIX.A<\/td>\n <\/td>\n <\/td>\n http:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/netflix-scam-delivers-ransomware\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    NETWALKER<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Nhtnwcuf<\/td>\n <\/td>\n <\/td>\n !_RECOVERY_HELP_!.txt\nHELP_ME_PLEASE.txt<\/td>\n Does not encrypt the files \/ Files are destroyed<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/demonslay335\/status\/839221457360195589<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    NMoreira<\/td>\n .maktub\n.__AiraCropEncrypted!\n.aac<\/td>\n <\/td>\n Recupere seus arquivos. Leia-me!.txt\nLearn how to recover your files.txt<\/td>\n .aac is the extension used by the new version seen in July, 2017<\/td>\n mix of RSA and AES-256<\/td>\n XRatTeam\nXPan\nAiraCrop<\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/nmoreira<\/td>\n https:\/\/twitter.com\/fwosar\/status\/803682662481174528<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    NoobCrypt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/757267550346641408<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/noobcrypt-ransomware-dev-shows-noobness-by-using-same-password-for-everyone\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Nuke<\/td>\n .nuclear55<\/td>\n <\/td>\n !!_RECOVERY_instructions_!!.html\n!!_RECOVERY_instructions_!!.txt<\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Nullbyte<\/td>\n _nullbyte<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/download.bleepingcomputer.com\/demonslay335\/NullByteDecrypter.zip<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/the-nullbyte-ransomware-pretends-to-be-the-necrobot-pokemon-go-application\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Ocelot<\/td>\n <\/td>\n <\/td>\n <\/td>\n Does not encrypt anything<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/817648547231371264<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    ODCODC<\/td>\n .odcodc<\/td>\n C-email-abennaki@india.com-(NOMBRE_ARCHIVO.ext).odcodc<\/td>\n HOW_TO_RESTORE_FILES.txt<\/td>\n <\/td>\n XOR<\/td>\n <\/td>\n <\/td>\n http:\/\/download.bleepingcomputer.com\/BloodDolly\/ODCODCDecoder.zip<\/td>\n http:\/\/www.nyxbone.com\/malware\/odcodc.html<\/td>\n https:\/\/twitter.com\/PolarToffee\/status\/813762510302183424<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Offline ransomware<\/td>\n .cbf<\/td>\n email-[params].cbf<\/td>\n desk.bmp\ndesk.jpg<\/td>\n email addresses overlap with .777 addresses<\/td>\n <\/td>\n Vipasana, Cryakl<\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/viruses\/disinfection\/8547<\/td>\n http:\/\/bartblaze.blogspot.com.co\/2016\/02\/vipasana-ransomware-new-ransom-on-block.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    OMG! Ransomware<\/td>\n .LOL!\n.OMG!<\/td>\n <\/td>\n how to get data.txt<\/td>\n <\/td>\n <\/td>\n GPCode<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Onyx<\/td>\n <\/td>\n <\/td>\n <\/td>\n Georgian ransomware<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/791557636164558848<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Operation Global III<\/td>\n .EXE<\/td>\n <\/td>\n <\/td>\n Is a file infector (virus)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/news.thewindowsclub.com\/operation-global-iii-ransomware-decryption-tool-released-70341\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Owl<\/td>\n dummy_file.encrypted<\/td>\n dummy_file.encrypted.[extension]<\/td>\n log.txt<\/td>\n <\/td>\n <\/td>\n CryptoWire<\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/842342996775448576<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    OzozaLocker<\/td>\n .Locked<\/td>\n <\/td>\n HOW TO DECRYPT YOU FILES.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/ozozalocker<\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/801503401867673603<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    PadCrypt<\/td>\n .padcrypt<\/td>\n <\/td>\n IMPORTANT READ ME.txt\nFile Decrypt Help.html<\/td>\n has a live support chat<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/padcrypt-the-first-ransomware-with-live-support-chat-and-an-uninstaller\/<\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/798141978810732544<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Padlock Screenlocker<\/td>\n <\/td>\n <\/td>\n <\/td>\n Unlock code is: ajVr\/G\\RJz0R<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/811635075158839296<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Patcher<\/td>\n .crypt<\/td>\n <\/td>\n README!.txt<\/td>\n Targeting macOS users<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/02\/decrypting-after-a-findzip-ransomware-infection\/<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/new-macos-patcher-ransomware-locks-data-for-good-no-way-to-recover-your-files\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    PayDay<\/td>\n .sexy<\/td>\n <\/td>\n !!!!!ATEN\u00c7\u00c3O!!!!!.html<\/td>\n Based off of Hidden-Tear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/808316635094380544<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    PayDOS<\/td>\n <\/td>\n <\/td>\n <\/td>\n Batch file\nPasscode: AES1014DW256<\/td>\n <\/td>\n Serpent<\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/ransomware-goes-retro-with-paydos-and-serpent-written-as-batch-files\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Paysafecard Generator 2016<\/td>\n .cry_<\/td>\n test.cry_jpg<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/796083768155078656<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    PClock<\/td>\n <\/td>\n <\/td>\n Your files are locked !.txt\nYour files are locked !!.txt\nYour files are locked !!!.txt\nYour files are locked !!!!.txt\n%AppData%\\WinCL\\winclwp.jpg<\/td>\n CryptoLocker Copycat<\/td>\n XOR<\/td>\n CryptoLocker clone\nWinPlock<\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/old-cryptolocker-copycat-named-pclock-resurfaces-with-new-attacks\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    PetrWrap<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/securelist.com\/blog\/research\/77762\/petrwrap-the-new-petya-based-ransomware-used-in-targeted-attacks\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Petya<\/td>\n .encrypted<\/td>\n <\/td>\n YOUR_FILES_ARE_ENCRYPTED.TXT\nYOUR_FILES_ARE_ENCRYPTED.HTML\nREADME.TXT<\/td>\n - overwrites MBR\n- encrypts MFT\n- PDFBewerbungsmappe.exe\n- Symantec & FireEye have confirmed that the initial attack vector is MEDoc (tax account software)<\/td>\n Modified Salsa20<\/td>\n Goldeneye<\/td>\n 29.09.2023<\/td>\n http:\/\/www.thewindowsclub.com\/petya-ransomware-decrypt-tool-password-generator\nhttps:\/\/www.youtube.com\/watch?v=mSqxFjZq_z4<\/td>\n https:\/\/blog.malwarebytes.org\/threat-analysis\/2016\/04\/petya-ransomware\/ \nhttps:\/\/www.fireeye.com\/blog\/threat-research\/2017\/06\/petya-ransomware-spreading-via-eternalblue-exploit.html<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/petya-ransomware-returns-with-goldeneye-version-continuing-james-bond-theme\/\nhttps:\/\/symantec-blogs.broadcom.com\/blogs\/threat-intelligence\/petya-ransomware-wiper?om_ext_cid=biz_social_NAM_twitter_Asset%2520Type%2520%2520-%2520Blog,Petya<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Philadelphia<\/td>\n .locked<\/td>\n .locked<\/td>\n <\/td>\n Coded by \"The_Rainmaker\"<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/philadelphia<\/td>\n www.bleepingcomputer.com\/news\/security\/the-philadelphia-ransomware-offers-a-mercy-button-for-compassionate-criminals\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Phobos<\/td>\n .phobos<\/td>\n file name[ID-000QQQ.hacker@AOL.com].phobos<\/td>\n <\/td>\n Rebranded Dharma Ransom Note<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.coveware.com\/blog\/phobos-ransomware-distributed-dharma-crew<\/td>\n https:\/\/www.bleepingcomputer.com\/forums\/t\/688649\/phobos-ransomware-help-topic-phobos-phoboshta\/page-2<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Phoenix<\/td>\n .R.i.P<\/td>\n <\/td>\n Important!.txt<\/td>\n Based on HiddenTear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/804810315456200704<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Pickles<\/td>\n .EnCrYpTeD<\/td>\n %random%.EnCrYpTeD<\/td>\n READ_ME_TO_DECRYPT.txt<\/td>\n Python Ransomware<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/834821166116327425<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    PizzaCrypts<\/td>\n .id-[victim_id]-maestro@pizzacrypts.info<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/download.bleepingcomputer.com\/BloodDolly\/JuicyLemonDecoder.zip<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    PokemonGO<\/td>\n .locked<\/td>\n <\/td>\n <\/td>\n Based on Hidden Tear<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/pokemonGO.html<\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/pokemongo-ransomware-installs-backdoor-accounts-and-spreads-to-other-drives\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Popcorn Time<\/td>\n .filock<\/td>\n <\/td>\n restore_your_files.html\nrestore_your_files.txt<\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/new-scheme-spread-popcorn-time-ransomware-get-chance-of-free-decryption-key\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Polyglot<\/td>\n <\/td>\n <\/td>\n <\/td>\n Immitates CTB-Locker<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/8547<\/td>\n https:\/\/securelist.com\/blog\/research\/76182\/polyglot-the-fake-ctb-locker\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Potato<\/td>\n .potato<\/td>\n <\/td>\n README.png\nREADME.html<\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    PowerWare<\/td>\n .locky<\/td>\n <\/td>\n <\/td>\n Open-sourced PowerShell<\/td>\n AES(128)<\/td>\n PoshCoder<\/td>\n <\/td>\n https:\/\/github.com\/pan-unit42\/public_tools\/blob\/master\/powerware\/powerware_decrypt.py\nhttps:\/\/download.bleepingcomputer.com\/demonslay335\/PowerLockyDecrypter.zip<\/td>\n https:\/\/www.carbonblack.com\/2016\/03\/25\/threat-alert-powerware-new-ransomware-written-in-powershell-targets-organizations-via-microsoft-word\/<\/td>\n http:\/\/researchcenter.paloaltonetworks.com\/2016\/07\/unit42-powerware-ransomware-spoofing-locky-malware-family\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    PowerWorm<\/td>\n <\/td>\n <\/td>\n DECRYPT_INSTRUCTION.html\nlooks like CryptoWall 3, but with additional warnings at the bottom that ransom price will go up after some time<\/td>\n no decryption possible<\/td>\n AES, but throws key away, destroys the files<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Princess Locker<\/td>\n <\/td>\n [a-z]{4,6},[0-9]<\/td>\n !_HOW_TO_RESTORE_[extension].TXT\n!_HOW_TO_RESTORE_[extension].html\n!_HOW_TO_RESTORE_*id*.txt\n.*id*\n@_USE_TO_FIX_JJnY.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/hshrzd.wordpress.com\/2016\/11\/17\/princess-locker-decryptor\/<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/introducing-her-royal-highness-the-princess-locker-ransomware\/<\/td>\n https:\/\/blog.malwarebytes.com\/threat-analysis\/2016\/11\/princess-ransomware\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    PRISM<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.enigmasoftware.com\/prismyourcomputerhasbeenlockedransomware-removal\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Project34<\/td>\n <\/td>\n <\/td>\n \u041f\u0410\u0420\u041e\u041b\u042c.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    ProposalCrypt<\/td>\n .crypted<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/demonslay335\/status\/812002960083394560<\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/811613888705859586<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Ps2exe<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/jiriatvirlab\/status\/803297700175286273<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    PyL33T<\/td>\n .d4nk<\/td>\n <\/td>\n <\/td>\n Python Ransomware<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/Jan0fficial\/status\/834706668466405377<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    R<\/td>\n <\/td>\n <\/td>\n Ransomware.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/846705481741733892<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    R980<\/td>\n .crypt<\/td>\n <\/td>\n DECRYPTION INSTRUCTIONS.txt\nrtext.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/otx.alienvault.com\/pulse\/57976b52b900fe01376feb01\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    RAA encryptor<\/td>\n .locked<\/td>\n <\/td>\n !!!README!!![id].rtf<\/td>\n Possible affiliation with Pony<\/td>\n <\/td>\n RAA<\/td>\n <\/td>\n <\/td>\n https:\/\/reaqta.com\/2016\/06\/raa-ransomware-delivering-pony\/<\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/the-new-raa-ransomware-is-created-entirely-using-javascript\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Rabion<\/td>\n <\/td>\n <\/td>\n <\/td>\n RaaS\nCopy of Ranion RaaS<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/CryptoInsane\/status\/846181140025282561<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Radamant<\/td>\n .RDM\n.RRK\n.RAD\n.RADAMANT<\/td>\n <\/td>\n YOUR_FILES.url<\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n https:\/\/decrypter.emsisoft.com\/radamant<\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/new-radamant-ransomware-kit-adds-rdm-extension-to-encrypted-files\/<\/td>\n http:\/\/www.nyxbone.com\/malware\/radamant.html<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Rakhni<\/td>\n .locked\n.kraken\n.darkness\n.nochance\n.oshit\n.oplata@qq_com\n.relock@qq_com\n.crypto\n.helpdecrypt@ukr.net\n.pizda@qq_com\n.dyatel@qq_com\n_ryp\n.nalog@qq_com\n.chifrator@qq_com\n.gruzin@qq_com\n.troyancoder@qq_com\n.encrypted\n.cry\n.AES256\n.enc\n.hb15<\/td>\n .coderksu@gmail_com_id[0-9]{2,3}\n.crypt@india.com.[\\w]{4,12}<\/td>\n \\fud.bmp\n\\paycrypt.bmp\n\\strongcrypt.bmp\n\\maxcrypt.bmp\nor a similar named bmp in the startup folder\n%APPDATA%\\Roaming\\.bmp is set as wallpaper<\/td>\n Files might be partially encrypted<\/td>\n <\/td>\n Agent.iih \nAura \nAutoit \nPletor \nRotor \nLamer \nIsda\nCryptokluchen\nBandarchor<\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/us\/viruses\/disinfection\/10556<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Ramsomeer<\/td>\n <\/td>\n <\/td>\n <\/td>\n Based on the DUMB ransomware<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Ranion<\/td>\n <\/td>\n <\/td>\n <\/td>\n RaaS service<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/ranion-ransomware-as-a-service-available-on-the-dark-web-for-educational-purposes\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Rannoh<\/td>\n <\/td>\n locked-.[a-zA-Z]{4}<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/viruses\/disinfection\/8547<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    RanRan<\/td>\n .zXz<\/td>\n <\/td>\n VictemKey_0_5\nVictemKey_5_30\nVictemKey_30_100\nVictemKey_100_300\nVictemKey_300_700\nVictemKey_700_2000\nVictemKey_2000_3000\nVictemKey_3000\nzXz.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/github.com\/pan-unit42\/public_tools\/tree\/master\/ranran_decryption<\/td>\n http:\/\/researchcenter.paloaltonetworks.com\/2017\/03\/unit42-targeted-ransomware-attacks-middle-eastern-government-organizations-political-purposes\/<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/new-ranran-ransomware-uses-encryption-tiers-political-messages\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Ransoc<\/td>\n <\/td>\n <\/td>\n <\/td>\n Doesn't encrypt user files<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/ransoc-desktop-locking-ransomware-ransacks-local-files-social-media-profiles<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/ransoc-ransomware-extorts-users-who-accessed-questionable-content\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Ransom32<\/td>\n <\/td>\n <\/td>\n <\/td>\n no extension change, Javascript Ransomware<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    RansomLock<\/td>\n <\/td>\n <\/td>\n <\/td>\n Locks the desktop<\/td>\n Asymmetric 1024<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.symantec.com\/security_response\/writeup.jsp?docid=2009-041513-1400-99&tabid=2<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    RansomPlus<\/td>\n .encrypted<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/jiriatvirlab\/status\/825411602535088129<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    RarVault<\/td>\n <\/td>\n <\/td>\n RarVault.htm<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Razy<\/td>\n .razy\n.fear<\/td>\n <\/td>\n <\/td>\n <\/td>\n AES(128)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/Razy(German).html<\/td>\n http:\/\/nyxbone.com\/malware\/Razy.html<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Rector<\/td>\n .vscrypt\n.infected\n.bloc\n.korrektor<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/viruses\/disinfection\/4264<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Red Alert<\/td>\n <\/td>\n <\/td>\n <\/td>\n Based on Hidden Tear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JaromirHorejsi\/status\/815557601312329728<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    RektLocker<\/td>\n .rekt<\/td>\n <\/td>\n Readme.txt<\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/viruses\/disinfection\/4264<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    RemindMe<\/td>\n .remind\n.crashed<\/td>\n <\/td>\n decypt_your_files.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/RemindMe.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Revenge<\/td>\n .REVENGE<\/td>\n <\/td>\n # !!!HELP_FILE!!! #.txt<\/td>\n CryptoMix \/ CryptFile2 Variant<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/revenge-ransomware-a-cryptomix-variant-being-distributed-by-rig-exploit-kit\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Rokku<\/td>\n .rokku<\/td>\n <\/td>\n README_HOW_TO_UNLOCK.TXT\nREADME_HOW_TO_UNLOCK.HTML<\/td>\n possibly related with Chimera<\/td>\n Curve25519 + ChaCha<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/blog.malwarebytes.org\/threat-analysis\/2016\/04\/rokku-ransomware\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    RoshaLock<\/td>\n <\/td>\n <\/td>\n <\/td>\n Stores your files in a password protected RAR file<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/siri_urz\/status\/842452104279134209<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    RozaLocker<\/td>\n .ENC<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/jiriatvirlab\/status\/840863070733885440<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Runsomewere<\/td>\n <\/td>\n <\/td>\n <\/td>\n Based on HT\/EDA2\nUtilizes the Jigsaw Ransomware background<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/801812325657440256<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    RussianRoulette<\/td>\n <\/td>\n <\/td>\n <\/td>\n Variant of the Philadelphia ransomware<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/823925410392080385<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    SADStory<\/td>\n <\/td>\n <\/td>\n <\/td>\n Variant of CryPy<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/845356853039190016<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Sage 2.0<\/td>\n .sage<\/td>\n <\/td>\n !Recovery_[3_random_chars].html<\/td>\n Predecessor CryLocker<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/sage-2-0-ransomware-gearing-up-for-possible-greater-distribution\/<\/td>\n https:\/\/www.govcert.admin.ch\/blog\/27\/sage-2.0-comes-with-ip-generation-algorithm-ipga<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Sage 2.2<\/td>\n .sage<\/td>\n <\/td>\n <\/td>\n Sage 2.2 deletes volume snapshots through vssadmin.exe, disables startup repair, uses process wscript.exe to execute a VBScript, and coordinates the execution of scheduled tasks via schtasks.exe.<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/malwarebreakdown.com\/2017\/03\/16\/sage-2-2-ransomware-from-good-man-gate<\/td>\n https:\/\/malwarebreakdown.com\/2017\/03\/10\/finding-a-good-man\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Samas-Samsam<\/td>\n .encryptedAES\n.encryptedRSA\n.encedRSA\n.justbtcwillhelpyou\n.btcbtcbtc\n.btc-help-you\n.only-we_can-help_you\n.iwanthelpuuu\n.notfoundrans\n.encmywork\n.VforVendetta\n.theworldisyours\n.Whereisyourfiles\n.helpmeencedfiles\n.powerfulldecrypt\n.noproblemwedecfiles\n.weareyourfriends\n.otherinformation\n.letmetrydecfiles\n.encryptedyourfiles\n.weencedufiles\n.iaufkakfhsaraf\n.cifgksaffsfyghd<\/td>\n <\/td>\n HELP_DECRYPT_YOUR_FILES.html\n###-READ-FOR-HELLPP.html\n000-PLEASE-READ-WE-HELP.html\nCHECK-IT-HELP-FILES.html\nWHERE-YOUR-FILES.html\nHELP-ME-ENCED-FILES.html\nWE-MUST-DEC-FILES.html\n000-No-PROBLEM-WE-DEC-FILES.html\nTRY-READ-ME-TO-DEC.html\n000-IF-YOU-WANT-DEC-FILES.html\nLET-ME-TRY-DEC-FILES.html\n001-READ-FOR-DECRYPT-FILES.html\nREAD-READ-READ.html\nIF_WANT_FILES_BACK_PLS_READ.html\nREAD_READ_DEC_FILES.html<\/td>\n Targeted attacks\n-Jexboss\n-PSExec\n-Hyena<\/td>\n AES(256) + RSA(2096)<\/td>\n samsam.exe\nMIKOPONI.exe\nRikiRafael.exe\nshowmehowto.exe<\/td>\n <\/td>\n https:\/\/download.bleepingcomputer.com\/demonslay335\/SamSamStringDecrypter.zip<\/td>\n http:\/\/blog.talosintel.com\/2016\/03\/samsam-ransomware.html<\/td>\n http:\/\/www.intelsecurity.com\/advanced-threat-research\/content\/Analysis_SamSa_Ransomware.pdf<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Sanction<\/td>\n .sanction<\/td>\n <\/td>\n DECRYPT_YOUR_FILES.HTML<\/td>\n Based on HiddenTear, but heavily modified keygen<\/td>\n AES(256) + RSA(2096)<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Sanctions<\/td>\n .wallet<\/td>\n <\/td>\n RESTORE_ALL_DATA.html<\/td>\n <\/td>\n AES(256) + RSA(2048)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/sanctions-ransomware-makes-fun-of-usa-sanctions-against-russia\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Sardoninir<\/td>\n .enc<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/835955409953357825<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Satan<\/td>\n .stn<\/td>\n <\/td>\n HELP_DECRYPT_FILES.html<\/td>\n RaaS<\/td>\n AES(256) + RSA(2096)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/new-satan-ransomware-available-through-a-ransomware-as-a-service-\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Satana<\/td>\n Sarah_G@ausi.com___<\/td>\n <\/td>\n !satana!.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/blog.malwarebytes.com\/threat-analysis\/2016\/06\/satana-ransomware\/<\/td>\n https:\/\/blog.kaspersky.com\/satana-ransomware\/12558\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Saturn<\/td>\n <\/td>\n <\/td>\n #DECRYPT_MY_FILES#.txt\n#DECRYPT_MY_FILES#.vbs\n#DECRYPT_MY_FILES.BMP<\/td>\n VM aware, deletes volume shadow copies, disables windows startup repair, clears windows backup catalog.<\/td>\n <\/td>\n <\/td>\n 02\/19\/2018<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Scarab<\/td>\n .scarab<\/td>\n <\/td>\n <\/td>\n Post encryption, text file is dropped w\/personal identifier and email to contact as well as a Bitmessage account. Email = suupport[@]protonmail[.]com and Bitmessage = BM-2cTu8prUGDS6XmXqPrZiYXXeqyFw5dXEba<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Scraper<\/td>\n <\/td>\n <\/td>\n <\/td>\n no extension change<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/securelist.com\/blog\/research\/69481\/a-flawed-ransomware-encryptor\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    SerbRansom<\/td>\n .velikasrbija<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/830116190873849856<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/ultranationalist-developer-behind-serbransom-ransomware\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Serpent<\/td>\n .serpent<\/td>\n <\/td>\n HOW_TO_DECRYPT_YOUR_FILES_[random_3_chars].html\nHOW_TO_DECRYPT_YOUR_FILES_[random_3_chars].txt<\/td>\n Batch file\nPasscode: RSA1014DJW2048<\/td>\n AES(256)<\/td>\n PayDOS<\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/ransomware-goes-retro-with-paydos-and-serpent-written-as-batch-files\/<\/td>\n https:\/\/www.proofpoint.com\/us\/threat-insight\/post\/new-serpent-ransomware-targets-danish-speakers<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Serpico<\/td>\n <\/td>\n <\/td>\n <\/td>\n DetoxCrypto Variant<\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/Serpico.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Shark<\/td>\n .locked<\/td>\n <\/td>\n Readme.txt<\/td>\n <\/td>\n AES(256)<\/td>\n Atom<\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/the-shark-ransomware-project-allows-to-create-your-own-customized-ransomware\/<\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/shark-ransomware-rebrands-as-atom-for-a-fresh-start\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    ShellLocker<\/td>\n .L0cked<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/799388289337671680<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    ShinoLocker<\/td>\n .shino<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/760560147131408384<\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/new-educational-shinolocker-ransomware-project-released\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Shujin<\/td>\n <\/td>\n <\/td>\n \u6587\u4ef6\u89e3\u5bc6\u5e2e\u52a9.txt<\/td>\n <\/td>\n <\/td>\n KinCrypt<\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/chineseRansom.html<\/td>\n http:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/chinese-language-ransomware-makes-appearance\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Simple_Encoder<\/td>\n .~<\/td>\n <\/td>\n _RECOVER_INSTRUCTIONS.ini<\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/the-shark-ransomware-project-allows-to-create-your-own-customized-ransomware\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    SkidLocker \/ Pompous<\/td>\n .locked<\/td>\n <\/td>\n READ_IT.txt<\/td>\n Based on EDA2<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/pompous-ransomware-dev-gets-defeated-by-backdoor\/<\/td>\n http:\/\/www.nyxbone.com\/malware\/SkidLocker.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    SkyName<\/td>\n <\/td>\n <\/td>\n <\/td>\n Based on HiddenTear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/817079028725190656<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Smash!<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/smash-ransomware-is-cute-rather-than-dangerous\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Smrss32<\/td>\n .encrypted<\/td>\n <\/td>\n _HOW_TO_Decrypt.bmp<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Snatch<\/td>\n .abcde\n\n.snatch\n.jimm\n.googl\n.dglnl\n.ohwqg\n.wvtr0\n.hceem<\/td>\n appending .abcde to the original file name (e.g., filename.txt.abcde)<\/td>\n README_ABCDE_FILES.txt\nDECRYPT_ABCDE_DATA.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/news.sophos.com\/en-us\/2019\/12\/09\/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection\/<\/td>\n https:\/\/thedfirreport.com\/2020\/06\/21\/snatch-ransomware\/<\/a><\/td>\n 193.188.22.29 (:443)\n193.188.22.29 (:37462)\n193.188.22.26\n193.188.22.25\n67.211.209.151 (:3306)\n37.59.146.180\n45.147.228.91\n185.61.149.242\n94.140.125.150\nmydatasuperhero.com\nmydatassuperhero.com\nsnatch24uldhpwrm.onion\nsnatch6brk4nfczg.onion<\/td>\n commands executed during the attack:\nvssadmin delete shadows \/all \/quiet\nbcdedit.exe \/set {current} safeboot minimal\nshutdown.exe \/r \/f \/t 00\nnet stop SuperBackupMan<\/td>\n <\/tr>\n
    SNSLocker<\/td>\n .RSNSlocked\n.RSplited<\/td>\n <\/td>\n READ_Me.txt<\/td>\n Based on EDA2<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/nyxbone.com\/malware\/SNSLocker.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Spora<\/td>\n <\/td>\n <\/td>\n [Infection-ID].HTML<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/blog.gdatasoftware.com\/2017\/01\/29442-spora-worm-and-ransomware<\/td>\n http:\/\/blog.emsisoft.com\/2017\/01\/10\/from-darknet-with-love-meet-spora-ransomware\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Sport<\/td>\n .sport<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Stampado<\/td>\n .locked<\/td>\n <\/td>\n Random message includes bitcoin wallet address with instructions<\/td>\n Coded by \"The_Rainmaker\"\nRandomly deletes a file every 6hrs up to 96hrs then deletes decryption key<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n https:\/\/success.trendmicro.com\/portal_kb_articledetail?solutionid=1114221\nhttp:\/\/www.bleepingcomputer.com\/news\/security\/stampado-ransomware-campaign-decrypted-before-it-started\/\nhttps:\/\/decrypter.emsisoft.com\/stampado<\/td>\n https:\/\/cdn.streamable.com\/video\/mp4\/kfh3.mp4<\/td>\n http:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/the-economics-behind-ransomware-prices\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Strictor<\/td>\n .locked<\/td>\n <\/td>\n <\/td>\n Based on EDA2, shows Guy Fawkes mask<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/Strictor.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Surprise<\/td>\n .surprise\n.tzu<\/td>\n <\/td>\n DECRYPTION_HOWTO.Notepad<\/td>\n Based on EDA2<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Survey<\/td>\n <\/td>\n <\/td>\n ThxForYurTyme.txt<\/td>\n Still in development, shows FileIce survey<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    SynoLocker<\/td>\n <\/td>\n <\/td>\n <\/td>\n Exploited Synology NAS firmware directly over WAN<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    SZFLocker<\/td>\n .szf<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/now.avg.com\/dont-pay-the-ransom-avg-releases-six-free-decryption-tools-to-retrieve-your-files\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    TeamXrat<\/td>\n .___xratteamLucked<\/td>\n <\/td>\n Como descriptografar os seus arquivos.txt<\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/securelist.com\/blog\/research\/76153\/teamxrat-brazilian-cybercrime-meets-ransomware\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    TeleCrypt<\/td>\n .xcri<\/td>\n <\/td>\n HELP_RESTORE.HTML\nRECOVER[5 random symbols].html<\/td>\n Telecrypt will generate a random string to encrypt with that is between 10-20 length and only contain the letters vo,pr,bm,xu,zt,dq.<\/td>\n <\/td>\n Trojan-Ransom.Win32.Telecrypt\nPDM:Trojan.Win32.Generic<\/td>\n 29.09.2023<\/td>\n https:\/\/malwarebytes.app.box.com\/s\/kkxwgzbpwe7oh59xqfwcz97uk0q05kp3\nhttps:\/\/blog.malwarebytes.com\/threat-analysis\/2016\/11\/telecrypt-the-ransomware-abusing-telegram-api-defeated\/<\/td>\n https:\/\/blog.malwarebytes.com\/threat-analysis\/2016\/11\/telecrypt-the-ransomware-abusing-telegram-api-defeated\/<\/td>\n https:\/\/securelist.com\/blog\/research\/76558\/the-first-cryptor-to-exploit-telegram\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    TeslaCrypt 0.x - 2.2.0<\/td>\n .vvv\n.ecc\n.exx\n.ezz\n.abc\n.aaa\n.zzz\n.xyz<\/td>\n <\/td>\n HELP_TO_SAVE_FILES.txt\nHowto_RESTORE_FILES.html<\/td>\n Factorization<\/td>\n RSA\nAES\nECHD<\/td>\n AlphaCrypt<\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/576600\/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt\/\nhttp:\/\/www.talosintel.com\/teslacrypt_tool\/<\/td>\n https:\/\/www.fireeye.com\/blog\/threat-research\/2015\/05\/teslacrypt_followin.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    TeslaCrypt 3.0+<\/td>\n .micro\n.xxx\n.ttt\n.mp3<\/td>\n <\/td>\n <\/td>\n 4.0+ has no extension<\/td>\n AES(256) + ECHD + SHA1<\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/576600\/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt\/\nhttp:\/\/www.welivesecurity.com\/2016\/05\/18\/eset-releases-decryptor-recent-variants-teslacrypt-ransomware\/\nhttps:\/\/blog.kaspersky.com\/raknidecryptor-vs-teslacrypt\/12169\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    TeslaCrypt 4.1A<\/td>\n <\/td>\n <\/td>\n RECOVER<5_chars>.html\nRECOVER<5_chars>.png\nRECOVER<5_chars>.txt\n_how_recover+.txt or .html\nhelp_recover_instructions+.BMP or .html or .txt\n_H_e_l_p_RECOVER_INSTRUCTIONS+.txt, .html or .png\nRecovery+<5 random chars>.txt, .html, e.g., Recovery+gwote.txt\nRESTORE_FILES_.TXT , e.g. restore_files_kksli.bmp\nHELP_RESTORE_FILES_.TXT , e.g. help_restore_files_kksli.bmp\nHOWTO_RECOVER_FILES_.TXT. e.g. howto_recover_files_xeyye.txt\nHELP_TO_SAVE_FILES.txt or .bmp<\/td>\n no special extension<\/td>\n AES(256) + ECHD + SHA1<\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/576600\/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt\/\nhttp:\/\/www.welivesecurity.com\/2016\/05\/18\/eset-releases-decryptor-recent-variants-teslacrypt-ransomware\/\nhttps:\/\/blog.kaspersky.com\/raknidecryptor-vs-teslacrypt\/12169\/<\/td>\n https:\/\/www.endgame.com\/blog\/your-package-has-been-successfully-encrypted-teslacrypt-41a-and-malware-attack-chain<\/td>\n https:\/\/blog.kaspersky.com\/raknidecryptor-vs-teslacrypt\/12169\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    TeslaCrypt 4.2<\/td>\n <\/td>\n <\/td>\n RECOVER<5_chars>.html\nRECOVER<5_chars>.png\nRECOVER<5_chars>.txt\n_how_recover+.txt or .html\nhelp_recover_instructions+.BMP or .html or .txt\n_H_e_l_p_RECOVER_INSTRUCTIONS+.txt, .html or .png\nRecovery+<5 random chars>.txt, .html, e.g., Recovery+gwote.txt\nRESTORE_FILES_.TXT , e.g. restore_files_kksli.bmp\nHELP_RESTORE_FILES_.TXT , e.g. help_restore_files_kksli.bmp\nHOWTO_RECOVER_FILES_.TXT. e.g. howto_recover_files_xeyye.txt\nHELP_TO_SAVE_FILES.txt or .bmp<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/576600\/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt\/\nhttp:\/\/www.welivesecurity.com\/2016\/05\/18\/eset-releases-decryptor-recent-variants-teslacrypt-ransomware\/\nhttps:\/\/blog.kaspersky.com\/raknidecryptor-vs-teslacrypt\/12169\/<\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/teslacrypt-4-2-released-with-quite-a-few-modifications\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Thanksgiving<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/801486420368093184<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Threat Finder<\/td>\n <\/td>\n <\/td>\n HELP_DECRYPT.HTML<\/td>\n Files cannot be decrypted\nHas a GUI<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    TorrentLocker<\/td>\n .Encrypted\n.enc<\/td>\n <\/td>\n HOW_TO_RESTORE_FILES.html\nDECRYPT_INSTRUCTIONS.html\nDESIFROVANI_POKYNY.html\nINSTRUCCIONES_DESCIFRADO.html\nISTRUZIONI_DECRITTAZIONE.html\nENTSCHLUSSELN_HINWEISE.html\nONTSLEUTELINGS_INSTRUCTIES.html\nINSTRUCTIONS_DE_DECRYPTAGE.html\nSIFRE_COZME_TALIMATI.html\nwie_zum_Wiederherstellen_von_Dateien.txt<\/td>\n Newer variants not decryptable.\nOnly first 2 MB are encrypted<\/td>\n AES(256) CBC for files\nRSA(1024) for AES key\nuses LibTomCrypt<\/td>\n Crypt0L0cker\nCryptoFortress \nTeerac<\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/547708\/torrentlocker-ransomware-cracked-and-decrypter-has-been-made\/<\/td>\n https:\/\/twitter.com\/PolarToffee\/status\/804008236600934403<\/td>\n http:\/\/blog.talosintelligence.com\/2017\/03\/crypt0l0cker-torrentlocker-old-dog-new.html<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    TowerWeb<\/td>\n <\/td>\n <\/td>\n Payment_Instructions.jpg<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/618055\/towerweb-ransomware-help-support-topic-payment-instructionsjpg\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Toxcrypt<\/td>\n .toxcrypt<\/td>\n <\/td>\n tox.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Trojan<\/td>\n .braincrypt<\/td>\n <\/td>\n !!! HOW TO DECRYPT FILES !!!.txt<\/td>\n <\/td>\n <\/td>\n BrainCrypt<\/td>\n <\/td>\n https:\/\/download.bleepingcomputer.com\/demonslay335\/BrainCryptDecrypter.zip<\/td>\n https:\/\/twitter.com\/PolarToffee\/status\/811249250285842432<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Troldesh<\/td>\n .breaking_bad\n.better_call_saul\n.xtbl\n.da_vinci_code\n.windows10\n.no_more_ransom<\/td>\n <\/td>\n README.txt \nnomoreransom_note_original.txt<\/td>\n May download additional malware after encryption<\/td>\n AES(256)<\/td>\n Shade\nXTBL<\/td>\n <\/td>\n https:\/\/www.nomoreransom.org\/uploads\/ShadeDecryptor_how-to_guide.pdf<\/td>\n http:\/\/www.nyxbone.com\/malware\/Troldesh.html<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/kelihos-botnet-delivering-shade-troldesh-ransomware-with-no-more-ransom-extension\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    TrueCrypter<\/td>\n .enc<\/td>\n <\/td>\n <\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/news\/security\/truecrypter-ransomware-accepts-payment-in-bitcoins-or-amazon-gift-card\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Trump Locker<\/td>\n .TheTrumpLockerf\n.TheTrumpLockerfp<\/td>\n <\/td>\n What happen to my files.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/new-trump-locker-ransomware-is-a-fraud-just-venuslocker-in-disguise\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Turkish<\/td>\n .sifreli<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/821991600637313024<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Turkish (Fake CTB-Locker)<\/td>\n .encrypted<\/td>\n <\/td>\n Beni Oku.txt<\/td>\n keys in '%name%.manifest.xml<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/842034887397908480<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Turkish Ransom<\/td>\n .locked<\/td>\n <\/td>\n DOSYALARINIZA ULA\u015eMAK \u0130\u00c7\u0130N A\u00c7INIZ.html<\/td>\n <\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/turkishRansom.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    UltraLocker<\/td>\n <\/td>\n <\/td>\n <\/td>\n Based on the idiotic open-source ransomware called CryptoWire<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/807161652663742465<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/-proof-of-concept-cryptowire-ransomware-spawns-lomix-and-ultralocker-families\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    UmbreCrypt<\/td>\n <\/td>\n umbrecrypt_ID_[VICTIMID]<\/td>\n README_DECRYPT_UMBRE_ID_[victim_id].jpg\nREADME_DECRYPT_UMBRE_ID_[victim_id].txt\ndefault32643264.bmp\ndefault432643264.jpg<\/td>\n CrypBoss Family<\/td>\n AES<\/td>\n <\/td>\n <\/td>\n http:\/\/www.thewindowsclub.com\/emsisoft-decrypter-hydracrypt-umbrecrypt-ransomware<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    UnblockUPC<\/td>\n <\/td>\n <\/td>\n Files encrypted.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/forums\/t\/627582\/unblockupc-ransomware-help-support-topic-files-encryptedtxt\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Ungluk<\/td>\n .H3LL\n.0x0\n.1999<\/td>\n <\/td>\n READTHISNOW!!!.txt\nHellothere.txt\nYOUGOTHACKED.TXT<\/td>\n Ransom note instructs to use Bitmessage to get in contact with attacker\nSecretishere.key\nSECRETISHIDINGHEREINSIDE.KEY\nsecret.key<\/td>\n AES<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Unlock26<\/td>\n .locked-[XXX]<\/td>\n <\/td>\n ReadMe-XXX.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/new-raas-portal-preparing-to-spread-unlock26-ransomware\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Unlock92<\/td>\n .CRRRT\n.CCCRRRPPP<\/td>\n <\/td>\n READ_ME_!.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/839038399944224768<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Vanguard<\/td>\n <\/td>\n <\/td>\n <\/td>\n GO Ransomware<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JAMESWT_MHT\/status\/834783231476166657<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    VapeLauncher<\/td>\n <\/td>\n <\/td>\n <\/td>\n CryptoWire variant<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/839771195830648833<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    VaultCrypt<\/td>\n .vault\n.xort\n.trun<\/td>\n <\/td>\n VAULT.txt\nxort.txt\ntrun.txt\n.hta | VAULT.hta<\/td>\n <\/td>\n uses gpg.exe<\/td>\n CrypVault\nZlader<\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/russianRansom.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    VBRANSOM 7<\/td>\n .VBRANSOM<\/td>\n <\/td>\n <\/td>\n Does not actually encrypt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/817851339078336513<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    VenisRansomware<\/td>\n <\/td>\n <\/td>\n <\/td>\n In dev\nVenisRansom@protonmail.com<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/Antelox\/status\/785849412635521024<\/td>\n http:\/\/pastebin.com\/HuK99Xmj<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    VenusLocker<\/td>\n .Venusf\n.Venusp<\/td>\n <\/td>\n ReadMe.txt<\/td>\n Based on EDA2<\/td>\n AES(256)<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/blog.malwarebytes.com\/threat-analysis\/2016\/08\/venus-locker-another-net-ransomware\/?utm_source=twitter&utm_medium=social<\/td>\n http:\/\/www.nyxbone.com\/malware\/venusLocker.html<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Vindows Locker<\/td>\n .vindows<\/td>\n <\/td>\n <\/td>\n <\/td>\n AES<\/td>\n <\/td>\n <\/td>\n https:\/\/malwarebytes.app.box.com\/s\/gdu18hr17mwqszj3hjw5m3sw84k8hlph\nhttps:\/\/rol.im\/VindowsUnlocker.zip<\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/800729944112427008<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/vindowslocker-ransomware-mimics-tech-support-scam-not-the-other-way-around\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Virlock<\/td>\n .exe<\/td>\n <\/td>\n <\/td>\n Polymorphism \/ Self-replication<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/Virlock.html<\/td>\n http:\/\/www.welivesecurity.com\/2014\/12\/22\/win32virlock-first-self-reproducing-ransomware-also-shape-shifter\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Virus-Encoder<\/td>\n .CrySiS\n.xtbl\n.crypt\n.DHARMA<\/td>\n .id-########.decryptformoney@india.com.xtbl\n.[email_address].DHARMA<\/td>\n How to decrypt your data.txt<\/td>\n <\/td>\n AES(256)<\/td>\n CrySiS<\/td>\n <\/td>\n http:\/\/www.welivesecurity.com\/2016\/11\/24\/new-decryption-tool-crysis-ransomware\/\nhttp:\/\/media.kaspersky.com\/utilities\/VirusUtilities\/EN\/rakhnidecryptor.zip<\/td>\n http:\/\/www.nyxbone.com\/malware\/virus-encoder.html<\/td>\n http:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/crysis-targeting-businesses-in-australia-new-zealand-via-brute-forced-rdps\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Vortex<\/td>\n .aes<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n \u0166l\u0e4ft\u0454\u0433\u0e04 \u0433\u0e04\u0e20\u0e23\u0e4f\u0e53\u0e2c\u0e04\u0433\u0454<\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/839778905091424260<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    vxLock<\/td>\n .vxLock<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    WannaCry<\/td>\n .wcry\n.wncry\n.WNCRY\n.WCRY<\/td>\n <\/td>\n @Please_Read_Me@.txt<\/td>\n <\/td>\n <\/td>\n WannaCrypt\nWCry<\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/846241982347427840<\/td>\n https:\/\/docs.google.com\/spreadsheets\/d\/1XNCCiiwpIfW8y0mzTUdLLVzoW6x64hkHJ29hcQW5deQ\/pubhtml#<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    WildFire Locker<\/td>\n .wflx<\/td>\n <\/td>\n HOW_TO_UNLOCK_FILES_README_().txt<\/td>\n Zyklon variant<\/td>\n <\/td>\n Hades Locker<\/td>\n <\/td>\n <\/td>\n https:\/\/labs.opendns.com\/2016\/07\/13\/wildfire-ransomware-gaining-momentum\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Winnix Cryptor<\/td>\n .wnx<\/td>\n <\/td>\n YOUR FILES ARE ENCRYPTED!.txt<\/td>\n <\/td>\n GPG<\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/PolarToffee\/status\/811940037638111232<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    XCrypt<\/td>\n <\/td>\n <\/td>\n Xhelp.jpg<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/825790584971472902<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    XData<\/td>\n .~xdata~<\/td>\n <\/td>\n HOW_CAN_I_DECRYPT_MY_FILES.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/xdata-ransomware-on-a-rampage-in-ukraine\/#.WR-iz69z-MA.twitter<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Xorist<\/td>\n .EnCiPhErEd\n.73i87A\n.p5tkjw\n.PoAr2w\n.fileiscryptedhard\n.encoderpass\n.zc3791\n.antihacker2017<\/td>\n <\/td>\n HOW TO DECRYPT FILES.TXT<\/td>\n encrypted files will still have the original non-encrypted header of 0x33 bytes length<\/td>\n XOR or TEA<\/td>\n <\/td>\n <\/td>\n https:\/\/support.kaspersky.com\/viruses\/disinfection\/2911\nhttps:\/\/decrypter.emsisoft.com\/xorist<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    XRTN<\/td>\n .xrtn<\/td>\n <\/td>\n <\/td>\n VaultCrypt family<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    XYZWare<\/td>\n <\/td>\n <\/td>\n <\/td>\n Based on HiddenTear<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/833636006721122304<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    You Have Been Hacked!!!<\/td>\n .Locked<\/td>\n <\/td>\n <\/td>\n Attempt to steal passwords<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/808280549802418181<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    YourRansom<\/td>\n .yourransom<\/td>\n <\/td>\n README.txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/_ddoxer\/status\/827555507741274113<\/td>\n https:\/\/www.bleepingcomputer.com\/news\/security\/yourransom-is-the-latest-in-a-long-line-of-prank-and-educational-ransomware\/<\/a><\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Zcrypt<\/td>\n .zcrypt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Zcryptor<\/td>\n <\/td>\n <\/td>\n https:\/\/blogs.technet.microsoft.com\/mmpc\/2016\/05\/26\/link-lnk-to-ransom\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Zeta<\/td>\n .code\n.scl\n.rmd<\/td>\n <\/td>\n # HELP_DECRYPT_YOUR_FILES #.TXT<\/td>\n <\/td>\n <\/td>\n CryptoMix<\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/JakubKroustek\/status\/804009831518572544<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Zimbra<\/td>\n .crypto<\/td>\n <\/td>\n how.txt<\/td>\n mpritsken@priest.com<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n http:\/\/www.bleepingcomputer.com\/forums\/t\/617874\/zimbra-ransomware-written-in-python-help-and-support-topic-crypto-howtotxt\/<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    ZinoCrypt<\/td>\n .ZINO<\/td>\n <\/td>\n ZINO_NOTE.TXT<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/malwrhunterteam\/status\/842781575410597894<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Zlader \/ Russian<\/td>\n .vault<\/td>\n <\/td>\n <\/td>\n VaultCrypt family<\/td>\n RSA<\/td>\n VaultCrypt\nCrypVault<\/td>\n <\/td>\n <\/td>\n http:\/\/www.nyxbone.com\/malware\/russianRansom.html<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Zorro<\/td>\n .zorro<\/td>\n <\/td>\n Take_Seriously (Your saving grace).txt<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/BleepinComputer\/status\/844538370323812353<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    zScreenLocker<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/twitter.com\/struppigel\/status\/794077145349967872<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Zyka<\/td>\n .locked<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n https:\/\/download.bleepingcomputer.com\/demonslay335\/StupidDecrypter.zip<\/td>\n https:\/\/twitter.com\/GrujaRS\/status\/826153382557712385<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n
    Zyklon<\/td>\n .zyklon<\/td>\n <\/td>\n <\/td>\n Hidden Tear family, GNL Locker variant<\/td>\n <\/td>\n GNL Locker<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/tr>\n <\/tbody> \n\n \n <\/table>\n\n<\/div>\n\nGenerated by wpDataTables<\/a><\/span>