| .CryptoHasYou. |
.enc |
|
AES(256) |
|
|
INFO |
|
| 777 |
.777 |
-._[timestamp]_$[email]$.777 |
XOR |
Sevleg |
INFO |
|
|
| 7ev3n |
.R4A
.R5A |
|
|
7ev3n-HONE$T |
INFO |
INFO |
INFO
|
| 7h9r |
.7h9r |
|
AES |
|
|
INFO |
|
| 8lock8 |
.8lock8 |
|
AES (256) |
Based on H.T. |
INFO |
|
|
| ALFA Ransomware |
.bin |
|
|
|
|
INFO |
|
| Alpha Ransomware |
.encrypt |
|
AES(256) |
AlphaLocker |
INFO |
INFO |
|
| Apocalypse |
.encrypted
.SecureCrypted
.FuckYourData
.unavailable
.bleepYourFiles
.Where_my_files.txt |
|
|
|
INFO
INFO
|
|
|
| ApocalypseVM |
.encrypted
.locked |
|
|
|
INFO
|
|
|
| AutoLocky |
.locky |
|
|
|
INFO |
|
|
| BadBlock |
|
|
|
|
INFO |
INFO |
|
| BaksoCrypt |
.adr |
|
|
|
|
INFO |
|
| Bandarchor |
|
.id-[ID]_[EMAIL_ADDRESS] |
AES(256) |
Rakhni |
|
INFO |
|
| Bart |
.bart.zip |
|
|
BaCrypt |
INFO
|
INFO
INFO
|
|
| BitCryptor |
.clf |
|
|
|
INFO |
|
|
| BitStak |
.bitstak |
|
Base64 + String Replacement |
|
INFO |
|
|
| BlackShades Cryptor |
.Silent |
|
AES(256) |
SilentShade |
|
INFO |
|
| Blocatto |
.blocatto |
|
AES (256) |
Based on H.T. |
INFO |
|
|
| Booyah |
|
|
|
Salam! |
|
|
|
| Brazilian |
.lock |
|
AES(256) |
Based on EDA2 |
|
INFO |
|
| BrLock |
|
|
AES |
|
|
INFO |
|
| Browlock |
|
|
|
|
|
|
|
| Bucbi |
|
|
GOST |
|
|
INFO |
|
| BuyUnlockCode |
|
(.*).encoded.([A-Z0-9]{9}) |
|
|
|
|
|
| Cerber |
.cerber |
|
AES |
|
|
INFO |
|
| Chimera |
.crypt
4 random characters, e.g.: .PzZs, .MKJL |
|
|
|
|
INFO
INFO |
|
| CoinVault |
.clf |
|
|
|
INFO |
|
|
| Coverton |
.coverton
.enigma
.czvxce |
|
AES(256) |
|
|
INFO |
|
| Cryaki |
.{CRYPTENDBLACKDC} |
|
|
|
INFO |
|
|
| Crybola |
|
|
|
|
INFO |
|
|
| CryFile |
.criptiko
.criptoko
.criptokod
.cripttt
.aga |
|
|
|
INFO |
|
|
| CrypMIC |
|
|
|
|
INFO |
|
| Crypren |
.ENCRYPTED |
|
|
|
INFO |
INFO |
|
| Crypt38 |
.crypt38 |
|
AES |
|
INFO |
INFO |
|
| Cryptear |
|
|
AES(256) |
Based on H.T. |
INFO |
|
|
| CryptFIle2 |
.scl |
id[_ID]email_xerx@usa.com.scl |
RSA |
|
|
INFO |
|
| CryptInfinite |
.crinf |
|
|
|
INFO |
|
|
| CryptoBit |
|
|
AES and RSA |
|
INFO |
|
|
| CryptoDefense |
|
|
|
|
INFO |
|
|
| CryptoFinancial |
|
|
|
Ranscam |
|
INFO
INFO
|
|
| CryptoFortress |
.frtrss |
|
AES(256) |
|
|
|
|
| CryptoGraphic Locker |
.clf |
|
|
|
|
|
|
| CryptoHost |
|
|
AES(256) |
Manamecrypt
Telograph
ROI Locker |
INFO |
|
|
| CryptoJoker |
.crjoker |
|
AES(256) |
|
|
|
|
| CryptoLocker |
.encrypted |
|
|
|
INFO |
INFO |
|
| CryptoMix |
.code
.scl |
.id_ID_email_EMAIL_.code
.id_ID_email_EMAIL_.scl |
|
Zeta |
|
INFO |
|
| CryptoRoger |
.crptrgr |
|
AES |
|
|
INFO |
|
| CryptoShocker |
.locked |
|
AES |
|
|
INFO |
|
| CryptoTorLocker2015 |
.CryptoTorLocker2015! |
|
|
|
INFO |
|
|
| CryptoWall 1 |
|
|
|
|
|
|
|
| CryptoWall 2 |
|
|
|
|
|
|
|
| CryptoWall 3 |
|
|
|
|
|
|
|
| CryptoWall 4 |
(random).(random) |
|
|
|
|
|
|
| CryptXXX |
.crypt |
|
|
CryptProjectXXX |
INFO |
INFO |
|
| CryptXXX 2.0 |
.crypt |
|
|
CryptProjectXXX |
|
INFO |
|
| CryptXXX 3.0 |
.crypt
.cryp1
.crypz
.cryptz
random |
|
|
UltraCrypter |
|
INFO |
|
| CTB-Faker |
|
|
|
|
|
INFO
|
|
| CTB-Locker |
.ctbl |
.([a-z]{6,7}) |
RSA(2048) |
|
|
|
|
| CTB-Locker WEB |
|
|
AES(256) |
|
INFO |
INFO |
|
| CuteRansomware |
.已加密
.encrypted |
|
AES(128) |
my-Little-Ransomware |
INFO |
INFO |
|
| DeCrypt Protect |
.html |
|
|
|
INFO |
|
|
| DEDCryptor |
.ded |
|
AES(256) |
Based on EDA2 |
|
INFO
INFO
|
|
| DirtyDecrypt |
|
|
|
|
|
INFO |
|
| DMALocker |
NONE |
|
AES(256) |
|
INFO
INFO |
INFO |
|
| DMALocker 2.0 |
NONE |
|
AES(256) |
|
|
INFO |
|
| DMALocker 3.0 |
NONE |
|
AES(256) + RSA |
|
|
|
|
| DMALocker 4.0 |
NONE |
|
AES(256) + RSA |
|
|
INFO |
|
| EDA2 / HiddenTear |
.locked |
|
AES(256) |
Cryptear |
|
|
|
| EduCrypt |
.isis
.locked |
|
|
EduCrypter |
INFO
|
|
|
| El-Polocker |
.ha3 |
|
|
Los Pollos Hermanos |
|
|
|
| Enigma |
.enigma |
|
AES (128) |
|
|
INFO |
|
| Fakben |
.locked |
|
|
Based on H.T. |
|
INFO |
|
| Fury |
|
|
|
|
INFO |
|
|
| GhostCrypt |
.Z81928819 |
|
AES (256) |
Based on H.T. |
INFO |
INFO |
|
| GNL Locker |
.locked |
|
AES (256) |
|
|
INFO |
|
| Gomasom |
.crypt |
!___[EMAILADDRESS]_.crypt |
|
|
INFO |
|
|
| Goopic |
|
|
|
|
|
INFO
|
|
| Gopher |
|
|
|
|
|
|
|
| Harasom |
.html |
|
|
|
INFO |
|
|
| Herbst |
.herbst |
|
AES(256) |
|
|
INFO
| |
| Hi Buddy! |
.cry |
|
AES(256) |
Based on H.T. |
|
INFO |
|
| HolyCrypt |
(encrypted) |
|
AES |
|
|
INFO |
|
| HydraCrypt |
|
hydracrypt_ID_[\w]{8} |
|
|
INFO |
INFO |
|
| iLock |
.crime |
|
|
|
|
|
|
| iLockLight |
.crime |
|
|
|
|
|
|
| JagerDecryptor |
!ENC |
|
|
|
|
INFO
|
|
| Jeiphoos |
|
|
|
RaaS
Sarento |
|
INFO |
|
| Jigsaw |
.AFD
.btc
.fun
.gws
.kkk
.paybtcs
.paymrss
.payms
.paymst
.payransom
.payrms
.porno
.pornoransom
.paym
.pays
.epic |
|
AES(256) |
|
INFO |
INFO
INFO
|
|
| Job Crypter |
.locked
.css |
|
TripleDES |
Based on H.T. |
|
INFO
INFO |
|
| JohnyCryptor |
|
|
|
|
|
|
|
| KeRanger |
.encrypted |
|
AES |
|
INFO |
INFO |
|
| KeyBTC |
.keybtc@inbox_com |
|
|
|
INFO |
|
|
| KEYHolder |
|
|
|
|
|
INFO |
|
| KimcilWare |
.kimcilware
.locked |
|
AES |
|
INFO |
INFO |
|
| Kozy.Jozy |
.31392E30362E32303136_[ID-KEY]_LSBJ1 |
.([0-9A-Z]{20})_([0-9]{2})_([A-Z0-9]{4,5}) |
RSA(2048) |
QC |
|
INFO
INFO
|
|
| KratosCrypt |
.kratos |
|
|
|
|
|
|
| KryptoLocker |
|
|
AES(256) |
Based on H.T. |
|
|
|
| LeChiffre |
.LeChiffre |
|
|
|
INFO |
INFO |
|
| Linux.Encoder |
|
|
|
|
INFO |
|
|
| Locker |
NONE |
|
|
|
INFO |
|
|
| Locky |
.locky
.zepto |
([A-F0-9]{32}).locky
([A-F0-9]{32}).zepto |
AES(128) |
|
INFO |
|
|
| Lortok |
.crime |
|
|
|
|
|
|
| LowLevel04 |
oor. |
|
|
|
|
|
|
| Mabouia |
|
|
|
|
|
|
|
| Magic |
.magic |
|
AES(256) |
Based on EDA2 |
|
|
|
| MaktubLocker |
|
[a-z]{4,6} |
AES(256) |
|
|
INFO |
|
| MIRCOP |
Lock. |
|
AES |
Crypt888 |
INFO
|
INFO
INFO
|
|
| MireWare |
.fucked
.fuck |
|
AES(256) |
Based on H.T. |
|
|
|
| Mischa |
|
.([a-zA-Z0-9]{4}) |
|
"Petya's little brother" |
|
INFO |
|
| MM Locker |
.locked |
|
AES(256) |
Based on EDA2
Booyah |
|
INFO |
|
| Mobef |
.KEYZ
.KEYH0LES |
|
|
Yakes
CriptoBit |
|
INFO
INFO
|
|
| NanoLocker |
NONE |
|
AES(256) |
|
INFO |
|
|
| Nemucod |
.crypted |
|
XOR(255) |
|
INFO
INFO
INFO
|
|
|
| NoobCrypt |
|
|
|
|
|
INFO
|
|
| ODCODC |
.odcodc |
C-email-abennaki@india.com-(file).odcodc |
XOR |
|
INFO
|
INFO |
|
| Offline ransomware |
.cbf |
email-[params].cbf |
|
Vipasana
Cryakl |
|
INFO |
|
| OMG! Ransomware |
.LOL!
.OMG! |
|
|
GPCode |
|
|
|
| Operation Global III |
.EXE |
|
|
|
INFO |
|
|
| PadCrypt |
.padcrypt |
|
|
|
|
INFO |
|
| PClock |
|
|
XOR |
|
INFO |
|
|
| Petya |
|
|
Modified Salsa20 |
|
INFO
INFO |
INFO |
|
| PizzaCrypts |
.id-[victim_id]-maestro@pizzacrypts.info |
|
|
|
|
|
|
| PowerWare |
.locky |
|
AES(128) |
PoshCoder |
INFO
INFO
|
INFO
INFO
|
|
| PRISM |
|
|
|
|
|
INFO |
|
| R980 |
.crypt |
|
|
|
|
INFO |
|
| RAA encryptor |
.locked |
|
|
RAA |
|
INFO
INFO
|
|
| Radamant |
.RDM
.RRK
.RAD
.RADAMANT |
|
AES(256) |
|
INFO |
INFO
INFO
INFO |
|
| Rakhni |
.locked
.kraken
.darkness
.nochance
.oshit
.oplata@qq.com
.relock@qq_com
.crypto
.helpdecrypt@ukr.net
.pizda@qq_com
.dyatel@qq_com
.nalog@qq_com
.chifrator@qq_com
.gruzin@qq_com
.troyancoder@qq_com
.encrypted
.cry
.AES256
.enc
.hb15 |
.coderksu@gmail_com_id[0-9]{2,3}
.crypt@india.com.[\w]{4,12}" |
|
Agent.iih
Aura
Autoit
Pletor
Rotor
Lamer
Isda
Cryptokluchen |
INFO |
|
|
| Rannoh |
|
locked-.[a-zA-Z]{4} |
|
|
INFO |
|
|
| Ransom32 |
NONE |
|
|
|
|
|
|
| Rector |
.vscrypt
.infected
.bloc
.korrektor |
|
|
|
INFO |
|
|
| RemindMe |
.remind |
|
|
|
|
INFO |
|
| Rokku |
.rokku |
|
Curve25519 + ChaCha |
|
|
INFO |
|
| Samas-Samsam |
.encryptedAES
.encryptedRSA
.encedRSA
.justbtcwillhelpyou
.btcbtcbtc
.btc-help-you
.only-we_can-help_you
.iwanthelpuuu |
|
AES(256) + RSA(2096) |
|
|
INFO |
|
| Sanction |
.sanction |
|
AES(256) + RSA(2096) |
Based on H.T. |
|
|
|
| Satana |
Sarah_G@ausi.com___ |
|
|
|
|
INFO
INFO
|
|
| Scraper |
NONE |
|
|
|
INFO |
|
|
| ShinoLocker |
.shino |
|
|
|
|
INFO
INFO
|
|
| Shujin |
|
|
|
KinCrypt |
|
INFO
INFO |
|
| SkidLocker |
.locked |
|
AES(256) |
Based on EDA2
Pompous |
INFO |
INFO |
|
| SNSLocker |
.RSNSlocked
.RSplited |
|
AES(256) |
Based on EDA2 |
|
INFO |
|
| Sport |
.sport |
|
|
|
|
|
|
| Stampado |
.locked |
|
AES(256) |
|
INFO
|
INFO
|
|
| Strictor |
.locked |
|
AES(256) |
Based on EDA2 |
|
INFO |
|
| Surprise |
.surprise
.tzu |
|
AES(256) |
Based on EDA2 |
|
|
|
| SynoLocker |
|
|
|
|
|
|
|
| SZFLocker |
.szf |
|
|
|
INFO |
|
|
| TeslaCrypt 0.x - 2.2.0 |
.vvv
.ecc
.exx
.ezz
.abc
.aaa
.zzz
.xyz |
|
|
AlphaCrypt |
INFO
INFO |
|
|
| TeslaCrypt 3.0+ |
.micro
.xxx
.ttt
.mp3 |
|
AES(256) + ECHD + SHA1 |
|
INFO
INFO
INFO
|
|
|
| TeslaCrypt 4.1A |
NONE |
|
AES(256) + ECHD + SHA1 |
|
INFO
INFO
INFO
|
INFO
INFO
|
|
| TeslaCrypt 4.2 |
|
|
|
|
INFO
INFO
INFO
|
INFO |
|
| TorrentLocker |
.Encrypted |
|
|
Crypt0L0cker
CryptoFortress (.ftrss) |
INFO |
|
|
| TowerWeb |
|
|
|
|
|
INFO
|
|
| Toxcrypt |
.toxcrypt |
|
|
|
|
|
|
| Troldesh |
.xtbl
.breaking_bad
.better_call_saul
.da_vinci_code
.windows10 |
|
AES(256) |
Shade
XTBL |
|
INFO |
|
| TrueCrypter |
.enc |
|
AES(256) |
|
|
INFO |
|
| Turkish Ransom |
.locked |
|
AES(256) |
|
|
INFO |
|
| UmbreCrypt |
|
umbrecrypt_ID_[VICTIMID] |
AES |
|
INFO |
|
|
| Ungluk |
.H3LL
.0x0
.1999 |
|
AES |
|
|
|
|
| Unlock92 |
.CRRRT
.CCCRRRPPP |
|
|
|
|
|
|
| VaultCrypt |
.vault
.xort
.trun |
|
uses gpg.exe |
CrypVault
Zlader |
|
INFO |
|
| VenusLocker |
.Venusf
.Venusp |
|
AES(256) |
|
|
INFO |
|
| Virlock |
.exe |
|
|
|
|
INFO
INFO
INFO
INFO
|
|
| Virus-Encoder |
.CrySiS
.xtbl |
|
AES(256) |
|
|
INFO |
|
| WildFire Locker |
.wflx |
|
|
|
|
INFO |
|
| Xorist |
.EnCiPhErEd
.73i87A
.p5tkjw
.PoAr2w
.fileiscryptedhard |
|
XOR or TEA |
|
INFO |
|
|
| XRTN |
.xrtn |
|
|
|
|
|
|
| Zcrypt |
.zcrypt |
|
|
Zcryptor |
|
INFO |
|
| Zimbra |
.crypto |
|
|
|
|
INFO |
|
| Zlader / Russian |
.vault |
|
RSA |
VaultCrypt
CrypVault |
|
INFO |
|
| Zyklon |
.zyklon |
|
|
|
|
|
|
