misp-galaxy/clusters/ransomware.json

{
  "authors": [
    "Various"
  ],
  "description": "Ransomware galaxy based on https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml",
  "type": "ransomware",
  "version": 1,
  "name": "Ransomware",
  "uuid": "10cf658b-5d32-4c4b-bb32-61760a640372",
  "values": [
    {
      "description": "AES(256); .enc; ",
      "value": ".CryptoHasYou."
    },
    {
      "description": "Sevleg; XOR; .777; ._[timestamp]_$[email]$.777 e.g. ._14-05-2016-11-59-36_$ninja.gaiver@aol.com$.777; ",
      "value": "777"
    },
    {
      "description": "7ev3n-HONE$T; .R4A .R5A; ",
      "value": "7ev3n"
    },
    {
      "description": "AES; .7h9r; ",
      "value": "7h9r"
    },
    {
      "description": "AES (256); .8lock8; ",
      "value": "8lock8"
    },
    {
      "description": ".bin; ",
      "value": "Alfa Ransomware"
    },
    {
      "description": "AES(128); random; random(x5); ",
      "value": "Alma Ransomware"
    },
    {
      "description": "AlphaLocker; AES(256); .encrypt; ",
      "value": "Alpha Ransomware"
    },
    {
      "description": ".amba; ",
      "value": "AMBA"
    },
    {
      "description": ".adk; ",
      "value": "Angry Duck"
    },
    {
      "description": "Fabiansomeware; .encrypted .SecureCrypted .FuckYourData .unavailable .bleepYourFiles .Where_my_files.txt; ",
      "value": "Apocalypse"
    },
    {
      "description": ".encrypted .locked; ",
      "value": "ApocalypseVM"
    },
    {
      "description": ".locky; ",
      "value": "AutoLocky"
    },
    {
      "description": "",
      "value": "BadBlock"
    },
    {
      "description": ".adr; ",
      "value": "BaksoCrypt"
    },
    {
      "description": "Rakhni; AES(256); .id-[ID]_[EMAIL_ADDRESS]; ",
      "value": "Bandarchor"
    },
    {
      "description": "BaCrypt; .bart.zip .bart .perl; ",
      "value": "Bart"
    },
    {
      "description": ".clf; ",
      "value": "BitCryptor"
    },
    {
      "description": "Base64 + String Replacement; .bitstak; ",
      "value": "BitStak"
    },
    {
      "description": "SilentShade; AES (256); .Silent; ",
      "value": "BlackShades Crypter"
    },
    {
      "description": "AES (256); .blocatto; ",
      "value": "Blocatto"
    },
    {
      "description": "Salam!; ",
      "value": "Booyah"
    },
    {
      "description": "AES(256); .lock; ",
      "value": "Brazilian"
    },
    {
      "description": "AES; ",
      "value": "BrLock"
    },
    {
      "description": "",
      "value": "Browlock"
    },
    {
      "description": "GOST;  ; ",
      "value": "Bucbi"
    },
    {
      "description": "(.*).encoded.([A-Z0-9]{9}); ",
      "value": "BuyUnlockCode"
    },
    {
      "description": ".cry; ",
      "value": "Central Security Treatment Organization"
    },
    {
      "description": "AES; .cerber .cerber2 .cerber3; ",
      "value": "Cerber"
    },
    {
      "description": ".crypt 4 random characters, e.g., .PzZs, .MKJL; ",
      "value": "Chimera"
    },
    {
      "description": ".clf; ",
      "value": "CoinVault"
    },
    {
      "description": "AES(256); .coverton .enigma .czvxce; ",
      "value": "Coverton"
    },
    {
      "description": ".{CRYPTENDBLACKDC}; ",
      "value": "Cryaki"
    },
    {
      "description": "",
      "value": "Crybola"
    },
    {
      "description": "Moves bytes; .criptiko .criptoko .criptokod .cripttt .aga; ",
      "value": "CryFile"
    },
    {
      "description": "Cry, CSTO; .cry; ",
      "value": "CryLocker"
    },
    {
      "description": "AES(256); ",
      "value": "CrypMIC"
    },
    {
      "description": ".ENCRYPTED; ",
      "value": "Crypren"
    },
    {
      "description": "AES; .crypt38; ",
      "value": "Crypt38"
    },
    {
      "description": "Hidden Tear; AES(256); ",
      "value": "Cryptear"
    },
    {
      "description": "RSA; .scl; id[_ID]email_xerx@usa.com.scl; ",
      "value": "CryptFIle2"
    },
    {
      "description": ".crinf; ",
      "value": "CryptInfinite"
    },
    {
      "description": "AES and RSA; ",
      "value": "CryptoBit"
    },
    {
      "description": "",
      "value": "CryptoDefense"
    },
    {
      "description": "Ranscam; ",
      "value": "CryptoFinancial"
    },
    {
      "description": "AES (256), RSA (1024); .frtrss; ",
      "value": "CryptoFortress"
    },
    {
      "description": ".clf; ",
      "value": "CryptoGraphic Locker"
    },
    {
      "description": "Manamecrypt, Telograph, ROI Locker; AES(256) (RAR implementation); ",
      "value": "CryptoHost"
    },
    {
      "description": "AES-256; .crjoker; ",
      "value": "CryptoJoker"
    },
    {
      "description": ".encrypted  .ENC; ",
      "value": "CryptoLocker"
    },
    {
      "description": "[A-F0-9]{8}_luck; ",
      "value": "CryptoLuck / YafunnLocker"
    },
    {
      "description": "Zeta; .code .scl; .id_(ID_MACHINE)_email_xoomx@dr.com_.code .id_*_email_zeta@dr.com .id_(ID_MACHINE)_email_anx@dr.com_.scl; ",
      "value": "CryptoMix"
    },
    {
      "description": "AES; .crptrgr; ",
      "value": "CryptoRoger"
    },
    {
      "description": "AES; .locked; ",
      "value": "CryptoShocker"
    },
    {
      "description": ".CryptoTorLocker2015!; ",
      "value": "CryptoTorLocker2015"
    },
    {
      "description": "no filename change; ",
      "value": "CryptoWall 1"
    },
    {
      "description": "no filename change; ",
      "value": "CryptoWall 2"
    },
    {
      "description": "no filename change; ",
      "value": "CryptoWall 3"
    },
    {
      "description": "<random>.<random>, e.g., 27p9k967z.x1nep; ",
      "value": "CryptoWall 4"
    },
    {
      "description": "CryptProjectXXX; .crypt; ",
      "value": "CryptXXX"
    },
    {
      "description": "CryptProjectXXX; .crypt; ",
      "value": "CryptXXX 2.0"
    },
    {
      "description": "UltraDeCrypter UltraCrypter; .crypt .cryp1 .crypz .cryptz random; ",
      "value": "CryptXXX 3.0"
    },
    {
      "description": ".cryp1; ",
      "value": "CryptXXX 3.1"
    },
    {
      "description": "",
      "value": "CTB-Faker"
    },
    {
      "description": "Citroni; RSA(2048); .ctbl ; .([a-z]{6,7}); ",
      "value": "CTB-Locker"
    },
    {
      "description": "AES(256); ",
      "value": "CTB-Locker WEB"
    },
    {
      "description": "my-Little-Ransomware; AES(128); .已加密 .encrypted; ",
      "value": "CuteRansomware"
    },
    {
      "description": "",
      "value": "Deadly for a Good Purpose"
    },
    {
      "description": ".html; ",
      "value": "DeCrypt Protect"
    },
    {
      "description": "AES-256; .ded; ",
      "value": "DEDCryptor"
    },
    {
      "description": "Based on Detox: Calipso We are all Pokemons Nullbyte; AES; ",
      "value": "DetoxCrypto"
    },
    {
      "description": "",
      "value": "DirtyDecrypt"
    },
    {
      "description": "AES(256) in ECB mode,  Version 2-4 also RSA; ",
      "value": "DMALocker"
    },
    {
      "description": "AES(256); ",
      "value": "DMALocker 3.0"
    },
    {
      "description": "AES(256); .domino; ",
      "value": "Domino"
    },
    {
      "description": "Cryptear; AES(256); .locked; ",
      "value": "EDA2 / HiddenTear"
    },
    {
      "description": "EduCrypter; .isis .locked; ",
      "value": "EduCrypt"
    },
    {
      "description": "Los Pollos Hermanos; .ha3; ",
      "value": "El-Polocker"
    },
    {
      "description": "Trojan.Encoder.6491; ",
      "value": "Encoder.xxxx"
    },
    {
      "description": "AES (128); .enigma .1txt; ",
      "value": "Enigma"
    },
    {
      "description": ".exotic; ",
      "value": "Exotic"
    },
    {
      "description": "",
      "value": "Fairware"
    },
    {
      "description": ".locked; ",
      "value": "Fakben"
    },
    {
      "description": "Variants: Comrade Circle; AES(128); .fantom; ",
      "value": "Fantom"
    },
    {
      "description": "",
      "value": "Fonco"
    },
    {
      "description": "",
      "value": "FSociety"
    },
    {
      "description": "",
      "value": "Fury"
    },
    {
      "description": "AES (256); .Z81928819; ",
      "value": "GhostCrypt"
    },
    {
      "description": "Purge; Blowfish; .purge; ",
      "value": "Globe v1"
    },
    {
      "description": "Purge; Blowfish; .<email>.<random> e.g.: .7076.docx.okean-1955@india.com.!dsvgdfvdDVGR3SsdvfEF75sddf#xbkNY45fg6}P{cg; ",
      "value": "Globe v2"
    },
    {
      "description": "Purge; RC4; .globe or random; ",
      "value": "Globe v3"
    },
    {
      "description": "Variants, from old to latest: Zyklon Locker WildFire locker Hades Locker; AES (256); .locked; <ID>.locked, e.g., bill.!ID!8MMnF!ID!.locked; ",
      "value": "GNL Locker"
    },
    {
      "description": ".crypt; !___[EMAILADDRESS]_.crypt; ",
      "value": "Gomasom"
    },
    {
      "description": "",
      "value": "Goopic"
    },
    {
      "description": "",
      "value": "Gopher"
    },
    {
      "description": ".html; ",
      "value": "Harasom"
    },
    {
      "description": "Mamba; Custom (net shares), XTS-AES (disk); ",
      "value": "HDDCryptor"
    },
    {
      "description": ".herbst; ",
      "value": "Herbst"
    },
    {
      "description": "AES(256); .cry ; ",
      "value": "Hi Buddy!"
    },
    {
      "description": "removes extensions; ",
      "value": "Hitler"
    },
    {
      "description": "AES; (encrypted); ",
      "value": "HolyCrypt"
    },
    {
      "description": "Hungarian Locky (Hucky); AES, RSA (hardcoded); .locky; [a-zA-Z0-9+_-]{1,}.[a-z0-9]{3,4}.locky; ",
      "value": "Hucky"
    },
    {
      "description": "hydracrypt_ID_[\\w]{8}; ",
      "value": "HydraCrypt"
    },
    {
      "description": ".crime; ",
      "value": "iLock"
    },
    {
      "description": ".crime; ",
      "value": "iLockLight"
    },
    {
      "description": "<6 random characters>; ",
      "value": "International Police Association"
    },
    {
      "description": "!ENC; ",
      "value": "JagerDecryptor"
    },
    {
      "description": "Encryptor RaaS, Sarento; RC6 (files), RSA 2048 (RC6 key); ",
      "value": "Jeiphoos"
    },
    {
      "description": "CryptoHitMan (subvariant); AES(256); .btc .kkk .fun .gws .porno .payransom .payms .paymst .AFD .paybtcs .epic .xyz; ",
      "value": "Jigsaw"
    },
    {
      "description": "TripleDES; .locked .css; ",
      "value": "Job Crypter"
    },
    {
      "description": "AES; .encrypted; ",
      "value": "KeRanger"
    },
    {
      "description": "keybtc@inbox_com ; ",
      "value": "KeyBTC"
    },
    {
      "description": "",
      "value": "KEYHolder"
    },
    {
      "description": ".rip; ",
      "value": "Killer Locker"
    },
    {
      "description": "AES; .kimcilware .locked; ",
      "value": "KimcilWare"
    },
    {
      "description": "AES(256); .암호화됨; ",
      "value": "Korean"
    },
    {
      "description": ".kostya; ",
      "value": "Kostya"
    },
    {
      "description": "QC; RSA(2048); .31392E30362E32303136_[ID-KEY]_LSBJ1; .([0-9A-Z]{20})_([0-9]{2})_([A-Z0-9]{4,5}); ",
      "value": "Kozy.Jozy"
    },
    {
      "description": ".kratos; ",
      "value": "KratosCrypt"
    },
    {
      "description": "AES(256); ",
      "value": "KryptoLocker"
    },
    {
      "description": ".LeChiffre; ",
      "value": "LeChiffre"
    },
    {
      "description": "Linux.Encoder.{0,3}; ",
      "value": "Linux.Encoder"
    },
    {
      "description": "",
      "value": "Locker"
    },
    {
      "description": "AES(128); .locky .zepto .odin .shit .thor .asier .zzzzz .osiris; ([A-F0-9]{32}).locky ([A-F0-9]{32}).zepto ([A-F0-9]{32}).odin ([A-F0-9]{32}).shit ([A-F0-9]{32}).thor ([A-F0-9]{32}).aesir ([A-F0-9]{32}).zzzzz ([A-F0-9]{32}).osiris; ",
      "value": "Locky"
    },
    {
      "description": ".lock93; ",
      "value": "Lock93"
    },
    {
      "description": ".crime; ",
      "value": "Lortok"
    },
    {
      "description": "oor.; ",
      "value": "LowLevel04"
    },
    {
      "description": "",
      "value": "Mabouia"
    },
    {
      "description": "AES(256); .magic; ",
      "value": "Magic"
    },
    {
      "description": "AES(256), RSA (2048); [a-z]{4,6}; ",
      "value": "MaktubLocker"
    },
    {
      "description": "Crypt888; AES; Lock.; ",
      "value": "MIRCOP"
    },
    {
      "description": "AES(256); .fucked, .fuck; ",
      "value": "MireWare"
    },
    {
      "description": "\"Petya's little brother\"; .([a-zA-Z0-9]{4}); ",
      "value": "Mischa"
    },
    {
      "description": "Booyah; AES(256); .locked; ",
      "value": "MM Locker"
    },
    {
      "description": "Yakes CryptoBit; .KEYZ .KEYH0LES; ",
      "value": "Mobef"
    },
    {
      "description": "",
      "value": "n1n1n1"
    },
    {
      "description": "",
      "value": "Nagini"
    },
    {
      "description": "AES (256), RSA; ",
      "value": "NanoLocker"
    },
    {
      "description": "XOR(255) 7zip; .crypted; ",
      "value": "Nemucod"
    },
    {
      "description": "",
      "value": "NoobCrypt"
    },
    {
      "description": "XOR; .odcodc; C-email-abennaki@india.com-(NOMBRE_ARCHIVO.ext).odcodc; ",
      "value": "ODCODC"
    },
    {
      "description": "Vipasana, Cryakl; .cbf; email-[params].cbf; ",
      "value": "Offline ransomware"
    },
    {
      "description": "GPCode; .LOL! .OMG!; ",
      "value": "OMG! Ransomware"
    },
    {
      "description": "",
      "value": "Onyx"
    },
    {
      "description": ".EXE; ",
      "value": "Operation Global III"
    },
    {
      "description": ".padcrypt; ",
      "value": "PadCrypt"
    },
    {
      "description": "XOR; ",
      "value": "PClock"
    },
    {
      "description": "Goldeneye; Modified Salsa20; ",
      "value": "Petya"
    },
    {
      "description": "AES(256); .locked; <file_hash>.locked; ",
      "value": "Philadelphia"
    },
    {
      "description": ".id-[victim_id]-maestro@pizzacrypts.info; ",
      "value": "PizzaCrypts"
    },
    {
      "description": "AES(256); .locked; ",
      "value": "PokemonGO"
    },
    {
      "description": "AES(256); .filock; ",
      "value": "Popcorn Time"
    },
    {
      "description": "AES(256); ",
      "value": "Polyglot"
    },
    {
      "description": "PoshCoder; AES(128); .locky; ",
      "value": "PowerWare"
    },
    {
      "description": "AES, but throws key away, destroys the files; ",
      "value": "PowerWorm"
    },
    {
      "description": "",
      "value": "PRISM"
    },
    {
      "description": ".crypt; ",
      "value": "R980"
    },
    {
      "description": "RAA; .locked; ",
      "value": "RAA encryptor"
    },
    {
      "description": "AES(256); .RDM .RRK .RAD .RADAMANT; ",
      "value": "Radamant"
    },
    {
      "description": "Agent.iih  Aura  Autoit  Pletor  Rotor  Lamer  Isda Cryptokluchen Bandarchor; .locked .kraken .darkness .nochance .oshit .oplata@qq_com .relock@qq_com .crypto .helpdecrypt@ukr.net .pizda@qq_com .dyatel@qq_com _ryp .nalog@qq_com .chifrator@qq_com .gruzin@qq_com .troyancoder@qq_com .encrypted .cry .AES256 .enc .hb15; .coderksu@gmail_com_id[0-9]{2,3} .crypt@india.com.[\\w]{4,12}; ",
      "value": "Rakhni"
    },
    {
      "description": "locked-<original name>.[a-zA-Z]{4}; ",
      "value": "Rannoh"
    },
    {
      "description": "",
      "value": "Ransom32"
    },
    {
      "description": "Asymmetric 1024 ; ",
      "value": "RansomLock"
    },
    {
      "description": ".vscrypt .infected .bloc .korrektor; ",
      "value": "Rector"
    },
    {
      "description": "AES(256); .rekt; ",
      "value": "RektLocker"
    },
    {
      "description": ".remind .crashed; ",
      "value": "RemindMe"
    },
    {
      "description": "Curve25519 + ChaCha; .rokku; ",
      "value": "Rokku"
    },
    {
      "description": "samsam.exe MIKOPONI.exe RikiRafael.exe showmehowto.exe; AES(256) + RSA(2096); .encryptedAES .encryptedRSA .encedRSA .justbtcwillhelpyou .btcbtcbtc .btc-help-you .only-we_can-help_you .iwanthelpuuu .notfoundrans .encmywork; ",
      "value": "Samas-Samsam"
    },
    {
      "description": "AES(256) + RSA(2096); .sanction; ",
      "value": "Sanction"
    },
    {
      "description": "Sarah_G@ausi.com___; ",
      "value": "Satana"
    },
    {
      "description": "",
      "value": "Scraper"
    },
    {
      "description": "AES; ",
      "value": "Serpico"
    },
    {
      "description": "Atom; .locked; ",
      "value": "Shark"
    },
    {
      "description": ".shino; ",
      "value": "ShinoLocker"
    },
    {
      "description": "KinCrypt; ",
      "value": "Shujin"
    },
    {
      "description": "AES; .~; ",
      "value": "Simple_Encoder"
    },
    {
      "description": "AES(256); .locked; ",
      "value": "SkidLocker / Pompous"
    },
    {
      "description": ".encrypted; ",
      "value": "Smrss32"
    },
    {
      "description": "AES(256); .RSNSlocked .RSplited; ",
      "value": "SNSLocker"
    },
    {
      "description": ".sport; ",
      "value": "Sport"
    },
    {
      "description": "AES(256); .locked; ",
      "value": "Stampado"
    },
    {
      "description": "AES(256); .locked; ",
      "value": "Strictor"
    },
    {
      "description": "AES(256); .surprise .tzu; ",
      "value": "Surprise"
    },
    {
      "description": "",
      "value": "Survey"
    },
    {
      "description": "",
      "value": "SynoLocker"
    },
    {
      "description": ".szf; ",
      "value": "SZFLocker"
    },
    {
      "description": "Trojan-Ransom.Win32.Telecrypt PDM:Trojan.Win32.Generic; .xcri; ",
      "value": "TeleCrypt"
    },
    {
      "description": "AlphaCrypt; .vvv .ecc .exx .ezz .abc .aaa .zzz .xyz; ",
      "value": "TeslaCrypt 0.x - 2.2.0"
    },
    {
      "description": "AES(256) + ECHD + SHA1; .micro .xxx .ttt .mp3; ",
      "value": "TeslaCrypt 3.0+"
    },
    {
      "description": "AES(256) + ECHD + SHA1; ",
      "value": "TeslaCrypt 4.1A"
    },
    {
      "description": "",
      "value": "TeslaCrypt 4.2"
    },
    {
      "description": "",
      "value": "Threat Finder"
    },
    {
      "description": "Crypt0L0cker  (subvariant); AES(256) CBC for files RSA(1024) for AES key uses LibTomCrypt; .Encrypted .enc; ",
      "value": "TorrentLocker"
    },
    {
      "description": "",
      "value": "TowerWeb"
    },
    {
      "description": ".toxcrypt; ",
      "value": "Toxcrypt"
    },
    {
      "description": "Shade XTBL; AES(256); .better_call_saul .xtbl .da_vinci_code .windows10; ",
      "value": "Troldesh"
    },
    {
      "description": "AES(256); .enc; ",
      "value": "TrueCrypter"
    },
    {
      "description": "AES(256); .locked; ",
      "value": "Turkish Ransom"
    },
    {
      "description": "AES; umbrecrypt_ID_[VICTIMID]; ",
      "value": "UmbreCrypt"
    },
    {
      "description": "AES; .H3LL .0x0 .1999; ",
      "value": "Ungluk"
    },
    {
      "description": ".CRRRT .CCCRRRPPP; ",
      "value": "Unlock92"
    },
    {
      "description": "CrypVault Zlader; uses gpg.exe; .vault .xort .trun; ",
      "value": "VaultCrypt"
    },
    {
      "description": "",
      "value": "VenisRansomware"
    },
    {
      "description": "AES(256); .Venusf .Venusp; ",
      "value": "VenusLocker"
    },
    {
      "description": ".exe; ",
      "value": "Virlock"
    },
    {
      "description": "Crysis; AES(256); .CrySiS .xtbl; .id-########.decryptformoney@india.com.xtbl; ",
      "value": "Virus-Encoder"
    },
    {
      "description": ".wflx; ",
      "value": "WildFire Locker"
    },
    {
      "description": "XOR or TEA; .EnCiPhErEd .73i87A .p5tkjw .PoAr2w .fileiscryptedhard .encoderpass .zc3791; ",
      "value": "Xorist"
    },
    {
      "description": ".xrtn; ",
      "value": "XRTN "
    },
    {
      "description": "Zcryptor; .zcrypt; ",
      "value": "Zcrypt"
    },
    {
      "description": ".crypto; ",
      "value": "Zimbra"
    },
    {
      "description": "VaultCrypt CrypVault; RSA; .vault; ",
      "value": "Zlader / Russian"
    },
    {
      "description": "GNL Locker; .zyklon; ",
      "value": "Zyklon"
    },
    {
      "description": "AES; ",
      "value": "Erebus"
    }
  ],
  "source": "https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml"
}