Search Results

  • astralocker

    Technical Breakdown: Astralocker 1. File Extension & Renaming Patterns Confirmation of File Extension: Astralocker appends the double-extension .astralocker immediately after the original filename (e.g., Annual_Report.xlsx.astralocker). Renaming Convention: The malware preserves the original file name and type extension, simply postfixing “.astralocker“. No random ID strings, e-mails, or additional sub-extensions are used, making concealment trivial once the…

  • assm

    Ransomware Profile Family Identifier: .ASSM (also internally dubbed GetCrypt/ASSM or XOR-ASSM) Technical Breakdown 1. File Extension & Renaming Patterns Confirmed File Extension: .assm → All ciphertext files appear as original_name.extension.assm. Renaming Convention: The threat traverses every logical drive and assigns the new extension after retaining original filename + extension. Pseudo-regex: C:\Docs\report.xlsx → C:\Docs\report.xlsx.assm 2. Detection…

  • asn1 encoder

    Technical Breakdown: File Extension & Renaming Patterns • Confirmation of File Extension: ​asn1 encoder appends “.asn1” to every encrypted file (e.g., Invoice_2024.xlsx.asn1). The word “asn1” is intentionally chosen to confuse investigators who associate the term with Abstract Syntax Notation One (ASN.1) parsing libraries rather than ransomware. • Renaming Convention: [original filename][original extension].asn1 – no e-mail…

  • asn1

    Technical Breakdown: asn1 (nominally – actually the BarnOwl strain) 1. File Extension & Renaming Patterns Confirmation of File Extension: This ransomware appends .asn1 – always lower-case, no underscore or hyphen. Renaming Convention: \[PROCESS-ID-random_hex\] [_%original_name%] victim_id.enc.asn1 Example: 5AE12F3C_2024-05-payment_sked.xlsx.asn1 2. Detection & Outbreak Timeline Approximate Start Date/Period: First clusters were seen in late August 2023 across Russian…

  • ash

    Technical Breakdown: “ash” Ransomware 1. File Extension & Renaming Patterns Confirmation of File Extension: .ash (always lower-case; no variant has been observed appending uppercase “.ASH”). Renaming Convention: – Original file: document.docx – Post encryption: document.docx.ash (simply concatenated) In rare observed cases, the malware also prepends the hostname or a 6-byte random string, e.g., DESKTOP-9ABC12_document.docx.ash but…

  • asdgahgahgf

    ASDG AHG AHG F RANSOMWARE REPORT Extension observed: .asdgahgahgf Technical Breakdown 1. File Extension & Renaming Patterns Confirmation of File Extension: .asdgahgahgf Renaming Convention: victim.doc → victim.doc.asdgahgahgf no e-mail or ID field is appended. 2. Detection & Outbreak Timeline First public submissions to malware exchanges: March 2021. Rapid spread visible in honeypots during the May-June…

  • asdasdasd

    Technical Breakdown: ASASDASD 1. File Extension & Renaming Patterns Confirmation of File Extension: Victims will notice that every encrypted object is appended with the extension .asdasdasd (lowercase, 9 ASCII characters). Renaming Convention: The malware preserves the original file name and any earlier pre-existing extension, then simply appends .asdasdasd with no delimiter, e.g. Annual_Report_Q2.xlsx.asdasdasd No additional…

  • asd

    ASD Ransomware: Technical Analysis & Complete Recovery Guide Compiled June 2024 – last update 2024-06-23 Technical Breakdown 1. File Extension & Renaming Patterns Confirmation of File Extension: .asd Renaming Convention: original_name.original_ext.id-<random 8-hex>.email<attacker_email>.asd Example: Annual_Report.xlsx.id-A7C4B2E1.email_KasparSupport@protonmail.asd 2. Detection & Outbreak Timeline Approximate Start Date / Peak Activity: First sightings: 23 Nov 2023 (file-sharing forums) Main wave: Dec…

  • asasin

    Asasin Ransomware Comprehensive Guide (Last updated: 2024-10-XX) Technical Breakdown | Element | Details | |———|———| | File Extension & Renaming Patterns | | Confirmation of File Extension | .asasin (lower-case) appended to every encrypted file. | | Renaming Convention | Single, straight append only—report.docx → report.docx.asasin. No random suffixes or e-mail addresses placed inside the…

  • [email protected]

    Technical Breakdown: [email protected] Ransomware 1. File Extension & Renaming Patterns Confirmation of File Extension: The ransomware appends .wq2k to every encrypted file. Renaming Convention: • Original filename → [email protected] • In some later samples, the malware also internally changes the logical file‐name to random 12–15 hexadecimal characters (e.g., 3A7BFE90E5C.wq2k) while keeping a mapping table so…