Search Results

  • airacropencrypted!

    Technical Breakdown: 1. File Extension & Renaming Patterns Confirmation of File Extension: The ransomware appends .airacropencrypted! to every encrypted file (case-sensitive, including the exclamation mark). Renaming Convention: Original: Document.docx After attack: Document.docx.airacropencrypted! No base-name obfuscation—it simply tacks the extension on the end, making it easy to spot but not to reverse by filename editing. 2.…

  • air

    Comprehensive Community Resource: ‘Air’ Ransomware (.air Extension) Technical Breakdown 1. File Extension & Renaming Patterns Confirmation of File Extension: Every encrypted file receives a second or sometimes third layer—.air. Renaming Convention: • Single-round infection – the original file path becomes original_filename.ext.air • Double-round re-infection (observed starting July-2023) – original_filename.ext.air.air • Volume-level marker – inside every…

  • aim

    Technical Resource: AIm (Adobe Illustrator Meta ransomware) Technical Breakdown: 1. File Extension & Renaming Patterns Confirmation of File Extension: AIm appends .aim to each encrypted file. A typical file Report_Q3.xlsx becomes Report_Q3.xlsx.aim. Renaming Convention: – Preserves the original file (and directory) names exactly. – Files retain preceding extension—I.E. *.xlsx, *.ps1, *.pdf etc.—then the new suffix.…

  • ahyoz1ra

    Threat Brief: ahyoz1ra Ransomware (also tracked internally as “AhYoZ1RA”, “AhyoZ1Ra”, and by the gang branding “Тень-Шифр / Shadow-Cipher”) Technical Breakdown 1. File Extension & Renaming Patterns Exact file extension: .ahyoz1ra (all lowercase, 8 characters, appended exactly once) Renaming convention: Original file is overwritten – it is NOT left behind. New name becomes: <original_fullname>.<original_ext>.ahyoz1ra No base-64…

  • ahui

    ──────────────────────── RANSOMWARE DOSSIER – “AHUI” ──────────────────────── ## Technical Breakdown: ### 1. File Extension & Renaming Patterns * **Confirmation of File Extension:** `.ahui` – appended *after* the original file extension (e.g., `Report_2024.xlsx` turns into `Report_2024.xlsx.ahui`). * **Renaming convention used by the malware:** The original file name and extension remain fully intact immediately before `.ahui`; no prefix…

  • ahtw

    Technical Breakdown: 1. File Extension & Renaming Patterns Confirmation of File Extension: Files encrypted by the AHTW ransomware end with .ahtw exactly. Renaming Convention: After encryption, each affected file is appended with a single suffix: .<original_file_name>.[<victim_id>].ahtw. Example: Report.docx becomes Report.docx.[C7C8F7B8].ahtw. 2. Detection & Outbreak Timeline Approximate Start Date/Period: The first large-scale campaigns of AHTW were…

  • ahp

    Ransomware AHP – Community Resource Guide Technical Breakdown: 1. File Extension & Renaming Patterns Confirmation of File Extension: The ransomware consistently appends the .ahp suffix to every encrypted file. Renaming Convention: Files are first overwritten then renamed in the pattern: <original-file-name>.<original-extension>.ahp Example: Report_Q1.xlsx becomes Report_Q1.xlsx.ahp 2. Detection & Outbreak Timeline Approximate Start Date/Period: Independent security…

  • ahgr

    Ransomware Research Brief – Extension “.ahgr” Technical Breakdown 1. File Extension & Renaming Patterns • Exact Extension Used: “.ahgr” (always lower-case). • Renaming Pattern: → Original filename → <file-name.random-ID>.ahgr → The 8-byte random ID (hex) is freshly generated per file, e.g. contract.docx.3F7B2C9A.ahgr. → Complete folder traversal, recursive through all reachable drives and mapped shares. 2.…

  • ahegao

    Technical Breakdown 1. File Extension & Renaming Patterns Confirmation of File Extension: .ahegao (The string is lowercase and is appended verbatim after the original file extension, e.g., Photo2024.jpg → Photo2024.jpg.ahegao) Renaming Convention: • Files keep their original name and first extension unchanged; .ahegao is simply tacked on at the end. • No “original-file-ID-email.wallet” style pattern; the…

  • agvv

    Technical Breakdown 1. File Extension & Renaming Patterns Confirmation of File Extension: Each encrypted file receives the new suffix ​.agvv (lower-case).  Example: “ProjectQ4.xlsx” becomes “ProjectQ4.xlsx.agvv”. Renaming Convention: The ransomware keeps the original file name and one primary extension intact, then appends the four-character annex. Momentarily before encryption, a 16-byte alphanumeric ID (victim UID) is injected…