Search Results

  • comrade circle

    Comrad Circle Ransomware Advisory Version 1.0 – 30 June 2024 Technical Breakdown 1. File Extension & Renaming Patterns • Confirmation of File Extension: ­ All encrypted files are appended with the extension “.comrade” in lower-case. • Renaming Convention: ­ Original filename → <original>.comrade (no obfuscation) ­ A ransom note—identical to every encrypted directory—is saved as…

  • comrade

    Comrade Ransomware Research Briefing Technical Breakdown 1. File Extension & Renaming Patterns Confirmation of Extension: The malware consistently appends .comrade (lower-case, preceded by a single space) to the basename of every encrypted file. Renaming Convention: Original filename is preserved: Annual_Budget_Q1.xlsx remains readable. A single space, hard-coded delimiter, plus the new extension is appended: Annual_Budget_Q1.xlsx .comrade…

  • complete

    Technical Breakdown 1. File Extension & Renaming Patterns Confirmation of File Extension: .complete – the extension is appended after the original file extension (e.g., Document.xlsx.complete). Renaming Convention: Original filename is preserved. Hard-coded string .complete is appended unconditionally; no additional hex or UID tokens are used. If a .complete file already exists, the variant overwrites it…

  • commonransom

    CommonRansom Technical & Recovery Resource (compiled for mirrored ext “.commonransom”) ================================================================= ## Technical Breakdown 1. File Extension & Renaming Patterns Confirmation of File Extension: *.commonransom Renaming Convention: The malware prepends a distinct 13-character pseudocode before the original filename followed by a hyphen and then appends the extension. Example: vWg39EhZ1Sh4K-document.docx → vWg39EhZ1Sh4K-document.docx.commonransom – The 13-character prefix…

  • combo13

    Technical Breakdown: 1. File Extension & Renaming Patterns Confirmation of File Extension: Files affected by Combo13 are appended with .combo13 (e.g., Report_Q3.docx → Report_Q3.docx.combo13) Renaming Convention: – Original filename is completely preserved, the extension is simply tacked on after the existing extension, giving a double-extension illusion. – If multiple extensions already exist (e.g., data.tar.gz), Combo13…

  • combo

    Ransomware Guide: “Combo” (*.combo) A community reference by Kimi – last updated 02 Jun 2024 Technical Breakdown 1. File Extension & Renaming Patterns Confirmation of File Extension: .combo (all lower-case, no digits appended). Renaming Convention: The ransomware prepends the original name with a victim-ID string and appends .combo. Example given a file report.xlsx, it becomes…

  • com2

    Technical & Recovery Resource | Ransomware using the .com2 extension Technical Breakdown 1. File Extension & Renaming Patterns Confirmation of File Extension: .com2 (always in lower-case, no preceding dot when appended). Renaming Convention: Original: 2024_Budget.xlsx Encrypted: 2024_Budget.xlsx.com2 The ransomware keeps the full original path and just tacks .com2 to the very end. The internal file…

  • colorit

    Ransomware Deep-Dive Variant: COLORIT Technical Breakdown: 1. File Extension & Renaming Patterns Confirmation of File Extension: .colorit (lower-case, appended after the original extension). Renaming Convention: Original name → <full_original_filename>.<original_extension>.colorit Example: Quarterly_Reports_Q1_2024.xlsx becomes Quarterly_Reports_Q1_2024.xlsx.colorit 2. Detection & Outbreak Timeline Approximate Start Period: Earliest public telemetry: 18 March 2023. Escalation window: Large e-mail phishing waves observed 20–25…

  • colony96

    Ransomware Resource Sheet: colony96 ⚠️ Active-as-of-2024 strain – treat every interaction as potentially infectious. Technical Breakdown 1. File Extension & Renaming Patterns Confirmed extension: .colony96 (lowercase, appended immediately after the original file name). Renaming convention: <original-name>.<original-extension>.colony96 The malware preserves directory–tree hierarchy under each renamed path; directories themselves are not renamed. 2. Detection & Outbreak Timeline…

  • colony*

    Technical Breakdown: 1. File Extension & Renaming Patterns Confirmation of File Extension: This strain appends .colony96, **.colony***, or similar, where * is an incrementing number (e.g., .colony96, .colony97). Renaming Convention: Original file ➜ Photo.jpg.colony96 Directories that contain at least one encrypted file have an additional note dropped: README.recover-instructions.txt. 2. Detection & Outbreak Timeline Approximate Start…