spot/dot/ekstensi/extension encrypt by virus malware Ransomware
By: Gorentos@bitmessage.ch (Kontak: gorentos@bitmessage.ch, gorentos@firemail.cc, gorentos2@firemail.cc, varasto@firemail.cc, @datarestore (telegram))
.rezuc, .gusau, .format, .cosakos, .krusop, .locked, .coharos
By: helpshadow@india.com;
helpshadow@firemail.cc;
restoredjvu@india.com;
restoredjvu@firemail.cc;
pdfhelp@india.com;
pdfhelp@firemail.cc.
.djvu, .djvus, .djvuu, .udjvu, .uudjvu, .djvuq, .djvur, .pdff, .tro, .tfude, .tfudeq, .tfudet, .adobe, .adobee, .blower, .promorad, .promock.
Ekstensi lainnya
.mtogas .nasoh .nacro .pedro .vesrato .masodas .nuksus .gnncry .id_******_.WECANHELP .brusaf .nvetud .kovasoh .londec .nelasod .mogranos .lotej .prandel .zatrov .masok .ECh0raix .ctNfy .rsalive .exe .ntuseg .ndarod .access .wannacash .lapoi .todar .dodoc .bopador .novasof .MDRL .Hades666!Ransom .darus .tocue .haka .lilocked .lurk .id-xxxxxx .herad .gehad .vusad .godes .budak .heran .berosuce .kroput .djvut .litar .nemty .sguard .stare .cetori .nacros .prendel .cosacos .mogranos .bopador .madek .darus .nonck .vusad .lokas .cezor .besub .nusar .lotep .dalle .neras .vesad .kjh .html .goresan .boston .heroset .bat .muslat .davda .lancet .redmat .stone .rezuc .skymap .rectot .radman .ferosas .dotmap .bufas .fordan .sarut .forasom .berost .roldat .dutan .moresa .verasto .etols .gropas .refols .roland .grovat .trosak .grovas .tronas .kropun .klope .charck .pulsar1 .promorad2 .promorad .promoz .cosanostra .blower .tro .PHOBOS .INFOWAIT .pumax .puma .bkp .monro .brrr .KEYPASS lock.onion .combo .bomber .donut .CryBrazil .REBUS .infovip@airmail.cc .pain .HOUSE .zenis .CRAB .id.ransomed@india(.)com .losers .ykcol .locky .armadilo1 .arena .cesar .lukitus .cezar .diablo6 .srpx .mole .MOLE03 .matroska .oops .REYPTSON .scorpio .OXR .ranrans .bubble .via .BeethoveN .lock .imsorry .666 .wlu .maysomware .wncry .vCrypt1 .ATLAS .ransom .salsa222 .stn .one .fucked .crypted .angleware .LLTP .zino .Nhtnwcuf .evillock .merry .grapn206@india.com .zzzzz .GSupport3 .kyra .Alcatraz .Crypt888 .CryPy .bart2 .fantom .id__email_enc10@dr.com_.rmd .carote .sguard .stare .hese .gero .makkonahi .Good .geno .kkk, .btc, .gws, .J, .encrypted, .porno, .payransom, .pornoransom, .epic, .xyz, .versiegelt, .encrypted, .payb, .pays, .payms, .paymds, .paymts, .paymst, .payrms, .payrmts, .paymrts, .paybtcs, .fun, .hush, .uk-dealer@sigaint.org, or .gefickt, .MyChemicalRomance4EVER, .szf, .locked, .34xxx, .bloccato, .BUGSECCCC, .Hollycrypt, .lock, .saeid, .unlockit, .razy, .mecpt, .monstro, .lok, .암호화됨, .8lock8, .fucked, .flyper, .kratos, .krypted, .CAZZO, .doomed, .ACRYPT, .GSupport[0-9], .blackblock, .dll555, .duhust, .exploit, .frozen, .globe, .gsupport, .kyra, .purged, .raid[0-9], .siri-down@india.com, .xtbl, .zendrz, .zendr[0-9], .hnyear, .hilda!, .shariz, .frendi, .STUB, .[buy-decryptor@pm.me], .enc, .bear, .vanss, .btc, .monro, .pay2me, RedEye, .blackrouter, .ZABLOKOWANE, .mtk118, .Apollon865, .peta, .moka, .meds, .ebola, .money, .MGS, .lfv77az, .alanwalkergod@protonmail.com, .erenahen, .karl, .domn, .lonleyencryptedfile, .DECP, .nesa, .KRONOS .Lazarus+, .kuub, .badday, .noos, .D00mEd, .RYK, ._NEMTY, .bora, .clean, .leto, .bot, .werd, .nols, .odveta, .coot, .derp, .mkos, .nbes, .piny, .redl
.wiki bitlocker@foxmail.com
.mailto[kokoklock@cock.li].1be018 note;1BE018-Readme.txt
email contact kokoklock@cock.li, pabpabtab@tuta.io
.[notopen@countermail.com].NOT_OPEN” extension for encrypted files and “!HOW_RECOVERY_FILES!.txt”
Extension: .lbiaf6c8 or
Note in Russian: КАК РАСШИФРОВАТЬ ФАЙЛЫ.TXT
Email: mailnitrom@protonmail.ch (mailnitrom@airmail.cc, mailnitrom@tutanota.com)
.oo7 b1tc01n@aol.com
worldofdonkeys@
horsesecret@ beautymdonkey@ spot .borishorse, .horseliker
“.USA” and “.xwx”, extortion email addresses “usacode@aol.com” and “data@decoding.biz”.
‘.best’ – ‘bestdecoding@cock.li’
‘.ETH’ – helpfilerestore@india.com
‘.qwex’ – ‘backdata@qq.com’
‘.air’ – ‘satco@tutanota.com’
‘.888’ – donald888@mail.fr
‘.amber’ and ‘.frend’ – ‘korvin0amber@cock.li’ and ‘undogdianact1986@aol.com’
‘.KARLS’ – ‘karlosdecrypt@outlook.com’
‘.aqva’ – ‘crypted_files@qq.com’
‘.AYE’ – ‘sebekgrime@tutanota.com’
‘.korea’ – ‘omfg@420blaze.it’
‘.NWA’ – ‘dr.crypt@aol.com’
‘.com’ – ‘trupm@protonmail.com’
‘.azero’ – ‘cryptor55@cock.li’
another ‘.com’ variant with contact email address ‘ht2707@email.vccs.edu’
‘.bk666’ – ‘berserk666@tutanota.com’
‘.ms13’ – ‘ms_13@aol.com’
‘.carcn’ – ‘carcinoma24@aol.com’
‘.btix’ – ‘encrypt11@cock.li’
‘.LOVE’ – ‘seeyoubro@tutanota.com’
‘.video’ – ‘tetty86@cock.li’
‘.MERS’ – ‘crypt1style@aol.com’
‘.bat’ – ‘idecryptyourdata@cock.li’ and ‘decryptyourdata@qq.com’
‘.qbix’ – ‘backdata@qq.com’
more and more variants coming – ‘.aa1’ – ‘who8@mail.fr’ – and ‘.wal’ – ‘decryptdocs@protonmail.com’
‘.qbtex’ – ‘1btc@decryption.biz’
‘.yG’ – ‘sysadmin@mail.fr’
‘.drweb’ – ‘dr.web24@aol.com’
‘.jack’ – ‘lockhelp@qq.com’ – and ‘.PLUT’ – ‘adolfhackler@tutanota.com’
‘.DDOS’ – ‘decripted@cock.li’
‘.cry’ – ‘decryptoperator@qq.com’
‘.4k’ – ‘rocosmon@cock.li’
‘.TOR13’ – ‘chanelcrypt@aol.com’
‘.good’ – ‘onecrypt@aol.com’
‘.beets’ – ‘vombombom@cock.li’
‘.BSC’ – ‘basecrypt@aol.com’
‘.zoh’ – ‘restdoc@protonmail.com’
‘.kjh’ – ‘datareturn@protonmail.com’
‘.html’ – ‘paydra@cock.li’
‘.harma’ – ‘ban.out@foxmail.com’
‘.HACK’ – ‘mr.hacker@tutanota.com’
‘.xxxx’ – ‘decryptxxx@protonmail.com’
‘.php’ + ‘.dqb’ – ‘back_me@foxmail.com’ + ‘btcdecoding@qq.com’
‘.1BTC’ – ‘btcdecoding@foxmail.com’
‘.com2’ – ‘DonovanTudor@aol.com’
‘.Acuf2’ – ‘panama777@tutanota’
‘.nqix’ – ‘support@qbmail.biz’
‘.Q1G’ – ‘getbtc@aol.com’
‘.cmd’ – ‘jsmith1974@mail.fr’
ID Ransomware
010001, 0kilobypt, 24H Ransomware, 4rw5w, 777, 7ev3n, 7h9r, 7zipper, 8lock8, AAC, ABCLocker, ACCDFISA v2.0, AdamLocker, AES_KEY_GEN_ASSIST, AES-Matrix, AES-NI, AES256-06, Al-Namrood, Al-Namrood 2.0, Alcatraz, Alfa, Allcry, Alma Locker, Alpha, AMBA, Amnesia, Amnesia2, Anatova, AnDROid, AngryDuck, Annabelle 2.1, Anubi, Anubis, AnubisCrypt, Apocalypse, Apocalypse (New Variant), ApocalypseVM, ApolloLocker, AresCrypt, Argus, Armage, ArmaLocky, Arsium, ASN1 Encoder, Ataware, Atchbo, Aurora, AutoLocky, AutoWannaCryV2, AVCrypt, AxCrypter, aZaZeL, B2DR, BadBlock, BadEncript, BadRabbit, Bam!, BananaCrypt, BandarChor, Bart, Bart v2.0, Basilisque Locker, BigBobRoss, Bisquilla, BitCrypt, BitCrypt 2.0, BitCryptor, BitKangoroo, Bitpaymer, Bitshifter, BitStak, BKRansomware, Black Feather, Black Shades, BlackHeart, Blackout, BlackRuby, Blind, Blind 2, Blocatto, BlockFile12, Blooper, Blue Blackmail, BoooamCrypt, Booyah, BrainCrypt, Brazilian Ransomware, BrickR, BTCamant, BTCWare, BTCWare Aleta, BTCWare Gryphon, BTCWare Master, BTCWare PayDay, Bubble, Bucbi, Bud, BugWare, BuyUnlockCode, Cancer, Cassetto, Cerber, Cerber 2.0, Cerber 3.0, Cerber 4.0 / 5.0, CerberTear, ChaCha, Chekyshka, Chimera, ChinaYunLong, ChineseRarypt, CHIP, ClicoCrypter, Clop, Clouded, CmdRansomware, CockBlocker, Coin Locker, CoinVault, Comrade Circle, Conficker, CorruptCrypt, Cossy, Coverton, Cr1ptT0r Ransomware, CradleCore, CreamPie, Creeper, Cripton, Cry128, Cry36, Cry9, Cryakl, CryFile, CryLocker, CrypMic, CrypMic, Crypren, Crypt0, Crypt0L0cker, Crypt0r, Crypt12, Crypt38, CryptConsole, CryptConsole3, CryptFuck, CryptGh0st, CryptInfinite, CryptoDefense, CryptoDevil, CryptoFinancial, CryptoFortress, CryptoGod, CryptoHasYou, CryptoHitman, CryptoJacky, CryptoJoker, CryptoLocker3, CryptoLockerEU, CryptoLuck, CryptoMix, CryptoMix Revenge, CryptoMix Wallet, Crypton, CryptON, CryptoPokemon, CryptorBit, CryptoRoger, CryptoShield, CryptoShocker, CryptoTorLocker, CryptoViki, CryptoWall 2.0, CryptoWall 3.0, CryptoWall 4.0, CryptoWire, CryptXXX, CryptXXX 2.0, CryptXXX 3.0, CryptXXX 4.0, CryPy, CrySiS, Crystal, CSP Ransomware, CTB-Faker, CTB-Locker, Dablio, Damage, DarkoderCryptor, DataKeeper, Dcrtr, DCry, DCry 2.0, Deadly, DeathNote, DecryptIomega, DEDCryptor, Defender, Defray, Defray777, DeriaLock, Dharma (.cezar Family), Dharma (.dharma Family), Dharma (.onion Family), Dharma (.wallet Family), Digisom, DilmaLocker, DirtyDecrypt, District, DMA Locker, DMA Locker 3.0, DMA Locker 4.0, DMALocker Imposter, DoggeWiper, Domino, Done, DoNotChange, Donut, DoubleLocker, DriedSister, DryCry, Dviide, DXXD, DynA-Crypt, eBayWall, eCh0raix / QNAPCrypt, ECLR Ransomware, EdgeLocker, EduCrypt, EggLocker, El Polocker, Enc1, EnCrypt, EncryptedBatch, EncrypTile, EncryptoJJS, Encryptor RaaS, Enigma, Enjey Crypter, EnkripsiPC, EOEO, Erebus, Eris, Eternal, Everbe, Everbe 2.0, Evil, Executioner, ExecutionerPlus, Exocrypt XTC, Exotic, Extortion Scam, Extractor, Fabiansomware, Fadesoft, Fantom, FartPlz, FCPRansomware, FCrypt, FenixLocker, FenixLocker 2.0, Fenrir, FilesLocker, FindZip, FireCrypt, Flatcher3, FLKR, Flyper, FreeMe, FrozrLock, FRSRansomware, FS0ciety, FuckSociety, FunFact, GandCrab, GandCrab v4.0 / v5.0, GandCrab2, GarrantyDecrypt, GC47, Gerber, GermanWiper, GetCrypt, GhostCrypt, GhostHammer, Gibon, Globe, Globe (Broken), Globe3, GlobeImposter, GlobeImposter 2.0, Godra, GOG, Golden Axe, GoldenEye, Gomasom, Good, Gorgon, Gotcha, GPAA, GPCode, GPGQwerty, GusCrypter, GX40, HadesLocker, Halloware, HappyDayzz, hc6, hc7, HDDCryptor, Heimdall, HellsRansomware, Help50, HelpDCFile, Herbst, Hermes, Hermes 2.0, Hermes 2.1, Heropoint, Hi Buddy!, HiddenTear, HKCrypt, HollyCrypt, HolyCrypt, HPE iLO Ransomware, Hucky, HydraCrypt, IEncrypt, IFN643, Ims00ry, ImSorry, Incanto, InducVirus, InfiniteTear, InfinityLock, InsaneCrypt, iRansom, Iron, Ishtar, Israbye, JabaCrypter, Jack.Pot, Jaff, Jager, Jamper / Buran, JapanLocker, JeepersCrypt, Jemd, Jigsaw, JNEC.a, JobCrypter, JoeGo Ransomware, JosepCrypt, JSWorm, JSWorm 2.0, JSWorm 4.0, JuicyLemon, JungleSec, Kaenlupuf, Kali, Karma, Karmen, Karo, Kasiski, Katyusha, KawaiiLocker, KCW, Kee Ransomware, KeRanger, Kerkoporta, KeyBTC, KEYHolder, KillerLocker, KillRabbit, KimcilWare, Kirk, Kolobo, Kostya, Kozy.Jozy, Kraken, Kraken Cryptor, KratosCrypt, Krider, Kriptovor, KryptoLocker, L33TAF Locker, Ladon, Lalabitch, LambdaLocker, LeChiffre, LightningCrypt, Lilocked, Lime, Litra, LittleFinger, LLTP, LMAOxUS, Lock2017, Lock93, LockBox, LockCrypt, LockCrypt 2.0, Locked-In, LockedByte, LockeR, LockerGoga, LockLock, LockMe, Lockout, Locky, LongTermMemoryLoss, LooCipher, Lortok, LoveServer, LowLevel04, Lucky, MadBit, MAFIA, MafiaWare, Magic, Magniber, Major, Maktub Locker, MalwareTech’s CTF, Maoloa, Marduk, Marlboro, MarsJoke, Matrix, MauriGo, MaxiCrypt, Maykolin, Maysomware, MCrypt2018, MegaCortex, MegaLocker, Meteoritan, Mikoyan, MindSystem, Minotaur, MirCop, MireWare, Mischa, MMM, MNS CryptoLocker, Mobef, MongoLock, MoonCrypter, MorrisBatchCrypt, MOTD, MoWare, MRCR1, MrDec, Mystic, n1n1n1, NanoLocker, NCrypt, NegozI, Nemty, Nemucod, Nemucod-7z, Nemucod-AES, NETCrypton, Netix, NewHT, Nhtnwcuf, NM4, NMoreira, NMoreira 2.0, Noblis, NonRansomware, NotAHero, Nozelesn, NSB Ransomware, Nuke, NullByte, NxRansomware, ODCODC, OhNo!, OoPS, OopsLocker, OpenToYou, OpJerusalem, Ordinypt, OzozaLocker, PadCrypt, Paradise, Paradise B29, PayPalGenerator2019, PaySafeGen, PClock, PClock (Updated), PEC 2017, Pendor, Petna, PewCrypt, PGPSnippet, Philadelphia, Phobos, Pickles, Plague17, Planetary Ransomware, PoisonFang, PopCornTime, Potato, PowerLocky, PowerShell Locker, PowerWare, Pr0tector, Predator, PrincessLocker, PrincessLocker 2.0, PrincessLocker Evolution, Project34, Project57, Protected Ransomware, PshCrypt, PUBG Ransomware, PyCL, PyCL, PyL33T, PyLocky, qkG, QP Ransomware, QuakeWay, QwertyCrypt, Qweuirtksd, R980, RAA-SEP, RabbitFox, RackCrypt, Radamant, Radamant v2.1, Radiation, Random6, RandomLocker, Ranion, RanRan, RanRans, Rans0mLocked, RansomCuck, Ransomnix, RansomPlus, Ransomwared, RansomWarrior, Rapid, Rapid 2.0 / 3.0, RaRansomware, RarVault, Razy, RedBoot, RedEye, REKTLocker, Rektware, Relock, RemindMe, RenLocker, RensenWare, RetMyData, REvil / Sodinokibi, Reyptson, RobbinHood, Roga, Rokku, Rontok, RoshaLock, RotorCrypt, Roza, RSA-NI, RSA2048Pro, RSAUtil, Ruby, Russenger, Russian EDA2, Ryuk, SAD, SadComputer, SADStory, Sage 2.0, Salsa, SamSam, Sanction, Sanctions, Satan, Satana, Saturn, Scarab, SD 1.1, Seon, Sepsis, SerbRansom, Serpent, ShellLocker, Shifr, Shigo, ShinigamiLocker, ShinoLocker, ShivaGood, ShkolotaCrypt, Shrug, Shujin, Shutdown57, Sifreli, Sigma, Sigrun, SilentSpring, Simple_Encoder, SintaLocker, Skull Ransomware, SkyFile, SkyStars, Smrss32, SnakeLocker, Snatch, SNSLocker, SoFucked, Solo Ransomware, Spartacus, Spectre, Spider, Spora, Sport, SQ_, Stampado, Stinger, STOP (Djvu), STOP / KEYPASS, StorageCrypter, Storm, Striked, Stroman, Stupid Ransomware, Styx, SuperB, SuperCrypt, Surprise, SynAck, SyncCrypt, Syrk, SYSDOWN, SystemCrypter, SZFLocker, T1Happy, Team XRat, Telecrypt, TellYouThePass, Termite, TeslaCrypt 0.x, TeslaCrypt 2.x, TeslaCrypt 3.0, TeslaCrypt 4.0, TeslaWare, TFlower, Thanatos, TheDarkEncryptor, THT Ransomware, tk, Torchwood, TotalWipeOut, TowerWeb, ToxCrypt, Trojan.Encoder.6491, Troldesh / Shade, Tron, TrueCrypter, TrumpLocker, UCCU, UIWIX, Ukash, UmbreCrypt, UnblockUPC, Ungluk, Unit09, Unknown Crypted, Unknown Lock, Unknown XTBL, Unlock26, Unlock92, Unlock92 2.0, Unlock92 Zipper, Useless Disk, UselessFiles, UserFilesLocker, USR0, Uyari, V8Locker, Vapor v1, VaultCrypt, vCrypt, VegaLocker, Velso, Vendetta, VenisRansomware, VenusLocker, ViACrypt, VindowsLocker, VisionCrypt, VMola, Vortex, Vurten, VxLock, Waffle, WannaCash, WannaCry, WannaCry.NET, WannaCryOnClick, WannaDie, WannaPeace, WannaSmile, WannaSpam, Wesker, WhatAFuck, WhiteRose, WildFire Locker, WininiCrypt, Winnix Cryptor, WinRarer, WonderCrypter, Wooly, Wulfric, X Locker 5.0, XCry, XCrypt, XData, XiaoBa, XiaoBa 2.0, Xorist, Xort, XRTN, XTP Locker 5.0, XYZWare, Yatron, YouAreFucked, YourRansom, Yyto, ZariqaCrypt, zCrypt, Zekwacrypt, Zenis, ZeroCrypt, ZeroFucks, Zeropadypt, Zeropadypt NextGen, ZeroRansom, Zilla, ZimbraCryptor, ZinoCrypt, ZipLocker, Zipper, Zoldon, ZQ, Zyklon, RSA
