spot/dot/ekstensi/extension encrypt by virus malware Ransomware
By: Gorentos@bitmessage.ch (Kontak: gorentos@bitmessage.ch, gorentos@firemail.cc, gorentos2@firemail.cc, varasto@firemail.cc, @datarestore (telegram))
.rezuc, .gusau, .format, .cosakos, .krusop, .locked, .coharos
By: helpshadow@india.com;
helpshadow@firemail.cc;
restoredjvu@india.com;
restoredjvu@firemail.cc;
pdfhelp@india.com;
pdfhelp@firemail.cc.
.djvu, .djvus, .djvuu, .udjvu, .uudjvu, .djvuq, .djvur, .pdff, .tro, .tfude, .tfudeq, .tfudet, .adobe, .adobee, .blower, .promorad, .promock.
Ekstensi lainnya
.mtogas .nasoh .nacro .pedro .vesrato .masodas .nuksus .gnncry .id_******_.WECANHELP .brusaf .nvetud .kovasoh .londec .nelasod .mogranos .lotej .prandel .zatrov .masok .ECh0raix .ctNfy .rsalive .exe .ntuseg .ndarod .access .wannacash .lapoi .todar .dodoc .bopador .novasof .MDRL .Hades666!Ransom .darus .tocue .haka .lilocked .lurk .id-xxxxxx .herad .gehad .vusad .godes .budak .heran .berosuce .kroput .djvut .litar .nemty .sguard .stare .cetori .nacros .prendel .cosacos .mogranos .bopador .madek .darus .nonck .vusad .lokas .cezor .besub .nusar .lotep .dalle .neras .vesad .kjh .html .goresan .boston .heroset .bat .muslat .davda .lancet .redmat .stone .rezuc .skymap .rectot .radman .ferosas .dotmap .bufas .fordan .sarut .forasom .berost .roldat .dutan .moresa .verasto .etols .gropas .refols .roland .grovat .trosak .grovas .tronas .kropun .klope .charck .pulsar1 .promorad2 .promorad .promoz .cosanostra .blower .tro .PHOBOS .INFOWAIT .pumax .puma .bkp .monro .brrr .KEYPASS lock.onion .combo .bomber .donut .CryBrazil .REBUS .infovip@airmail.cc .pain .HOUSE .zenis .CRAB .id.ransomed@india(.)com .losers .ykcol .locky .armadilo1 .arena .cesar .lukitus .cezar .diablo6 .srpx .mole .MOLE03 .matroska .oops .REYPTSON .scorpio .OXR .ranrans .bubble .via .BeethoveN .lock .imsorry .666 .wlu .maysomware .wncry .vCrypt1 .ATLAS .ransom .salsa222 .stn .one .fucked .crypted .angleware .LLTP .zino .Nhtnwcuf .evillock .merry .grapn206@india.com .zzzzz .GSupport3 .kyra .Alcatraz .Crypt888 .CryPy .bart2 .fantom .id__email_enc10@dr.com_.rmd .carote .sguard .stare .hese .gero .makkonahi .Good .geno .kkk, .btc, .gws, .J, .encrypted, .porno, .payransom, .pornoransom, .epic, .xyz, .versiegelt, .encrypted, .payb, .pays, .payms, .paymds, .paymts, .paymst, .payrms, .payrmts, .paymrts, .paybtcs, .fun, .hush, .uk-dealer@sigaint.org, or .gefickt, .MyChemicalRomance4EVER, .szf, .locked, .34xxx, .bloccato, .BUGSECCCC, .Hollycrypt, .lock, .saeid, .unlockit, .razy, .mecpt, .monstro, .lok, .암호화됨, .8lock8, .fucked, .flyper, .kratos, .krypted, .CAZZO, .doomed, .ACRYPT, .GSupport[0-9], .blackblock, .dll555, .duhust, .exploit, .frozen, .globe, .gsupport, .kyra, .purged, .raid[0-9], .siri-down@india.com, .xtbl, .zendrz, .zendr[0-9], .hnyear, .hilda!, .shariz, .frendi, .STUB, .[buy-decryptor@pm.me], .enc, .bear, .vanss, .btc, .monro, .pay2me, RedEye, .blackrouter, .ZABLOKOWANE, .mtk118, .Apollon865, .peta, .moka, .meds, .ebola, .money, .MGS, .lfv77az, .alanwalkergod@protonmail.com, .erenahen, .karl, .domn, .lonleyencryptedfile, .DECP, .nesa, .KRONOS .Lazarus+, .kuub, .badday, .noos, .D00mEd, .RYK, ._NEMTY, .bora, .clean, .leto, .bot, .werd
.wiki bitlocker@foxmail.com
.mailto[kokoklock@cock.li].1be018 note;1BE018-Readme.txt
email contact kokoklock@cock.li, pabpabtab@tuta.io
.[notopen@countermail.com].NOT_OPEN” extension for encrypted files and “!HOW_RECOVERY_FILES!.txt”
Extension: .lbiaf6c8 or
Note in Russian: КАК РАСШИФРОВАТЬ ФАЙЛЫ.TXT
Email: mailnitrom@protonmail.ch (mailnitrom@airmail.cc, mailnitrom@tutanota.com)
.oo7 b1tc01n@aol.com
worldofdonkeys@
horsesecret@ beautymdonkey@ spot .borishorse, .horseliker
“.USA” and “.xwx”, extortion email addresses “usacode@aol.com” and “data@decoding.biz”.
‘.best’ – ‘bestdecoding@cock.li’
‘.ETH’ – helpfilerestore@india.com
‘.qwex’ – ‘backdata@qq.com’
‘.air’ – ‘satco@tutanota.com’
‘.888’ – donald888@mail.fr
‘.amber’ and ‘.frend’ – ‘korvin0amber@cock.li’ and ‘undogdianact1986@aol.com’
‘.KARLS’ – ‘karlosdecrypt@outlook.com’
‘.aqva’ – ‘crypted_files@qq.com’
‘.AYE’ – ‘sebekgrime@tutanota.com’
‘.korea’ – ‘omfg@420blaze.it’
‘.NWA’ – ‘dr.crypt@aol.com’
‘.com’ – ‘trupm@protonmail.com’
‘.azero’ – ‘cryptor55@cock.li’
another ‘.com’ variant with contact email address ‘ht2707@email.vccs.edu’
‘.bk666’ – ‘berserk666@tutanota.com’
‘.ms13’ – ‘ms_13@aol.com’
‘.carcn’ – ‘carcinoma24@aol.com’
‘.btix’ – ‘encrypt11@cock.li’
‘.LOVE’ – ‘seeyoubro@tutanota.com’
‘.video’ – ‘tetty86@cock.li’
‘.MERS’ – ‘crypt1style@aol.com’
‘.bat’ – ‘idecryptyourdata@cock.li’ and ‘decryptyourdata@qq.com’
‘.qbix’ – ‘backdata@qq.com’
more and more variants coming – ‘.aa1’ – ‘who8@mail.fr’ – and ‘.wal’ – ‘decryptdocs@protonmail.com’
‘.qbtex’ – ‘1btc@decryption.biz’
‘.yG’ – ‘sysadmin@mail.fr’
‘.drweb’ – ‘dr.web24@aol.com’
‘.jack’ – ‘lockhelp@qq.com’ – and ‘.PLUT’ – ‘adolfhackler@tutanota.com’
‘.DDOS’ – ‘decripted@cock.li’
‘.cry’ – ‘decryptoperator@qq.com’
‘.4k’ – ‘rocosmon@cock.li’
‘.TOR13’ – ‘chanelcrypt@aol.com’
‘.good’ – ‘onecrypt@aol.com’
‘.beets’ – ‘vombombom@cock.li’
‘.BSC’ – ‘basecrypt@aol.com’
‘.zoh’ – ‘restdoc@protonmail.com’
‘.kjh’ – ‘datareturn@protonmail.com’
‘.html’ – ‘paydra@cock.li’
‘.harma’ – ‘ban.out@foxmail.com’
‘.HACK’ – ‘mr.hacker@tutanota.com’
‘.xxxx’ – ‘decryptxxx@protonmail.com’
‘.php’ + ‘.dqb’ – ‘back_me@foxmail.com’ + ‘btcdecoding@qq.com’
‘.1BTC’ – ‘btcdecoding@foxmail.com’
‘.com2’ – ‘DonovanTudor@aol.com’
‘.Acuf2’ – ‘panama777@tutanota’
‘.nqix’ – ‘support@qbmail.biz’
‘.Q1G’ – ‘getbtc@aol.com’
‘.cmd’ – ‘jsmith1974@mail.fr’
ID Ransomware
010001, 0kilobypt, 24H Ransomware, 4rw5w, 777, 7ev3n, 7h9r, 7zipper, 8lock8, AAC, ABCLocker, ACCDFISA v2.0, AdamLocker, AES_KEY_GEN_ASSIST, AES-Matrix, AES-NI, AES256-06, Al-Namrood, Al-Namrood 2.0, Alcatraz, Alfa, Allcry, Alma Locker, Alpha, AMBA, Amnesia, Amnesia2, Anatova, AnDROid, AngryDuck, Annabelle 2.1, Anubi, Anubis, AnubisCrypt, Apocalypse, Apocalypse (New Variant), ApocalypseVM, ApolloLocker, AresCrypt, Argus, Armage, ArmaLocky, Arsium, ASN1 Encoder, Ataware, Atchbo, Aurora, AutoLocky, AutoWannaCryV2, AVCrypt, AxCrypter, aZaZeL, B2DR, BadBlock, BadEncript, BadRabbit, Bam!, BananaCrypt, BandarChor, Bart, Bart v2.0, Basilisque Locker, BigBobRoss, Bisquilla, BitCrypt, BitCrypt 2.0, BitCryptor, BitKangoroo, Bitpaymer, Bitshifter, BitStak, BKRansomware, Black Feather, Black Shades, BlackHeart, Blackout, BlackRuby, Blind, Blind 2, Blocatto, BlockFile12, Blooper, Blue Blackmail, BoooamCrypt, Booyah, BrainCrypt, Brazilian Ransomware, BrickR, BTCamant, BTCWare, BTCWare Aleta, BTCWare Gryphon, BTCWare Master, BTCWare PayDay, Bubble, Bucbi, Bud, BugWare, BuyUnlockCode, Cancer, Cassetto, Cerber, Cerber 2.0, Cerber 3.0, Cerber 4.0 / 5.0, CerberTear, ChaCha, Chekyshka, Chimera, ChinaYunLong, ChineseRarypt, CHIP, ClicoCrypter, Clop, Clouded, CmdRansomware, CockBlocker, Coin Locker, CoinVault, Comrade Circle, Conficker, CorruptCrypt, Cossy, Coverton, Cr1ptT0r Ransomware, CradleCore, CreamPie, Creeper, Cripton, Cry128, Cry36, Cry9, Cryakl, CryFile, CryLocker, CrypMic, CrypMic, Crypren, Crypt0, Crypt0L0cker, Crypt0r, Crypt12, Crypt38, CryptConsole, CryptConsole3, CryptFuck, CryptGh0st, CryptInfinite, CryptoDefense, CryptoDevil, CryptoFinancial, CryptoFortress, CryptoGod, CryptoHasYou, CryptoHitman, CryptoJacky, CryptoJoker, CryptoLocker3, CryptoLockerEU, CryptoLuck, CryptoMix, CryptoMix Revenge, CryptoMix Wallet, Crypton, CryptON, CryptoPokemon, CryptorBit, CryptoRoger, CryptoShield, CryptoShocker, CryptoTorLocker, CryptoViki, CryptoWall 2.0, CryptoWall 3.0, CryptoWall 4.0, CryptoWire, CryptXXX, CryptXXX 2.0, CryptXXX 3.0, CryptXXX 4.0, CryPy, CrySiS, Crystal, CSP Ransomware, CTB-Faker, CTB-Locker, Dablio, Damage, DarkoderCryptor, DataKeeper, Dcrtr, DCry, DCry 2.0, Deadly, DeathNote, DecryptIomega, DEDCryptor, Defender, Defray, Defray777, DeriaLock, Dharma (.cezar Family), Dharma (.dharma Family), Dharma (.onion Family), Dharma (.wallet Family), Digisom, DilmaLocker, DirtyDecrypt, District, DMA Locker, DMA Locker 3.0, DMA Locker 4.0, DMALocker Imposter, DoggeWiper, Domino, Done, DoNotChange, Donut, DoubleLocker, DriedSister, DryCry, Dviide, DXXD, DynA-Crypt, eBayWall, eCh0raix / QNAPCrypt, ECLR Ransomware, EdgeLocker, EduCrypt, EggLocker, El Polocker, Enc1, EnCrypt, EncryptedBatch, EncrypTile, EncryptoJJS, Encryptor RaaS, Enigma, Enjey Crypter, EnkripsiPC, EOEO, Erebus, Eris, Eternal, Everbe, Everbe 2.0, Evil, Executioner, ExecutionerPlus, Exocrypt XTC, Exotic, Extortion Scam, Extractor, Fabiansomware, Fadesoft, Fantom, FartPlz, FCPRansomware, FCrypt, FenixLocker, FenixLocker 2.0, Fenrir, FilesLocker, FindZip, FireCrypt, Flatcher3, FLKR, Flyper, FreeMe, FrozrLock, FRSRansomware, FS0ciety, FuckSociety, FunFact, GandCrab, GandCrab v4.0 / v5.0, GandCrab2, GarrantyDecrypt, GC47, Gerber, GermanWiper, GetCrypt, GhostCrypt, GhostHammer, Gibon, Globe, Globe (Broken), Globe3, GlobeImposter, GlobeImposter 2.0, Godra, GOG, Golden Axe, GoldenEye, Gomasom, Good, Gorgon, Gotcha, GPAA, GPCode, GPGQwerty, GusCrypter, GX40, HadesLocker, Halloware, HappyDayzz, hc6, hc7, HDDCryptor, Heimdall, HellsRansomware, Help50, HelpDCFile, Herbst, Hermes, Hermes 2.0, Hermes 2.1, Heropoint, Hi Buddy!, HiddenTear, HKCrypt, HollyCrypt, HolyCrypt, HPE iLO Ransomware, Hucky, HydraCrypt, IEncrypt, IFN643, Ims00ry, ImSorry, Incanto, InducVirus, InfiniteTear, InfinityLock, InsaneCrypt, iRansom, Iron, Ishtar, Israbye, JabaCrypter, Jack.Pot, Jaff, Jager, Jamper / Buran, JapanLocker, JeepersCrypt, Jemd, Jigsaw, JNEC.a, JobCrypter, JoeGo Ransomware, JosepCrypt, JSWorm, JSWorm 2.0, JSWorm 4.0, JuicyLemon, JungleSec, Kaenlupuf, Kali, Karma, Karmen, Karo, Kasiski, Katyusha, KawaiiLocker, KCW, Kee Ransomware, KeRanger, Kerkoporta, KeyBTC, KEYHolder, KillerLocker, KillRabbit, KimcilWare, Kirk, Kolobo, Kostya, Kozy.Jozy, Kraken, Kraken Cryptor, KratosCrypt, Krider, Kriptovor, KryptoLocker, L33TAF Locker, Ladon, Lalabitch, LambdaLocker, LeChiffre, LightningCrypt, Lilocked, Lime, Litra, LittleFinger, LLTP, LMAOxUS, Lock2017, Lock93, LockBox, LockCrypt, LockCrypt 2.0, Locked-In, LockedByte, LockeR, LockerGoga, LockLock, LockMe, Lockout, Locky, LongTermMemoryLoss, LooCipher, Lortok, LoveServer, LowLevel04, Lucky, MadBit, MAFIA, MafiaWare, Magic, Magniber, Major, Maktub Locker, MalwareTech’s CTF, Maoloa, Marduk, Marlboro, MarsJoke, Matrix, MauriGo, MaxiCrypt, Maykolin, Maysomware, MCrypt2018, MegaCortex, MegaLocker, Meteoritan, Mikoyan, MindSystem, Minotaur, MirCop, MireWare, Mischa, MMM, MNS CryptoLocker, Mobef, MongoLock, MoonCrypter, MorrisBatchCrypt, MOTD, MoWare, MRCR1, MrDec, Mystic, n1n1n1, NanoLocker, NCrypt, NegozI, Nemty, Nemucod, Nemucod-7z, Nemucod-AES, NETCrypton, Netix, NewHT, Nhtnwcuf, NM4, NMoreira, NMoreira 2.0, Noblis, NonRansomware, NotAHero, Nozelesn, NSB Ransomware, Nuke, NullByte, NxRansomware, ODCODC, OhNo!, OoPS, OopsLocker, OpenToYou, OpJerusalem, Ordinypt, OzozaLocker, PadCrypt, Paradise, Paradise B29, PayPalGenerator2019, PaySafeGen, PClock, PClock (Updated), PEC 2017, Pendor, Petna, PewCrypt, PGPSnippet, Philadelphia, Phobos, Pickles, Plague17, Planetary Ransomware, PoisonFang, PopCornTime, Potato, PowerLocky, PowerShell Locker, PowerWare, Pr0tector, Predator, PrincessLocker, PrincessLocker 2.0, PrincessLocker Evolution, Project34, Project57, Protected Ransomware, PshCrypt, PUBG Ransomware, PyCL, PyCL, PyL33T, PyLocky, qkG, QP Ransomware, QuakeWay, QwertyCrypt, Qweuirtksd, R980, RAA-SEP, RabbitFox, RackCrypt, Radamant, Radamant v2.1, Radiation, Random6, RandomLocker, Ranion, RanRan, RanRans, Rans0mLocked, RansomCuck, Ransomnix, RansomPlus, Ransomwared, RansomWarrior, Rapid, Rapid 2.0 / 3.0, RaRansomware, RarVault, Razy, RedBoot, RedEye, REKTLocker, Rektware, Relock, RemindMe, RenLocker, RensenWare, RetMyData, REvil / Sodinokibi, Reyptson, RobbinHood, Roga, Rokku, Rontok, RoshaLock, RotorCrypt, Roza, RSA-NI, RSA2048Pro, RSAUtil, Ruby, Russenger, Russian EDA2, Ryuk, SAD, SadComputer, SADStory, Sage 2.0, Salsa, SamSam, Sanction, Sanctions, Satan, Satana, Saturn, Scarab, SD 1.1, Seon, Sepsis, SerbRansom, Serpent, ShellLocker, Shifr, Shigo, ShinigamiLocker, ShinoLocker, ShivaGood, ShkolotaCrypt, Shrug, Shujin, Shutdown57, Sifreli, Sigma, Sigrun, SilentSpring, Simple_Encoder, SintaLocker, Skull Ransomware, SkyFile, SkyStars, Smrss32, SnakeLocker, Snatch, SNSLocker, SoFucked, Solo Ransomware, Spartacus, Spectre, Spider, Spora, Sport, SQ_, Stampado, Stinger, STOP (Djvu), STOP / KEYPASS, StorageCrypter, Storm, Striked, Stroman, Stupid Ransomware, Styx, SuperB, SuperCrypt, Surprise, SynAck, SyncCrypt, Syrk, SYSDOWN, SystemCrypter, SZFLocker, T1Happy, Team XRat, Telecrypt, TellYouThePass, Termite, TeslaCrypt 0.x, TeslaCrypt 2.x, TeslaCrypt 3.0, TeslaCrypt 4.0, TeslaWare, TFlower, Thanatos, TheDarkEncryptor, THT Ransomware, tk, Torchwood, TotalWipeOut, TowerWeb, ToxCrypt, Trojan.Encoder.6491, Troldesh / Shade, Tron, TrueCrypter, TrumpLocker, UCCU, UIWIX, Ukash, UmbreCrypt, UnblockUPC, Ungluk, Unit09, Unknown Crypted, Unknown Lock, Unknown XTBL, Unlock26, Unlock92, Unlock92 2.0, Unlock92 Zipper, Useless Disk, UselessFiles, UserFilesLocker, USR0, Uyari, V8Locker, Vapor v1, VaultCrypt, vCrypt, VegaLocker, Velso, Vendetta, VenisRansomware, VenusLocker, ViACrypt, VindowsLocker, VisionCrypt, VMola, Vortex, Vurten, VxLock, Waffle, WannaCash, WannaCry, WannaCry.NET, WannaCryOnClick, WannaDie, WannaPeace, WannaSmile, WannaSpam, Wesker, WhatAFuck, WhiteRose, WildFire Locker, WininiCrypt, Winnix Cryptor, WinRarer, WonderCrypter, Wooly, Wulfric, X Locker 5.0, XCry, XCrypt, XData, XiaoBa, XiaoBa 2.0, Xorist, Xort, XRTN, XTP Locker 5.0, XYZWare, Yatron, YouAreFucked, YourRansom, Yyto, ZariqaCrypt, zCrypt, Zekwacrypt, Zenis, ZeroCrypt, ZeroFucks, Zeropadypt, Zeropadypt NextGen, ZeroRansom, Zilla, ZimbraCryptor, ZinoCrypt, ZipLocker, Zipper, Zoldon, ZQ, Zyklon, RSA
