splunk-security_content/lookups/ransomware_extensions.csv

1	Extensions	Name
2	.enc	.CryptoHasYou.
3	.777	777
4	.R4A	7ev3n
5	.R5A	7ev3n
6	.7h9r	7h9r
7	.8lock8	8lock8
8	.encrypt	Alpha Ransomware
9	.amba	AMBA
10	.adk	Angry Duck
11	.encrypted	Apocalypse
12	.SecureCrypted	Apocalypse
13	.FuckYourData	Apocalypse
14	.unavailable	Apocalypse
15	.bleepYourFiles	Apocalypse
16	.Where_my_files.txt	Apocalypse
17	.encrypted	ApocalypseVM
18	.locked	ApocalypseVM
19	.locky	AutoLocky
20	.adr	BaksoCrypt
21	.avos	AvosLocker
22	.avos2	AvosLocker
23	.avoslinux	AvosLocker
24	.bart.zip	Bart
25	.bart	Bart
26	.perl	Bart
27	.clf	BitCryptor
28	.bitstak	BitStak
29	.Silent	BlackShades Crypter
30	.blocatto	Blocatto
31	.cry	Central Security Treatment Organization
32	.cerber	Cerber
33	.cerber2	Cerber
34	.cerber3	Cerber
35	.clf	CoinVault
36	.coverton	Coverton
37	.enigma	Coverton
38	.czvxce	Coverton
39	.criptiko	CryFile
40	.criptoko	CryFile
41	.criptokod	CryFile
42	.cripttt	CryFile
43	.aga	CryFile
44	.cry	CryLocker
45	.ENCRYPTED	Crypren
46	.crypt38	Crypt38
47	.scl	CryptFIle2
48	.crinf	CryptInfinite
49	.frtrss	CryptoFortress
50	.clf	CryptoGraphic Locker
51	.crjoker	CryptoJoker
52	.encrypted	CryptoLocker
53	.ENC	CryptoLocker
54	.code	CryptoMix
55	.scl	CryptoMix
56	.crptrgr	CryptoRoger
57	.locked	CryptoShocker
58	.CryptoTorLocker2015!	CryptoTorLocker2015
59	.crypt	CryptXXX
60	.crypt	CryptXXX 2.0
61	.crypt	CryptXXX 3.0
62	.cryp1	CryptXXX 3.0
63	.crypz	CryptXXX 3.0
64	.cryptz	CryptXXX 3.0
65	.cryp1	CryptXXX 3.1
66	.ctbl	CTB-Locker
67	.encrypted	CuteRansomware
68	.ded	DEDCryptor
69	.domino	Domino
70	.locked	EDA2 / HiddenTear
71	.isis	EduCrypt
72	.locked	EduCrypt
73	.ha3	El-Polocker
74	.enigma	Enigma
75	.1txt	Enigma
76	.exotic	Exotic
77	.locked	Fakben
78	.fantom	Fantom
79	.Z81928819	GhostCrypt
80	.purge	Globe v1
81	.globe	Globe v3
82	.locked	GNL Locker
83	.crypt	Gomasom
84	.herbst	Herbst
85	.cry	Hi Buddy!
86	.locky	Hucky
87	.crime	iLock
88	.crime	iLockLight
89	.btc	Jigsaw
90	.kkk	Jigsaw
91	.fun	Jigsaw
92	.gws	Jigsaw
93	.porno	Jigsaw
94	.payransom	Jigsaw
95	.payms	Jigsaw
96	.paymst	Jigsaw
97	.AFD	Jigsaw
98	.paybtcs	Jigsaw
99	.epic	Jigsaw
100	.xyz	Jigsaw
101	.locked	Job Crypter
102	.encrypted	KeRanger
103	.keybtc@inbox_com	KeyBTC
104	.rip	Killer Locker
105	.kimcilware	KimcilWare
106	.locked	KimcilWare
107	.kostya	Kostya
108	.kratos	KratosCrypt
109	.LeChiffre	LeChiffre
110	.locky	Locky
111	.zepto	Locky
112	.odin	Locky
113	.shit	Locky
114	.thor	Locky
115	.asier	Locky
116	.zzzzz	Locky
117	.osiris	Locky
118	.lock93	Lock93
119	.crime	Lortok
120	.oor	LowLevel04
121	.magic	Magic
122	.Lock	MIRCOP
123	.fucked	MireWare
124	.fuck	MireWare
125	.locked	MM Locker
126	.KEYZ	Mobef
127	.KEYH0LES	Mobef
128	.crypted	Nemucod
129	.odcodc	ODCODC
130	.cbf	Offline ransomware
131	.LOL!	OMG! Ransomware
132	.OMG!	OMG! Ransomware
133	.padcrypt	PadCrypt
134	.locked	Philadelphia
135	.locked	PokemonGO
136	.filock	Popcorn Time
137	.locky	PowerWare
138	.crypt	R980
139	.locked	RAA encryptor
140	.RDM	Radamant
141	.RRK	Radamant
142	.RAD	Radamant
143	.RADAMANT	Radamant
144	.locked	Rakhni
145	.kraken	Rakhni
146	.darkness	Rakhni
147	.nochance	Rakhni
148	.oshit	Rakhni
149	.oplata@qq_com	Rakhni
150	.relock@qq_com	Rakhni
151	.crypto	Rakhni
152	.helpdecrypt@ukr.net	Rakhni
153	.pizda@qq_com	Rakhni
154	.dyatel@qq_com	Rakhni
155	._ryp	Rakhni
156	.nalog@qq_com	Rakhni
157	.chifrator@qq_com	Rakhni
158	.gruzin@qq_com	Rakhni
159	.troyancoder@qq_com	Rakhni
160	.encrypted	Rakhni
161	.cry	Rakhni
162	.AES256	Rakhni
163	.enc	Rakhni
164	.hb15	Rakhni
165	.vscrypt	Rector
166	.infected	Rector
167	.bloc	Rector
168	.korrektor	Rector
169	.rekt	RektLocker
170	.remind	RemindMe
171	.crashed	RemindMe
172	.rokku	Rokku
173	.encryptedAES	Samas-Samsam
174	.encryptedRSA	Samas-Samsam
175	.encedRSA	Samas-Samsam
176	.justbtcwillhelpyou	Samas-Samsam
177	.btcbtcbtc	Samas-Samsam
178	.btc-help-you	Samas-Samsam
179	.only-we_can-help_you	Samas-Samsam
180	.iwanthelpuuu	Samas-Samsam
181	.notfoundrans	Samas-Samsam
182	.encmywork	Samas-Samsam
183	.weapologize	Samas-Samsam
184	.stubbin	Samas-Samsam
185	.areyoulovemyrans	Samas-Samsam
186	.loveransisgood	Samas-Samsam
187	.myransext2017	Samas-Samsam
188	.disposed2017	Samas-Samsam
189	.prosperous666	Samas-Samsam
190	.supported2017	Samas-Samsam
191	.country82000	Samas-Samsam
192	.moments2900	Samas-Samsam
193	.breeding123	Samas-Samsam
194	.mention9823	Samas-Samsam
195	.suppose666	Samas-Samsam
196	.skjdthghh	Samas-Samsam
197	.cifgksaffsfyghd	Samas-Samsam
198	.iaufkakfhsaraf	Samas-Samsam
199	.filegofprencrp	Samas-Samsam
200	.weencedufiles	Samas-Samsam
201	.encryptedyourfiles	Samas-Samsam
202	.letmetrydecfiles	Samas-Samsam
203	.otherinformation	Samas-Samsam
204	.weareyourfriends	Samas-Samsam
205	.noproblemwedecfiles	Samas-Samsam
206	.powerfulldecrypt	Samas-Samsam
207	.wowreadfordecryp	Samas-Samsam
208	.wowwhereismyfiles	Samas-Samsam
209	.helpmeencedfiles	Samas-Samsam
210	.theworldisyours	Samas-Samsam
211	.vekanhelpu	Samas-Samsam
212	.howcanihelpusir	Samas-Samsam
213	.VforVendetta	Samas-Samsam
214	.checkdiskenced	Samas-Samsam
215	.goforhelp	Samas-Samsam
216	.iloveworld	Samas-Samsam
217	.canihelpyou	Samas-Samsam
218	.AreYouLoveMyRansFile	Samas-Samsam
219	.fucku	Samas-Samsam
220	.happenencedfiles	Samas-Samsam
221	.iwishiyou	Samas-Samsam
222	.powerfulldecryp	Samas-Samsam
223	.suppose665	Samas-Samsam
224	.Whereisyourfiles	Samas-Samsam
225	.sanction	Sanction
226	.locked	Shark
227	.shino	ShinoLocker
228	.locked	SkidLocker / Pompous
229	.encrypted	Smrss32
230	.RSNSlocked	SNSLocker
231	.RSplited	SNSLocker
232	.sport	Sport
233	.locked	Stampado
234	.locked	Strictor
235	.surprise	Surprise
236	.tzu	Surprise
237	.szf	SZFLocker
238	.xcri	TeleCrypt
239	.vvv	TeslaCrypt 0.x - 2.2.0
240	.ecc	TeslaCrypt 0.x - 2.2.0
241	.exx	TeslaCrypt 0.x - 2.2.0
242	.ezz	TeslaCrypt 0.x - 2.2.0
243	.abc	TeslaCrypt 0.x - 2.2.0
244	.aaa	TeslaCrypt 0.x - 2.2.0
245	.zzz	TeslaCrypt 0.x - 2.2.0
246	.xyz	TeslaCrypt 0.x - 2.2.0
247	.micro	TeslaCrypt 3.0+
248	.xxx	TeslaCrypt 3.0+
249	.ttt	TeslaCrypt 3.0+
250	.mp3	TeslaCrypt 3.0+
251	.Encrypted	TorrentLocker
252	.enc	TorrentLocker
253	.toxcrypt	Toxcrypt
254	.better_call_saul	Troldesh
255	.xtbl	Troldesh
256	.da_vinci_code	Troldesh
257	.windows10	Troldesh
258	.enc	TrueCrypter
259	.locked	Turkish Ransom
260	.H3LL	Ungluk
261	.0x0	Ungluk
262	.1999	Ungluk
263	.CRRRT	Unlock92
264	.CCCRRRPPP	Unlock92
265	.vault	VaultCrypt
266	.xort	VaultCrypt
267	.trun	VaultCrypt
268	.Venusf	VenusLocker
269	.Venusp	VenusLocker
270	.CrySiS	Virus-Encoder
271	.xtbl	Virus-Encoder
272	.wflx	WildFire Locker
273	.EnCiPhErEd	Xorist
274	.73i87A	Xorist
275	.p5tkjw	Xorist
276	.PoAr2w	Xorist
277	.fileiscryptedhard	Xorist
278	.encoderpass	Xorist
279	.zc3791	Xorist
280	.xrtn	XRTN
281	.zcrypt	Zcrypt
282	.crypto	Zimbra
283	.vault	Zlader / Russian
284	.zyklon	Zyklon
285	.wncry	WannaCry
286	.wcry	WannaCry
287	.wnry	WannaCry
288	.wncryt	WannaCry
289	.WNCRYT	WannaCry
290	.RYK	Ryuk
291	.Clop	Clop
292	.Cllp	Clop
293	.JSWORM	JSWorm
294	.NEMTY_*	Nemty
295	.NEFILIM	Nefilim
296	.OFFWHITE	Offwhite
297	.TELEGRAM	Telegram
298	.FUSION	Fusion
299	.MILIHPEN	Milihpen
300	.GANGBANG	Gangbang
301	.reddot	RedDot
302	.MEDUSA	Medusa
303	.rhysida	Rhysida