splunk-security_content/lookups/ransomware_extensions.csv

1	Extensions	Name
2	.enc	.CryptoHasYou.
3	.777	777
4	.R4A	7ev3n
5	.R5A	7ev3n
6	.7h9r	7h9r
7	.8lock8	8lock8
8	.encrypt	Alpha Ransomware
9	.amba	AMBA
10	.adk	Angry Duck
11	.encrypted	Apocalypse
12	.SecureCrypted	Apocalypse
13	.FuckYourData	Apocalypse
14	.unavailable	Apocalypse
15	.bleepYourFiles	Apocalypse
16	.Where_my_files.txt	Apocalypse
17	.encrypted	ApocalypseVM
18	.locked	ApocalypseVM
19	.locky	AutoLocky
20	.adr	BaksoCrypt
21	.avos	AvosLocker
22	.avos2	AvosLocker
23	.avoslinux	AvosLocker
24	.bart.zip	Bart
25	.bart	Bart
26	.perl	Bart
27	.clf	BitCryptor
28	.bitstak	BitStak
29	.Silent	BlackShades Crypter
30	.blocatto	Blocatto
31	.lock	Brazilian
32	.cry	Central Security Treatment Organization
33	.cerber	Cerber
34	.cerber2	Cerber
35	.cerber3	Cerber
36	.clf	CoinVault
37	.coverton	Coverton
38	.enigma	Coverton
39	.czvxce	Coverton
40	.criptiko	CryFile
41	.criptoko	CryFile
42	.criptokod	CryFile
43	.cripttt	CryFile
44	.aga	CryFile
45	.cry	CryLocker
46	.ENCRYPTED	Crypren
47	.crypt38	Crypt38
48	.scl	CryptFIle2
49	.crinf	CryptInfinite
50	.frtrss	CryptoFortress
51	.clf	CryptoGraphic Locker
52	.crjoker	CryptoJoker
53	.encrypted	CryptoLocker
54	.ENC	CryptoLocker
55	.code	CryptoMix
56	.scl	CryptoMix
57	.crptrgr	CryptoRoger
58	.locked	CryptoShocker
59	.CryptoTorLocker2015!	CryptoTorLocker2015
60	.crypt	CryptXXX
61	.crypt	CryptXXX 2.0
62	.crypt	CryptXXX 3.0
63	.cryp1	CryptXXX 3.0
64	.crypz	CryptXXX 3.0
65	.cryptz	CryptXXX 3.0
66	.cryp1	CryptXXX 3.1
67	.ctbl	CTB-Locker
68	.encrypted	CuteRansomware
69	.ded	DEDCryptor
70	.domino	Domino
71	.locked	EDA2 / HiddenTear
72	.isis	EduCrypt
73	.locked	EduCrypt
74	.ha3	El-Polocker
75	.enigma	Enigma
76	.1txt	Enigma
77	.exotic	Exotic
78	.locked	Fakben
79	.fantom	Fantom
80	.Z81928819	GhostCrypt
81	.purge	Globe v1
82	.globe	Globe v3
83	.locked	GNL Locker
84	.crypt	Gomasom
85	.herbst	Herbst
86	.cry	Hi Buddy!
87	.locky	Hucky
88	.crime	iLock
89	.crime	iLockLight
90	.btc	Jigsaw
91	.kkk	Jigsaw
92	.fun	Jigsaw
93	.gws	Jigsaw
94	.porno	Jigsaw
95	.payransom	Jigsaw
96	.payms	Jigsaw
97	.paymst	Jigsaw
98	.AFD	Jigsaw
99	.paybtcs	Jigsaw
100	.epic	Jigsaw
101	.xyz	Jigsaw
102	.locked	Job Crypter
103	.encrypted	KeRanger
104	.keybtc@inbox_com	KeyBTC
105	.rip	Killer Locker
106	.kimcilware	KimcilWare
107	.locked	KimcilWare
108	.kostya	Kostya
109	.kratos	KratosCrypt
110	.LeChiffre	LeChiffre
111	.locky	Locky
112	.zepto	Locky
113	.odin	Locky
114	.shit	Locky
115	.thor	Locky
116	.asier	Locky
117	.zzzzz	Locky
118	.osiris	Locky
119	.lock93	Lock93
120	.crime	Lortok
121	.oor	LowLevel04
122	.magic	Magic
123	.Lock	MIRCOP
124	.fucked	MireWare
125	.fuck	MireWare
126	.locked	MM Locker
127	.KEYZ	Mobef
128	.KEYH0LES	Mobef
129	.crypted	Nemucod
130	.odcodc	ODCODC
131	.cbf	Offline ransomware
132	.LOL!	OMG! Ransomware
133	.OMG!	OMG! Ransomware
134	.padcrypt	PadCrypt
135	.locked	Philadelphia
136	.locked	PokemonGO
137	.filock	Popcorn Time
138	.locky	PowerWare
139	.crypt	R980
140	.locked	RAA encryptor
141	.RDM	Radamant
142	.RRK	Radamant
143	.RAD	Radamant
144	.RADAMANT	Radamant
145	.locked	Rakhni
146	.kraken	Rakhni
147	.darkness	Rakhni
148	.nochance	Rakhni
149	.oshit	Rakhni
150	.oplata@qq_com	Rakhni
151	.relock@qq_com	Rakhni
152	.crypto	Rakhni
153	.helpdecrypt@ukr.net	Rakhni
154	.pizda@qq_com	Rakhni
155	.dyatel@qq_com	Rakhni
156	._ryp	Rakhni
157	.nalog@qq_com	Rakhni
158	.chifrator@qq_com	Rakhni
159	.gruzin@qq_com	Rakhni
160	.troyancoder@qq_com	Rakhni
161	.encrypted	Rakhni
162	.cry	Rakhni
163	.AES256	Rakhni
164	.enc	Rakhni
165	.hb15	Rakhni
166	.vscrypt	Rector
167	.infected	Rector
168	.bloc	Rector
169	.korrektor	Rector
170	.rekt	RektLocker
171	.remind	RemindMe
172	.crashed	RemindMe
173	.rokku	Rokku
174	.encryptedAES	Samas-Samsam
175	.encryptedRSA	Samas-Samsam
176	.encedRSA	Samas-Samsam
177	.justbtcwillhelpyou	Samas-Samsam
178	.btcbtcbtc	Samas-Samsam
179	.btc-help-you	Samas-Samsam
180	.only-we_can-help_you	Samas-Samsam
181	.iwanthelpuuu	Samas-Samsam
182	.notfoundrans	Samas-Samsam
183	.encmywork	Samas-Samsam
184	.weapologize	Samas-Samsam
185	.stubbin	Samas-Samsam
186	.areyoulovemyrans	Samas-Samsam
187	.loveransisgood	Samas-Samsam
188	.myransext2017	Samas-Samsam
189	.disposed2017	Samas-Samsam
190	.prosperous666	Samas-Samsam
191	.supported2017	Samas-Samsam
192	.country82000	Samas-Samsam
193	.moments2900	Samas-Samsam
194	.breeding123	Samas-Samsam
195	.mention9823	Samas-Samsam
196	.suppose666	Samas-Samsam
197	.skjdthghh	Samas-Samsam
198	.cifgksaffsfyghd	Samas-Samsam
199	.iaufkakfhsaraf	Samas-Samsam
200	.filegofprencrp	Samas-Samsam
201	.weencedufiles	Samas-Samsam
202	.encryptedyourfiles	Samas-Samsam
203	.letmetrydecfiles	Samas-Samsam
204	.otherinformation	Samas-Samsam
205	.weareyourfriends	Samas-Samsam
206	.noproblemwedecfiles	Samas-Samsam
207	.powerfulldecrypt	Samas-Samsam
208	.wowreadfordecryp	Samas-Samsam
209	.wowwhereismyfiles	Samas-Samsam
210	.helpmeencedfiles	Samas-Samsam
211	.theworldisyours	Samas-Samsam
212	.vekanhelpu	Samas-Samsam
213	.howcanihelpusir	Samas-Samsam
214	.VforVendetta	Samas-Samsam
215	.checkdiskenced	Samas-Samsam
216	.goforhelp	Samas-Samsam
217	.iloveworld	Samas-Samsam
218	.canihelpyou	Samas-Samsam
219	.AreYouLoveMyRansFile	Samas-Samsam
220	.fucku	Samas-Samsam
221	.happenencedfiles	Samas-Samsam
222	.iwishiyou	Samas-Samsam
223	.powerfulldecryp	Samas-Samsam
224	.suppose665	Samas-Samsam
225	.Whereisyourfiles	Samas-Samsam
226	.sanction	Sanction
227	.locked	Shark
228	.shino	ShinoLocker
229	.locked	SkidLocker / Pompous
230	.encrypted	Smrss32
231	.RSNSlocked	SNSLocker
232	.RSplited	SNSLocker
233	.sport	Sport
234	.locked	Stampado
235	.locked	Strictor
236	.surprise	Surprise
237	.tzu	Surprise
238	.szf	SZFLocker
239	.xcri	TeleCrypt
240	.vvv	TeslaCrypt 0.x - 2.2.0
241	.ecc	TeslaCrypt 0.x - 2.2.0
242	.exx	TeslaCrypt 0.x - 2.2.0
243	.ezz	TeslaCrypt 0.x - 2.2.0
244	.abc	TeslaCrypt 0.x - 2.2.0
245	.aaa	TeslaCrypt 0.x - 2.2.0
246	.zzz	TeslaCrypt 0.x - 2.2.0
247	.xyz	TeslaCrypt 0.x - 2.2.0
248	.micro	TeslaCrypt 3.0+
249	.xxx	TeslaCrypt 3.0+
250	.ttt	TeslaCrypt 3.0+
251	.mp3	TeslaCrypt 3.0+
252	.Encrypted	TorrentLocker
253	.enc	TorrentLocker
254	.toxcrypt	Toxcrypt
255	.better_call_saul	Troldesh
256	.xtbl	Troldesh
257	.da_vinci_code	Troldesh
258	.windows10	Troldesh
259	.enc	TrueCrypter
260	.locked	Turkish Ransom
261	.H3LL	Ungluk
262	.0x0	Ungluk
263	.1999	Ungluk
264	.CRRRT	Unlock92
265	.CCCRRRPPP	Unlock92
266	.vault	VaultCrypt
267	.xort	VaultCrypt
268	.trun	VaultCrypt
269	.Venusf	VenusLocker
270	.Venusp	VenusLocker
271	.CrySiS	Virus-Encoder
272	.xtbl	Virus-Encoder
273	.wflx	WildFire Locker
274	.EnCiPhErEd	Xorist
275	.73i87A	Xorist
276	.p5tkjw	Xorist
277	.PoAr2w	Xorist
278	.fileiscryptedhard	Xorist
279	.encoderpass	Xorist
280	.zc3791	Xorist
281	.xrtn	XRTN
282	.zcrypt	Zcrypt
283	.crypto	Zimbra
284	.vault	Zlader / Russian
285	.zyklon	Zyklon
286	.wncry	WannaCry
287	.wcry	WannaCry
288	.wnry	WannaCry
289	.wncryt	WannaCry
290	.WNCRYT	WannaCry
291	.RYK	Ryuk
292	.Clop	Clop
293	.Cllp	Clop
294	.JSWORM	JSWorm
295	.NEMTY_*	Nemty
296	.NEFILIM	Nefilim
297	.OFFWHITE	Offwhite
298	.TELEGRAM	Telegram
299	.FUSION	Fusion
300	.MILIHPEN	Milihpen
301	.GANGBANG	Gangbang
302	.reddot	RedDot