Malware Categories: Ransomware

Boooam is a file-locking virus named after the email address given by it — [email protected]. The victims of Boooam have had their files corrupted, and they’re encouraged by the criminal to pay for a decryptor. Cyber extortion is a lucrative and criminal business which claims new victims every day. Boooam was earlier this week and … Continued

Did your files get turned into Boop-type files? Boop is a file-locking virus that uses cryptography to encrypt (corrupt) data. There’s a key that could reverse that. In exchange for that decryption key, Boop asks you for money – from $490 to $980. This is why Boop is called “ransomware”. Although Boop can be deleted … Continued

Boot is a new version of Djvu — a big ransomware family that’s been known for about two years. Boot works by encrypting the victim’s files and leaving behind a message demanding payment. Boot is similar to Karl, Nesa, Meds, and other Djvu viruses. They all encrypt the victim’s data and then ask for a … Continued

Discovered a few days ago, Bopador is a virus that affects Windows computers and user-created files. The virus is created for extorting people out of their money. Bopador is part of the STOP ransomware family, together with Access, Cezor, Drume, and others. Bopador is a close copy of the previous STOP viruses with the ability to … Continued

Bora ransomware is a new edition of the Djvu strain. It doesn’t seem to be popular yet, and, hopefully, it will stay that way because this is a dangerous virus that can potentially cause a lot of harm. Bora locks the victim’s files using encryption and makes them unusable, but it also installs a password stealer and … Continued

Files suddenly being locked with the “.BORISHORSE” extension, a pop-up window telling you to contact people to get your data back — these are some very alarming symptoms. They show that your computer has been infected with a file-encrypting virus. This one has been named BORISHORSE and it shares family ties with Dharma and Phobos … Continued

Borontok aka. Rontok (B0r0nt0K, Botontok) virus is a new ransomware that got attention on February 22, 2019, when a user on BleepingComputer forum posted its ransom note which was demanding for 20BTC which in US dollars is around $76,000 at the moment of writing. Although crooks have been getting greedier with time, such amount is … Continued

BrickR Ransomware is a really dangerous malware infection that can cause you a lot of trouble. It is targeted to infect computers, encrypt files stored on a hard drive and then ask for a ransom in order to unlock it. So actually there are two problems – you have to remove the virus itself and … Continued

The Brotherhood is the name of computer virus which is categorized as ransomware. Ransomware infections are extremely dangerous – they can completely ruin your system and make it unusable. Most importantly, it can destroy your personal files, so you are in danger of losing very important data. This particular virus is targeting computer with Windows … Continued

Brusaf is a serious computer virus that can, in the worst cases, cost the victim their files permanently. If you see that your files won’t open and have been renamed to have “.brusaf” attached like a second extension, those are symptoms of a Brusaf infection. This virus is new, but it’s part of a known … Continued

BTCWare Aleta (also referred to as only Aleta) ransomware virus displays a screen-locker which is almost identical to the one that is triggered by the Master infection (which is based on BTCWare). It turns off the function of startup repair, intends to hide failures during reboot processes and conceals most of its files in a … Continued

Btix (also known as Encrypt11) is the new ransomware related to Dharma/CrySiS. This virus affects computers running Windows. Btix practically destroys most common files, like pictures, documents, spreadsheets, media files, and archives. The only way to fix them is to decrypt them using the decryption key stored with whoever is responsible for the Btix virus. The … Continued

Btos is a new ransomware threat. It can encrypt your files, making them impossible to open. And there’s no free decrypter except in some limited cases, so if you didn’t have a backup, your files could be lost. Btos is also dangerous in a few other ways – it can break your antivirus program, block … Continued

Bud ransomware virus is one of the crypto-malware samples that came out in September of 2017. Even though recent infections like InfinityLock or BlackHat ransomware are not the best crypto-viruses we have investigated, but they do pose a threat to owners of computers. As you might have heard, 2017 has been an exceptional year for … Continued

Having your files unexpectedly change to type budak is the symptom of a Budak infection. This virus goes through your files and locks them using strong cryptography (as well as appends the “budak” to the file names) including your images, documents, nearly any type of file. This is done so that extortionists can convince you … Continued

BugWare ransomware virus is one of the few crypto-malware example that require ransoms to be paid in Monero crypto-currency. We have only observed a couple of ransomware infections that make demans for Monero. Those samples include Kirk, eBayWall and OhNo! ransomware viruses. BugWare crypto-virus is delivered via doc_2017100200000-15.pdf.exe () payload which is going to be … Continued

Bundeskriminalamt virus is a ransomware program that takes over computers completely and tries to get money from their users. This version of a program targets computers in Austria specifically. It hides under the name of Austrian police and displays a message in German. The ransomware is distributed using Trojan viruses and once inside it locks … Continued

Buran is a file-locking virus that works on Windows systems. This ransomware renames the encrypted files by adding a long string (36 symbols long) of letters from A to F and numbers to the ends of their names. For example, “list.doc” might become “list.doc.A451E487-423B-C45B-45EA-1256A54DE247”, or similar. Buran leaves behind a ransom note (it starts with … Continued

Burn is of being a new variant of Scarab (Horsia) ransomware. This virus will encrypt files on the computer that it infects, appending the “.burn” extension and locking files of almost all most popular types. This virus is devastating for those unprepared, but there are ways to be ready for an attack by ransomware like Burn. How … Continued

Buyunlockcode ransomware is a malicious program that secretly infiltrates into random computers and demands for money for files’ decryption. It is not easy to get rid of this infection, mainly because although you can delete files related to it, some of your files can remain encrypted. It is only possible to restore the files if … Continued

C0hen locker is a ransomware infection for Windows PCs. It was noticed by the on Twitter. C0hen locker locks your files and asks you to download Discord to add the author of this ransomware (presumably) and ask them for the decryption key. C0hen locker in short: Type of threat Ransomware. Consequences of infection Files are … Continued

Cadq is a malicious program. It breaks files so that they can’t be opened and renames them to enc with “.cadq”. It also leaves behind a ransom note asking for hundreds of dollars in exchange for fixing the files. Cadq ransomware causes harm that might be unfixable in some cases. First of all, it needs … Continued

Caley is the name of the file-locking infection that belongs to the Phobos family of ransomware. Caley has all the same symptoms: files can’t be opened, have text added to their names, a window demanding money in Bitcoin is opened on your screen. Caley is very similar to Adage, Help, and other Phobos variants. This ransomware was … Continued

Calix Ransomware is a virus that infects systems in a variety of ways and locks files using cryptography. The locked files are renamed so that their names end with “.id[[random]-2451].[[email protected]].calix”, including the email address of the criminals behind this attack. Calix is a type of Phobos ransomware and there is no way to decrypt its … Continued

This ransomware from the Dharma/CrySiS family. Carcn uses encryption to scramble the data of files on a computer. The files are useless without a key (a very large number that is impossible to guess right) to decrypt them. The key is only known to the people who spread this ransomware. In exchange for decryption of … Continued

Reports about Carote infections appeared on the weekend and it appears to be another version of STOP/Djvu ransomware. The virus does not seem to introduce any new features or weaknesses, which means that Carote is just as dangerous as the other new versions of Djvu. Although there are possible solutions to recover files locked by … Continued

CASH ([email protected]) – a Dharma type ransomware infection. This virus can encrypt most user files, making them inaccessible and unusable even though the files are still on the infected computer. The makers of CASH hold the file decryption data for ransom and make money by extorting their victims. CASH is very similar to PDF, NQIX, … Continued

Central Security Service virus is a ransomware that was designed by cybercriminals in order to rip off random computer users. The program is installed to PCs with a help of Trojan viruses so the users would not detect it at the stage of infiltration. Once inside it blocks your entire system and does not allow … Continued

Cerber 2 Ransomware is is a new updated version of Cerber Ransomware that is even more dangerous than its predecessor. The most visible change in this program is that it encrypts files using .Cerber2 extension. The second version is not possible to decrypt using Cerber Decryptor, which was working really well removing the first version … Continued

Cerber Ransomware is another program that infiltrates into computers without user’s knowledge and xtncrypts their important files. It works exactly the same as previously released Locky Ransomware, CryptoWall Ransomware, TeslaCrypt Ransomware, CTB Locker, etc. The only difference among all of them is the size of the ransom it asks for. The application is normally distributed … Continued

People have noticed their files becoming impossible to open and use normally after they were inexplicably converted to the Cetori type. This is a symptom of a new infection known as Cetori, a cryptovirus. Malware that uses cryptography to deny the victims access to their own files and, like Cetori, asks for money to unlock … Continued

A new ransomware virus has been infecting people’s computers and locking their files with powerful encryption and the cezor extension. This virus, dubbed Cezor after the extension of the locked files, is part of the STOP/DJVU family of viruses which has persistently been infecting computers for over six months now, finding victims all over the world. … Continued

Charm ransomware is a cryptovirus that once inside of the computer will encrypt personal files stored there and require a ransom in order to provide unique decryption key that can restore those files. It will automatically add a unique extension to the end of every encrypted file – if you had a file named “file.txt”, … Continued

ChinaYunLong ransomware virus is a particularly towering infection as hackers do not strike as very interested in the income from this project. Even by looking at the title of this infection you should be able to determine that it is mostly going to be delivered to people from China. Nevertheless, we have some suspicion that … Continued

CHIP crypto-ransomware has been identified with this name due to the extension that it gives to the encrypted data: .CHIP. RIG-E (Empire) Exploit Kit has been spotted to be exploited as a tool to poke security holes and spread malware. Exploit kits are applied on various web servers: their primary goal is to investigate visitors’ … Continued

When ClicoCrypter ransomware virus made its first appearance as a polish crypto-infection, it was primarily seen as a real threat to Internet society. However, it appears to have more to do with ShinoLocker malware which was mainly created for educational purposes; in this case, the recent malware takes its course as an examiner for the … Continued

Recently discovered Clop virus is a ransomware infection, that can encrypt all your personal files and ask for a ransom in return once it is inside of your computer. It’s not known how much you will be asked to pay – it can be anything from $100 to several thousands of dollars. Regardless of that, we … Continued

CloudSword is a name will be used to refer to a new ransomware infection. Many ransomware creators attempt to incorporate something original into their projects, and very frequently, the titles of such threats come from famous TV shows, some borrow names from Greek mythology or turn to comic books. This time, CloudSword is based on … Continued

CNAIPIC virus (Centro Nazionale Anticrime Information per la Protezione delle infrastrutture Ctriche virus) is one more ransomware that attacks computers located in Italy. It ‘s a program that blocks your computer and displays a false message on your screen warning that you have to pay a fine because of some illegal actions. Usually it blames … Continued

CobraLocker is a family of ransomware infections. It has a few variations, including Cobra, DaVinci, and LegionLocker. Like other ransomware, CobraLocker breaks files by encrypting them. It then asks victims to pay a ransom if they want to get their files back. About CobraLocker: Threat type Ransomware, trojan. How to recognize CobraLocker ransomware CobraLocker encrypts … Continued

Coharos Virus can be infiltrated into your computer out of nowhere. This would result in detrimental damage and you would probably find yourself in a situation that is very unfortunate because all of your personal files would be locked. As you can already guess, Coharos is classified as ransomware. It seems like the virus originates … Continued

Though Coin Locker ransomware is written in easily decryptable cipher, called Ceasar Cipher, it can cause you quite a headache. The title of this cipher comes from the actual Julius Caesar who encrypted messages by substituting each letter with another one a certain amount of places before or after it in the same alphabet. About … Continued

CoinVault is a dangerous ransomware that seeks to swindle money from users with infected computers. Once inside of a computer of victim, CoinVault will encrypt certain files. Usually it is .docx, .ppt, .txt, .crt, .jpeg, .gif, and .mp3 files. Immediately afterwards, a message about encrypted files will appear on the screen: Your personal documents and … Continued