Search
Keyword: ransom.win32.cring
This crypto-ransomware speaks apart from dropping ransom notes. It determines the location (country) of the computer it infects, and avoids infecting computers found in certain countries. This Trojan
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This Ransomware arrives on a system
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It encrypts files with specific file extensions. It
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This Ransomware arrives on a system
\ns{random}.tmp\System.dll %User Profile%\System32\xfs-list of encrypted files {Drive Letter}:\README{number}.txt-serves as ransom note (Note: %User Temp% is the user's temporary folder, where it
execution. It encrypts files with specific file extensions. It encrypts files found in specific folders. It drops files as ransom note. Arrival Details This Ransomware arrives on a system as a file dropped by
Installation This Trojan drops the following files: (Folder of Encrypted Files}\OSIRIS-{Random Hex Values}.htm → Ransom Note It drops and executes the following files: %User Profile%\DesktopOSIRIS.bmp → Ransom
drops files as ransom note. Arrival Details This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Ransomware
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It deletes itself after execution. Arrival Details This
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This Trojan arrives on a system as a
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This Ransomware arrives on a system
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It deletes itself after execution. Arrival Details This
00 1D 00 00 00 1D E0 00 00 00 00 Other Details This Ransomware does the following: Displays the following window as ransom note: Ransomware Routine This Ransomware encrypts files found in the following
the following message as a ransom note: Lists all available drives on the system by executing the following command: %System%\cmd.exe /c Wmic Logicaldisk Where "DriveType=3" Get Name Ransomware Routine
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It drops files as ransom note. Arrival Details This
graphical interface that shows the ransom note in Russian: W32/Crypmodadv.XCV!tr (Fortinet); Trojan-Ransom.Win32.Telecrypt.a (Kaspersky); Dropped by other malware, Downloaded from the Internet Encrypts files,
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It deletes the initially executed copy of itself. It is
encrypts files in the following locations (including subfolders): %User Profile%\Pictures %User Profile%\Videos %User Profile%\Music %User Profile%\Desktop It also displays the following image as its ransom
This malware is related to the compromised blog page of the UK news media website, "The Independent." Users who visited the hacked page are redirected to sites
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It modifies the Internet Explorer Zone Settings. It