Crypto ransomware by extensions

Crypto ransomware is a category of ransomware viruses, which, apart from demanding the certain ransom payment, has file-encrypting capabilities. Thus, this type of viruses is also referred to as crypto-malware or crypto-viruses. The ransom is asked for the decryption of the encrypted data, which is to be transferred using the anonymous cryptocurrency, typically,- Bitcoins. The data files are locked and made unreadable after the encryption carried out by the crypto program, which is embedded in a data encryption mechanism. Accordingly, crypto viruses are also called crypto-lockers or file-lockers. They can act as screen lockers, preventing victims from accessing their computers or simply change the desktop background with the image of the ransom note. Crypto-malware is developed to target individual users, as well as computer networks belonging to huge corporations. This type of cyber threats is classified among the most dangerous viruses, since their developers typically employ elaborate data encryption mechanisms, which can even stay unpacked by the most experienced engineers in the field. Consequently, cyber criminals can make huge profits.

Most of the crypto-lockers can be identified by the specific filename extensions they append to the encrypted files. Usually, it is an additional extension added to the original name of the file and its extension. These extensions can be simple and be comprised of a short combination of characters or stand up as a simple phrase or a word. Often times they bear the title after which the crypto program itself has been named. However, some of these malicious extensions can even contain contact e-mails, the specific identification number of the infection, the BTC payment address, a string of random characters, etc. as additional assets.

However, not every crypto-malware has been designed to use a particular extension, appended to the encrypted files. There are such crypto ransomware coders, who, by chasing the glory of the most successful crypto-viruses, develop file-encrypting programs, adding the copied extensions to the aimed at files to falsify the infection of another crypto virus. There are also such crypto-lockers in the wild, which, instead of targeting the special file types, encrypt and lock the full disk. Other file-locking applications do not rename the encrypted files to make the corrupted data unavailable to be recognized by looking in the title. Thus, even though the extension appended may be a valuable indicator of the certain ransomware compromise, you cannot use it as the only identification mark of the particular crypto-ransomware infection or it is simple not present.

If you have any suggestions about crypto ransomware extensions leave a comment below.