T1486: Data Encrypted for Impact
Operational Executive Summary
T1486 (Data Encrypted for Impact) is classified under the Impact tactic within the MITRE ATT&CK framework. Techniques adversaries use to disrupt business operations, destroy system integrity, or manipulate critical availability, including high-speed ransomware encryption and disk wiping. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 171 distinct malware families, totaling over 24,188 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Data Encrypted for Impact to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Data Encrypted for Impact, malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1486 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Data Encrypted for Impact to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1486/.
Detection Engineering & Threat Hunting
Detecting Data Encrypted for Impact requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1486 (Data Encrypted for Impact) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Data Encrypted for Impact across adjacent network segments.
Cataloged Malware Families Utilizing T1486 (171 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1486 (Data Encrypted for Impact):
171 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| stop | Ransomware | 8,900 | STOP (universally recognized across consumer cybersecurity forums and threat feeds as STOP/Djvu) is the single most prevalent consumer ransomware family in cybe... |
| wannacry | Ransomware Worm | 4,876 | WannaCry (cataloged across security vendors and intelligence agencies as WanaCrypt0r, WCry, WannaCrypt, and Ransom.WannaCry) is an unprecedented global ransomwa... |
| virlock | Ransomware File Infector | 3,132 | VirLock (tracked in academic literature and threat databases as VirRansom) represents a historic and technically unique evolutionary milestone in malware engine... |
| gandcrab | Ransomware | 2,992 | GandCrab is a landmark ransomware family that revolutionized the modern cyber extortion industry by pioneering and popularizing the Ransomware-as-a-Service (Raa... |
| cerber | Ransomware | 1,792 | Cerber is an influential, early Ransomware-as-a-Service (RaaS) operation that operated with immense commercial success between February 2016 and late 2017. Deve... |
| gandcrypt | Ransomware | 474 | Ransom:Win32/GandCrypt (widely cataloged across endpoint telemetry as Trojan-Ransom.Win32.GandCrypt, Ransom.GandCrab, or Win32/GandCrypt) is the Microsoft Defen... |
| black | Ransomware | 329 | Black (cataloged across threat telemetry as Ransom:Win32/Black, Ransomware.BlackMatter, and Trojan-Ransom.Win32.Black) is an aggressive double-extortion enterpr... |
| daws | Ransomware | 246 | TrojanDownloader:Win32/Daws (cataloged across security vendors as Trojan.Daws or Ransom.Daws) is a persistent Windows trojan downloader and stage-one ransomware... |
| hydracrypt | Ransomware | 180 | HydraCrypt is a destructive crypto-ransomware family that surfaced in early 2016, engineered directly from the leaked source code of the CrypBoss ransomware fam... |
| bsymem | Ransomware | 144 | Trojan:Win32/Bsymem (cataloged across vendor telemetry as Trojan.Bsymem or Ransom.Bsymem) is a stealthy dual-stage remote access backdoor and enterprise ransomw... |
| archsms | Ransomware | 127 | ArchSMS (cataloged across security vendors under designations including Hoax.Win32.ArchSMS, Trojan-Ransom.Win32.ArchSMS, and Trojan:Win32/Archsms) is an infamou... |
| sugar | Ransomware | 80 | Sugar (tracked across cybersecurity threat intelligence feeds under aliases including Sugar Ransomware, Encoded01, and Ransom.Encoded01) is a Delphi-based Ranso... |
| shade | Ransomware | 72 | Shade (also widely tracked in cyber threat intelligence feeds as Troldesh, Encoder.858, and Ransom:Win32/Shade) is a landmark ransomware family that terrorized ... |
| scarab | Ransomware | 57 | Scarab (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Scarab, Trojan-Ransom.Win32.Scarab, and Rans... |
| crytex | Ransomware | 52 | Crytex (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Crytex, Trojan-Ransom.Win32.Crysis, and Rans... |
| crysis | Ransomware | 24 | Ransomware:Win32/Crysis (widely tracked in subsequent major evolutionary variants as Dharma) is a prolific, destructive Ransomware-as-a-Service (RaaS) that emer... |
| blamon | Ransomware | 22 | Blamon (tracked across endpoint security telemetry under signatures Ransom:Win32/Blamon, Ransom:Win32/Blamon.A, and Trojan-Ransom.Win32.Blamon) is a destructive... |
| elzob | Ransomware | 22 | Elzob (identified in security research telemetry as Ransom:Win32/Elzob, Trojan-Ransom.Win32.Elzob, and Win32/Elzob) is an aggressive Windows ransomware family a... |
| krucky | Ransomware | 22 | Krucky (tracked in malware research telemetry under designations including Ransom:Win32/Krucky, Ransom:Win32/Krucky.A, and Trojan-Ransom.Win32.Krucky) is a dest... |
| matrix | Ransomware | 22 | Matrix (cataloged under signatures Ransom:Win32/Matrix, Trojan-Ransom.Win32.Matrix, and Win32/Matrix) is a sophisticated targeted ransomware family active since... |
| golroted | Ransomware | 21 | Golroted (classified across antimalware engines under designations including Ransom:Win32/Golroted, Trojan-Ransom.Win32.Golroted, and Win32/Golroted) is a destr... |
| pajetbin | Ransomware | 21 | Pajetbin (classified across threat telemetry as Ransom:Win32/Pajetbin, Trojan-Ransom.Win32.Pajetbin, and Win32/Pajetbin) is a destructive crypto-ransomware fami... |
| schoolboy | Ransomware | 21 | Schoolboy (identified in endpoint telemetry as Ransom:Win32/Schoolboy, Trojan-Ransom.Win32.Schoolboy, and Win32/Schoolboy) is a targeted crypto-ransomware famil... |
| tonmye | Ransomware | 21 | Tonmye (tracked across antimalware research as Ransom:Win32/Tonmye, Trojan-Ransom.Win32.Tonmye, and Win32/Tonmye) is a destructive crypto-ransomware family targ... |
| blihan | Ransomware | 20 | Blihan (classified in endpoint telemetry as Ransom:Win32/Blihan, Trojan-Ransom.Win32.Blihan, and Win32/Blihan) is an aggressive crypto-ransomware family designe... |
| pasta | Ransomware | 20 | Pasta (identified in antimalware telemetry under signatures Ransom:Win32/Pasta, Trojan-Ransom.Win32.Pasta, and Win32/Pasta) is an extortion crypto-ransomware fa... |
| qzonit | Ransomware | 20 | Qzonit (cataloged across global antimalware repositories under designations including Ransom:Win32/Qzonit, Trojan-Ransom.Win32.Qzonit, and Win32/Qzonit) is a ta... |
| wdjiange | Ransomware | 20 | Wdjiange (classified in threat research telemetry under signatures Ransom:Win32/Wdjiange, Trojan-Ransom.Win32.Wdjiange, and Win32/Wdjiange) is an aggressive Win... |
| crusis | Ransomware | 19 | Crusis (widely known in the cybersecurity community as the CrySiS or Dharma ransomware family and cataloged by Microsoft as Ransom:Win32/Crusis) is an infamous ... |
| jigsaw | Ransomware | 16 | Jigsaw (classified across cybersecurity organizations as Ransom:Win32/Jigsaw, Trojan-Ransom.Win32.Jigsaw, and BitcoinBlackmailer) is a notorious and psychologic... |
| xorist | Ransomware | 15 | Xorist (classified across the cybersecurity industry as Ransom:Win32/Xorist, Trojan-Ransom.Win32.Xorist, and Enigma/Xorist builder family) is a landmark, highly... |
| enigma | Ransomware | 14 | Enigma (classified as Ransom:Win32/Enigma and Trojan-Ransom.Win32.Enigma) is an advanced Windows crypto-ransomware family designed for rapid and devastating cor... |
| troldesh | Ransomware | 14 | Troldesh (widely tracked across the intelligence community as Shade or Encrypter.JPHP) is a notorious Russian-speaking ransomware family first active in late 20... |
| vmpbad | Ransomware | 14 | Vmpbad (classified across antimalware research as Trojan:Win32/Vmpbad and Ransom:Win32/Vmpbad) is a heavily packed and armored trojan loader and crypto-ransomwa... |
| zerber | Ransomware | 13 | Ransomware:Win32/Zerber (a common misspelling or heuristic variant of **Cerber Ransomware**) was one of the most prolific, sophisticated, and financially succes... |
| crypren | Ransomware | 12 | Ransomware:Win32/Crypren is a destructive ransomware variant designed to infiltrate enterprise networks, encrypt critical user data and business databases, and ... |
| locky | Ransomware | 11 | Locky is one of the most prolific, damaging, and aggressively distributed ransomware strains in cyber history, first emerging in February 2016. Associated with ... |
| cryptolocker | Ransomware | 10 | CryptoLocker is the historic archetype of modern asymmetric ransomware, first discovered in September 2013. Engineered and operated under the criminal syndicate... |
| cryptos | Ransomware | 10 | Ransomware:Win32/Cryptos is a generic heuristic detection used by antivirus engines to identify early, varied, or obfuscated forms of encryption-based ransomwar... |
| trick | Ransomware | 10 | Trojan:Win32/Trick (universally known as **Trickbot**) is one of the most successful, devastating, and modular malware families in history. Originally emerging ... |
| cobalt | Ransomware | 9 | HackTool:Win32/Cobalt (universally known as **Cobalt Strike**) is technically a legitimate, commercial adversary simulation software (a 'Red Team' tool) created... |
| teslacrypt | Ransomware | 9 | TeslaCrypt is a notorious ransomware family first detected in February 2015 that achieved widespread prominence by specifically targeting video gamers—encryptin... |
| bitman | Ransomware | 8 | Bitman (classified in antivirus detection telemetry under designations including Ransom:Win32/Bitman, Ransom.Win32.Bitman, and Win32/Bitman) is a crypto-ransomw... |
| cryakl | Ransomware | 8 | Ransom:Win32/Cryakl is a highly destructive, Russian-origin ransomware family first observed around 2014. It is designed to aggressively encrypt a wide range of... |
| hiddentear | Ransomware | 8 | Ransom:Win32/Hiddentear is a highly significant ransomware family in cybersecurity history. Originally developed by a Turkish researcher in 2015 and released on... |
| datakeeper | Ransomware | 7 | Ransom:Win32/Datakeeper is a destructive ransomware family that targets both individual users and enterprise networks, utilizing strong cryptographic algorithms... |
| donex | Ransomware | 7 | Ransom:Win32/Donex is a destructive ransomware family that targets both individual users and enterprise networks, utilizing strong cryptographic algorithms to e... |
| hermes | Ransomware | 7 | Ransom:Win32/Hermes is a targeted, destructive ransomware strain first observed in early 2017 across Russian cybercrime underground forums. In October 2017, Her... |
| mbrlock | Ransomware | 7 | Ransom:Win32/Mbrlock represents a highly destructive class of ransomware known as **Bootlockers**. Unlike traditional file-encrypting ransomware that targets in... |
| mongolock | Ransomware | 7 | Ransom:Win32/Mongolock represents a highly specialized and devastating form of extortion that specifically targets unsecured, internet-exposed **MongoDB databas... |
| satwancrypt | Ransomware | 7 | Ransom:Win32/Satwancrypt is a destructive ransomware strain designed to infiltrate corporate networks, encrypt critical business data, and extort organizations ... |
| crypmodadv | Ransomware | 6 | Ransom:Win32/Crypmodadv is a generic detection for a class of highly destructive **Ransomware** and advanced Crypters. It is designed to aggressively infiltrate... |
| sagecrypt | Ransomware | 6 | Ransom:Win32/Sagecrypt (widely known as **Sage 2.0**) is a highly sophisticated ransomware family that gained prominence in 2017. It is notable for being heavil... |
| samas | Ransomware | 6 | Ransom:Win32/Samas (infamously known as **SamSam** or MSIL/Samas) is a highly destructive, targeted ransomware family that gained notoriety for crippling major ... |
| cryrar | Ransomware | 5 | Ransom:Win32/Cryrar is a severe threat classified as Ransomware. Uniquely, variants of this family (or families using similar techniques) often leverage legitim... |
| passcrypt | Ransomware | 5 | Ransom:Win32/Passcrypt (or Trojan:Win32/Passcrypt) is a severe threat generally classified as Ransomware or a destructive Password Stealer. It is designed to ex... |
| purga | Ransomware | 5 | Ransom:Win32/Purga (or Trojan:Win32/Purga) is a severe threat generally classified as Ransomware. It is designed to extort victims by strongly encrypting critic... |
| ranserkd | Ransomware | 5 | Ransom:Win32/Ranserkd is a highly destructive ransomware variant designed to systematically encrypt all valuable data on an infected endpoint or network share, ... |
| rantest | Ransomware | 5 | Ransom:Win32/Rantest is generally a heuristic classification for a test file, a proof-of-concept (PoC), or a benign simulator designed to mimic the behavior of ... |
| schwarzesonne | Ransomware | 5 | Ransom:Win32/Schwarzesonne (or Trojan:Win32/Schwarzesonne) is a severe threat generally classified as Ransomware or a highly destructive Trojan. It is designed ... |
| cryfile | Ransomware | 4 | Ransom:Win32/Cryfile is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, a... |
| cryptconsole | Ransomware | 4 | Ransom:Win32/Cryptconsole is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate da... |
| globeimposter | Ransomware | 4 | Ransom:Win32/Globeimposter is a highly prevalent, aggressive crypto-ransomware family that became notorious for its devastating attacks on healthcare organizati... |
| jigsawlocker | Ransomware | 4 | Ransom:Win32/Jigsawlocker (commonly known as Jigsaw) is an exceptionally cruel and psychologically manipulative crypto-ransomware family. Unlike standard ransom... |
| paradise | Ransomware | 4 | Ransom:Win32/Paradise is a prolific crypto-ransomware family operating under a Ransomware-as-a-Service (RaaS) model. It allows affiliates to distribute the malw... |
| polycrypt | Ransomware | 4 | Ransom:Win32/Polycrypt is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data,... |
| sigma | Ransomware | 4 | Ransom:Win32/Sigma is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, app... |
| spora | Ransomware | 4 | Ransom:Win32/Spora is widely regarded by threat analysts as one of the most sophisticated, 'professionally' developed crypto-ransomware families of its era. It ... |
| xdata | Ransomware | 4 | Ransom:Win32/Xdata is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, app... |
| crowti | Ransomware | 3 | Ransom:Win32/Crowti is Microsoft's internal detection designation for the infamous **CryptoWall** ransomware family. Emerging in the mid-2010s as a successor to... |
| democry | Ransomware | 3 | Ransomware:Win32/Democry is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware variant... |
| kaseya | Ransomware | 3 | HackTool:Win32/Kaseya (or related detections) does not refer to the Kaseya VSA software itself as being inherently malicious, but rather flags the abuse of this... |
| myransom | Ransomware | 3 | Ransomware:Win32/Myransom is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware varian... |
| ransomkd | Ransomware | 3 | Ransom:Win32/Ransomkd is a generic heuristic detection used by antivirus engines to identify executables that exhibit behavior typical of **Cryptographic Ransom... |
| sage | Ransomware | 3 | Ransomware:Win32/Sage (specifically known as Sage 2.0) is a highly destructive crypto-ransomware family that gained significant notoriety in early 2017. A varia... |
| samsam | Ransomware | 3 | Ransom:Win32/SamSam (also known as Samas) is a highly destructive, **Targeted Ransomware** family that gained infamy for crippling hospitals, municipalities, an... |
| sigrun | Ransomware | 3 | Ransom:Win32/Sigrun is a highly destructive Cryptographic Ransomware family designed to extort money from victims by rendering their data inaccessible. Like mos... |
| thanatos | Ransomware | 3 | Ransom:Win32/Thanatos is a notorious **Cryptographic Ransomware** family, but it is infamous for a critical and catastrophic implementation flaw: it is effectiv... |
| tovicrypt | Ransomware | 3 | Ransomware:Win32/Tovicrypt is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware varia... |
| vbcryptor | Ransomware | 3 | Ransomware:Win32/Vbcryptor is a broad detection name applied to various strains of ransomware, file encoders, and malicious crypters that are compiled using Mic... |
| crypt0l0cker | Ransomware | 2 | Ransomware:Win32/Crypt0l0cker is a highly destructive ransomware variant, often considered a direct clone or spiritual successor to the original, infamous Crypt... |
| grandcrab | Ransomware | 2 | Ransomware:Win32/GandCrab (often detected as GrandCrab) is one of the most historically significant Ransomware-as-a-Service (RaaS) operations to ever exist. Act... |
| hackav | Ransomware | 2 | Trojan:Win32/Hackav is a specific classification for utility malware designed with a singular, critical purpose: to impair, terminate, or completely uninstall l... |
| hiddentears | Ransomware | 2 | Ransomware:Win32/Hiddentears is a highly significant case study in malware history. It was originally released on GitHub in August 2015 by a Turkish programmer ... |
| lockcrypt | Ransomware | 2 | Ransomware:Win32/Lockcrypt is a destructive ransomware family that encrypts user data and demands payment for the decryption key. Unlike 'spray-and-pray' ransom... |
| metel | Trojan | 2 | Trojan:Win32/Metel (also known as Corkow) is a highly sophisticated, multi-stage Banking Trojan and APT-style framework that achieved massive notoriety in 2015 ... |
| ranpax | Ransomware | 2 | Ransomware:Win32/Ranpax is a destructive cryptographic ransomware family. Upon execution, it systematically encrypts critical user data, business documents, dat... |
| redeye | Ransomware | 2 | Ransomware:Win32/Redeye is a destructive ransomware variant that encrypts user files and demands payment (usually in cryptocurrency) for the decryption key (`T1... |
| saturn | Ransomware | 2 | Ransomware:Win32/Saturn is a destructive crypto-ransomware family designed to extort organizations by encrypting critical data and demanding payment in cryptocu... |
| 27d3e5bc | Ransomware | 1 | 27D3E5Bc (classified in antivirus detection telemetry under designations including Ransom:Win32/27D3E5Bc, Ransom.Win32.27D3E5Bc, and Win32/27D3E5Bc) is a crypto... |
| adcrypterlib | Ransomware | 1 | Adcrypterlib (classified in antivirus detection telemetry under designations including Ransom:Win32/Adcrypterlib, Ransom.Win32.Adcrypterlib, and Win32/Adcrypter... |
| amber | Ransomware | 1 | Amber (classified in antivirus detection telemetry under designations including Ransom:Win32/Amber, Ransom.Win32.Amber, and Win32/Amber) is a crypto-ransomware ... |
| amnesia | Ransomware | 1 | Amnesia (classified in antivirus detection telemetry under designations including Ransom:Win32/Amnesia, Ransom.Win32.Amnesia, and Win32/Amnesia) is a crypto-ran... |
| apocalypse | Ransomware | 1 | Apocalypse (classified in antivirus detection telemetry under designations including Ransom:Win32/Apocalypse, Ransom.Win32.Apocalypse, and Win32/Apocalypse) is ... |
| atom | Ransomware | 1 | Atom (classified in antivirus detection telemetry under designations including Ransom:Win32/Atom, Ransom.Win32.Atom, and Win32/Atom) is a crypto-ransomware desi... |
| badjoke | Ransomware | 1 | Badjoke (classified in antivirus detection telemetry under designations including Ransom:Win32/Badjoke, Ransom.Win32.Badjoke, and Win32/Badjoke) is a crypto-ran... |
| bansomqare | Ransomware | 1 | Bansomqare (classified in antivirus detection telemetry under designations including Ransom:Win32/Bansomqare, Ransom.Win32.Bansomqare, and Win32/Bansomqare) is ... |
| bitcovar | Ransomware | 1 | Bitcovar (classified in antivirus detection telemetry under designations including Ransom:Win32/Bitcovar, Ransom.Win32.Bitcovar, and Win32/Bitcovar) is a crypto... |
| blokrypt | Ransomware | 1 | Blokrypt (classified in antivirus detection telemetry under designations including Ransom:Win32/Blokrypt, Ransom.Win32.Blokrypt, and Win32/Blokrypt) is a crypto... |
| btcware | Ransomware | 1 | Btcware (classified in antivirus detection telemetry under designations including Ransom:Win32/Btcware, Ransom.Win32.Btcware, and Win32/Btcware) is a crypto-ran... |
| chimera | Ransomware | 1 | <h3>Executive Summary</h3> Chimera is a highly aggressive strain of enterprise ransomware that pioneered the "double extortion" tactic. It not only encrypts the... |
| cryptear | Ransomware | 1 | <h3>Executive Summary</h3> Cryptear is a variant of destructive Ransomware designed to infiltrate corporate networks, rapidly encrypt critical file systems, and... |
| cryptojoker | Ransomware | 1 | <h3>Executive Summary</h3> CryptoJoker is a highly destructive strain of file-encrypting Ransomware. It is designed to quickly infiltrate a system, encrypt all ... |
| cryptomix | Ransomware | 1 | Ransomware:Win32/Cryptomix is a well-known, historically significant ransomware family. Its primary objective is to encrypt the victim's files using strong cryp... |
| crypton | Ransomware | 1 | Ransom:Win32/Crypton is a destructive ransomware family that encrypts a victim's files and demands a cryptocurrency payment for the decryption key (`T1486`). Li... |
| cryptowall | Ransomware | 1 | CryptoWall is a family of file-encrypting ransomware analyzed by the Dell SecureWorks Counter Threat Unit (CTU). First analyzed in late February 2014 but distri... |
| cryptowire | Ransomware | 1 | <h3>Executive Summary</h3> Cryptowire is a variant of destructive Ransomware designed to infiltrate corporate networks, rapidly encrypt critical file systems, a... |
| cryptredol | Ransomware | 1 | Ransomware:Win32/Cryptredol is a destructive malware strain with a dual-impact payload: it functions primarily as ransomware, encrypting victim data (`T1486`), ... |
| cryptxxx | Ransomware | 1 | Ransom:Win32/Cryptxxx (also known as UltraCrypter) is a highly destructive, multi-faceted malware family. Unlike simple ransomware that only encrypts files, Cry... |
| e2f3f4d | Ransomware | 1 | <h3>Executive Summary</h3> "e2f3f4d" (and similar purely hexadecimal strings) represents a strict, static hash-based detection signature utilized by antivirus e... |
| eb149b | Ransomware | 1 | <h3>Executive Summary</h3> "Eb149b" is a generic detection identifier utilized by heuristic antivirus engines and endpoint protection platforms (EPP). It does n... |
| elite | Ransomware | 1 | <h3>Executive Summary</h3> Elite is a classification commonly associated with highly destructive ransomware variants (often adopting the "Elite" moniker in thei... |
| evillocker | Ransomware | 1 | <h3>Executive Summary</h3> EvilLocker is a highly destructive Ransomware family designed to extort financial payment from victims by encrypting their critical d... |
| fantom | Ransomware | 1 | <h3>Executive Summary</h3> Fantom is a highly deceptive Ransomware family that utilizes social engineering at the operating system level. It is designed to exto... |
| fastpc | Ransomware | 1 | <h3>Executive Summary</h3> FastPC (often branded under various iterations of "Fast PC Optimizer" or "PC Speedup") is a prevalent example of Rogue Security Softw... |
| flinject | Ransomware | 1 | <h3>Executive Summary</h3> FLInject (often flagged as Trojan.Inject or Injector.FLInject) is a specific, malicious utility designed solely to perform code injec... |
| fraudkrypt | Ransomware | 1 | Ransomware:Win32/Fraudkrypt is a malicious hybrid that blends the extortion tactics of Scareware with the destructive capability of Ransomware. Its primary obje... |
| genericrxbp | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxbp" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxdi | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxdi" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxed | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxed" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxeh | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxeh" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxet | Ransomware | 1 | <h3>Executive Summary</h3> Genericrxet is a heuristic identifier frequently used by security engines to flag generic Trojan or Ransomware behaviors. The "rxet" ... |
| genericrxex | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxex" is not a distinct malware family but a generic heuristic identifier utilized by various antivirus and endpoint protecti... |
| genericrxfh | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxfh" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxfp | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxfp" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxfs | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxfs" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxfu | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxfu" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| grandcrap | Ransomware | 1 | <h3>Executive Summary</h3> Grandcrap (often a detection alias or misspelling of the highly notorious <strong>GandCrab</strong> ransomware family) represents a s... |
| jobcrypter | Ransomware | 1 | <h3>Executive Summary</h3> JobCrypter is a destructive Ransomware family designed to extort financial payment from victims by encrypting their critical data. It... |
| keyboarddisable | Ransomware | 1 | <h3>Executive Summary</h3> "KeyboardDisable" is not a fully-featured malware family, but rather a specific, malicious payload component or behavioral symptom of... |
| killall | Ransomware | 1 | <h3>Executive Summary</h3> KillAll is a classification for malicious scripts, utilities, or "HackTools" specifically designed to aggressively terminate running ... |
| krakencryptor | Ransomware | 1 | <h3>Executive Summary</h3> Kraken Cryptor (KrakenCryptor) is a sophisticated Ransomware-as-a-Service (RaaS) operation that encrypts victim data and demands paym... |
| kryptpck | Ransomware | 1 | <h3>Executive Summary</h3> Kryptpck (often a variant identifier for Cryptolocker-style ransomware or generic heavily packed ransomware) is a highly destructive ... |
| kryptyk | Ransomware | 1 | Ransomware:Win32/Kryptyk is a classification indicating the presence of a ransomware payload or a precursor trojan specifically designed to facilitate a ransomw... |
| lockyc | Ransomware | 1 | <h3>Executive Summary</h3> Lockyc (often detected as a direct variant or sophisticated copycat of the infamous Locky ransomware) is a highly destructive malware... |
| lucky | Ransomware | 1 | <h3>Executive Summary</h3> Lucky is a destructive Ransomware family, closely related to (and often considered a variant or evolution of) the notorious Satan ran... |
| milicry | Ransomware | 1 | <h3>Executive Summary</h3> Milicry is a destructive family of Ransomware designed to infiltrate Windows systems, rapidly encrypt valuable user data, and extort ... |
| obfusransom | Ransomware | 1 | Ransomware:Win32/Obfusransom is a highly critical, heuristic detection string utilized by antivirus engines (specifically Microsoft Defender) to flag a file tha... |
| payer | Ransomware | 1 | Ransom:Win32/Payer is a generic categorization applied to trojans that exhibit the unmistakable behavioral patterns of Ransomware or digital extortion (`T1486`)... |
| pckdflystudio | Ransomware | 1 | <h3>Executive Summary</h3> Pckdflystudio is a heuristic detection name indicating that an executable file has been compressed or obfuscated using FlyStudio, a k... |
| pycrypter | Ransomware | 1 | <h3>Executive Summary</h3> PyCrypter is a classification for file-encrypting Ransomware written entirely in Python. While traditionally ransomware was written i... |
| pyinstaller | Ransomware | 1 | <h3>Executive Summary</h3> PyInstaller is not malware. It is a highly popular, legitimate, open-source utility used by developers to bundle Python scripts and t... |
| rakhni | Ransomware | 1 | <h3>Executive Summary</h3> Rakhni is a notorious and highly versatile malware family that originally emerged as Ransomware but evolved into a multifaceted threa... |
| ranion | Ransomware | 1 | <h3>Executive Summary</h3> Ranion is a Ransomware-as-a-Service (RaaS) platform that emerged on the dark web, offering cybercriminals a highly accessible, low-ba... |
| ransim | Ransomware | 1 | <h3>Executive Summary</h3> RanSim (Ransomware Simulator) is technically a benign security testing tool designed by KnowBe4 to simulate ransomware behavior on en... |
| ransomheur | Ransomware | 1 | <h3>Executive Summary</h3> "RansomHeur" (short for Ransomware Heuristic) is a highly critical, generic detection signature utilized by advanced Endpoint Protect... |
| retribution | Ransomware | 1 | <h3>Executive Summary</h3> Retribution is a destructive family of Ransomware designed to infiltrate Windows systems, rapidly encrypt valuable user data, and ext... |
| rostpay | Ransomware | 1 | <h3>Executive Summary</h3> Rostpay is a malicious Trojan that frequently exhibits destructive behavior, often operating as a "locker" ransomware or a data-wipin... |
| saencrypt | Ransomware | 1 | <h3>Executive Summary</h3> SAEncrypt is a variant of destructive Ransomware designed to infiltrate corporate networks, exfiltrate sensitive data (in double-exto... |
| satana | Ransomware | 1 | <h3>Executive Summary</h3> Satana is a highly destructive, hybrid ransomware variant that combines traditional file encryption with the catastrophic capabilitie... |
| satancrypt | Ransomware | 1 | <h3>Executive Summary</h3> Satancrypt (often related to the "Satan" Ransomware-as-a-Service family) is a highly destructive strain of enterprise ransomware desi... |
| screen | Ransomware | 1 | <h3>Executive Summary</h3> "Screen" (often categorized as ScreenLocker or Winlock) refers to a specific subclass of Ransomware that primarily aims to extort vic... |
| shezkrypt | Ransomware | 1 | <h3>Executive Summary</h3> Shezkrypt is a destructive ransomware and cryptor family designed to extort financial payment from victims by irreparably encrypting ... |
| shinolock | Ransomware | 1 | <h3>Executive Summary</h3> Shinolock is a variant of ransomware designed to extort financial payment from victims by encrypting their critical data and demandin... |
| snocry | Ransomware | 1 | <h3>Executive Summary</h3> Snocry is a destructive ransomware family designed to extort financial payment from victims by encrypting their critical files and de... |
| snow | Ransomware | 1 | <h3>Executive Summary</h3> Snow (often associated with the Snow Ransomware family or a specific Trojan downloader) is a malicious threat designed to infiltrate ... |
| stampado | Ransomware | 1 | Ransom:Win32/Stampado is a notorious example of cheap 'Ransomware-as-a-Service' (RaaS). Unlike advanced ransomware families that demand massive payouts from cor... |
| trialkiller | Ransomware | 1 | <h3>Executive Summary</h3> TrialKiller (also known as a "Crack," "Keygen," or "Patcher") is classified as a HackTool. Its primary, stated purpose is software pi... |
| upackdam | Ransomware | 1 | <h3>Executive Summary</h3> Upackdam (or Upack) is a classification for a specific, aggressive executable packer/compressor used almost exclusively by malware de... |
| urausy | Ransomware | 1 | Ransom:Win32/Urausy (also known as a 'Police Trojan') represents a massive, historical wave of screen-locking ransomware. Unlike modern crypto-ransomware that e... |
| vortex | Ransomware | 1 | <h3>Executive Summary</h3> Vortex is a destructive family of Ransomware (closely related to or derived from the AES-NI ransomware family) designed to infiltrate... |
| wadhrama | Ransomware | 1 | <h3>Executive Summary</h3> Wadhrama is a sophisticated, highly disruptive variant of ransomware characterized by its use of robust encryption algorithms and its... |
| wlock | Ransomware | 1 | <h3>Executive Summary</h3> Wlock is a destructive Ransomware variant (often functioning as a "Screen Locker"). Its primary objective is to extort money from the... |
| xxybsq | Ransomware | 1 | <h3>Executive Summary</h3> "Xxybsq" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). I... |
| xxybtw | Ransomware | 1 | <h3>Executive Summary</h3> "Xxybtw" is a generic detection identifier utilized by heuristic antivirus engines and endpoint protection platforms (EPP). It is not... |
| xxycbl | Ransomware | 1 | <h3>Executive Summary</h3> "Xxycbl" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). I... |
| xxycdl | Ransomware | 1 | <h3>Executive Summary</h3> "Xxycdl" is a generic detection identifier utilized by heuristic antivirus engines and endpoint protection platforms (EPP). It does n... |
| xxycec | Ransomware | 1 | <h3>Executive Summary</h3> "Xxycec" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). I... |
| xxycff | Ransomware | 1 | <h3>Executive Summary</h3> "Xxycff" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). I... |
| xxychs | Ransomware | 1 | <h3>Executive Summary</h3> "Xxychs" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). I... |
| zepto | Ransomware | 1 | <h3>Executive Summary</h3> Zepto is a highly destructive ransomware variant that gained massive notoriety in mid-2016. It is a direct evolution (and effectively... |