T1490: Inhibit System Recovery (Behaviorally blocking the deletion of backups)
Operational Executive Summary
T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups)) is classified under the Impact tactic within the MITRE ATT&CK framework. Techniques adversaries use to disrupt business operations, destroy system integrity, or manipulate critical availability, including high-speed ransomware encryption and disk wiping. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 150 distinct malware families, totaling over 16,063 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Inhibit System Recovery (Behaviorally blocking the deletion of backups) to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Inhibit System Recovery (Behaviorally blocking the deletion of backups), malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1490 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Inhibit System Recovery (Behaviorally blocking the deletion of backups) to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1490/.
Detection Engineering & Threat Hunting
Detecting Inhibit System Recovery (Behaviorally blocking the deletion of backups) requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups)) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Inhibit System Recovery (Behaviorally blocking the deletion of backups) across adjacent network segments.
Cataloged Malware Families Utilizing T1490 (150 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1490 (Inhibit System Recovery (Behaviorally blocking the deletion of backups)):
150 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| stop | Ransomware | 8,900 | STOP (universally recognized across consumer cybersecurity forums and threat feeds as STOP/Djvu) is the single most prevalent consumer ransomware family in cybe... |
| gandcrab | Ransomware | 2,992 | GandCrab is a landmark ransomware family that revolutionized the modern cyber extortion industry by pioneering and popularizing the Ransomware-as-a-Service (Raa... |
| cerber | Ransomware | 1,792 | Cerber is an influential, early Ransomware-as-a-Service (RaaS) operation that operated with immense commercial success between February 2016 and late 2017. Deve... |
| gandcrypt | Ransomware | 474 | Ransom:Win32/GandCrypt (widely cataloged across endpoint telemetry as Trojan-Ransom.Win32.GandCrypt, Ransom.GandCrab, or Win32/GandCrypt) is the Microsoft Defen... |
| black | Ransomware | 329 | Black (cataloged across threat telemetry as Ransom:Win32/Black, Ransomware.BlackMatter, and Trojan-Ransom.Win32.Black) is an aggressive double-extortion enterpr... |
| daws | Ransomware | 246 | TrojanDownloader:Win32/Daws (cataloged across security vendors as Trojan.Daws or Ransom.Daws) is a persistent Windows trojan downloader and stage-one ransomware... |
| hydracrypt | Ransomware | 180 | HydraCrypt is a destructive crypto-ransomware family that surfaced in early 2016, engineered directly from the leaked source code of the CrypBoss ransomware fam... |
| bsymem | Ransomware | 144 | Trojan:Win32/Bsymem (cataloged across vendor telemetry as Trojan.Bsymem or Ransom.Bsymem) is a stealthy dual-stage remote access backdoor and enterprise ransomw... |
| petya | Ransomware | 121 | Petya is one of the most historically destructive malware architectures ever deployed. Originally developed in early 2016 as a commercial ransomware strain by a... |
| sugar | Ransomware | 80 | Sugar (tracked across cybersecurity threat intelligence feeds under aliases including Sugar Ransomware, Encoded01, and Ransom.Encoded01) is a Delphi-based Ranso... |
| shade | Ransomware | 72 | Shade (also widely tracked in cyber threat intelligence feeds as Troldesh, Encoder.858, and Ransom:Win32/Shade) is a landmark ransomware family that terrorized ... |
| scarab | Ransomware | 57 | Scarab (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Scarab, Trojan-Ransom.Win32.Scarab, and Rans... |
| crytex | Ransomware | 52 | Crytex (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Crytex, Trojan-Ransom.Win32.Crysis, and Rans... |
| crysis | Ransomware | 24 | Ransomware:Win32/Crysis (widely tracked in subsequent major evolutionary variants as Dharma) is a prolific, destructive Ransomware-as-a-Service (RaaS) that emer... |
| blamon | Ransomware | 22 | Blamon (tracked across endpoint security telemetry under signatures Ransom:Win32/Blamon, Ransom:Win32/Blamon.A, and Trojan-Ransom.Win32.Blamon) is a destructive... |
| elzob | Ransomware | 22 | Elzob (identified in security research telemetry as Ransom:Win32/Elzob, Trojan-Ransom.Win32.Elzob, and Win32/Elzob) is an aggressive Windows ransomware family a... |
| krucky | Ransomware | 22 | Krucky (tracked in malware research telemetry under designations including Ransom:Win32/Krucky, Ransom:Win32/Krucky.A, and Trojan-Ransom.Win32.Krucky) is a dest... |
| matrix | Ransomware | 22 | Matrix (cataloged under signatures Ransom:Win32/Matrix, Trojan-Ransom.Win32.Matrix, and Win32/Matrix) is a sophisticated targeted ransomware family active since... |
| golroted | Ransomware | 21 | Golroted (classified across antimalware engines under designations including Ransom:Win32/Golroted, Trojan-Ransom.Win32.Golroted, and Win32/Golroted) is a destr... |
| pajetbin | Ransomware | 21 | Pajetbin (classified across threat telemetry as Ransom:Win32/Pajetbin, Trojan-Ransom.Win32.Pajetbin, and Win32/Pajetbin) is a destructive crypto-ransomware fami... |
| schoolboy | Ransomware | 21 | Schoolboy (identified in endpoint telemetry as Ransom:Win32/Schoolboy, Trojan-Ransom.Win32.Schoolboy, and Win32/Schoolboy) is a targeted crypto-ransomware famil... |
| tonmye | Ransomware | 21 | Tonmye (tracked across antimalware research as Ransom:Win32/Tonmye, Trojan-Ransom.Win32.Tonmye, and Win32/Tonmye) is a destructive crypto-ransomware family targ... |
| blihan | Ransomware | 20 | Blihan (classified in endpoint telemetry as Ransom:Win32/Blihan, Trojan-Ransom.Win32.Blihan, and Win32/Blihan) is an aggressive crypto-ransomware family designe... |
| pasta | Ransomware | 20 | Pasta (identified in antimalware telemetry under signatures Ransom:Win32/Pasta, Trojan-Ransom.Win32.Pasta, and Win32/Pasta) is an extortion crypto-ransomware fa... |
| qzonit | Ransomware | 20 | Qzonit (cataloged across global antimalware repositories under designations including Ransom:Win32/Qzonit, Trojan-Ransom.Win32.Qzonit, and Win32/Qzonit) is a ta... |
| wdjiange | Ransomware | 20 | Wdjiange (classified in threat research telemetry under signatures Ransom:Win32/Wdjiange, Trojan-Ransom.Win32.Wdjiange, and Win32/Wdjiange) is an aggressive Win... |
| crusis | Ransomware | 19 | Crusis (widely known in the cybersecurity community as the CrySiS or Dharma ransomware family and cataloged by Microsoft as Ransom:Win32/Crusis) is an infamous ... |
| jigsaw | Ransomware | 16 | Jigsaw (classified across cybersecurity organizations as Ransom:Win32/Jigsaw, Trojan-Ransom.Win32.Jigsaw, and BitcoinBlackmailer) is a notorious and psychologic... |
| xorist | Ransomware | 15 | Xorist (classified across the cybersecurity industry as Ransom:Win32/Xorist, Trojan-Ransom.Win32.Xorist, and Enigma/Xorist builder family) is a landmark, highly... |
| zerber | Ransomware | 13 | Ransomware:Win32/Zerber (a common misspelling or heuristic variant of **Cerber Ransomware**) was one of the most prolific, sophisticated, and financially succes... |
| crypren | Ransomware | 12 | Ransomware:Win32/Crypren is a destructive ransomware variant designed to infiltrate enterprise networks, encrypt critical user data and business databases, and ... |
| locky | Ransomware | 11 | Locky is one of the most prolific, damaging, and aggressively distributed ransomware strains in cyber history, first emerging in February 2016. Associated with ... |
| cryptos | Ransomware | 10 | Ransomware:Win32/Cryptos is a generic heuristic detection used by antivirus engines to identify early, varied, or obfuscated forms of encryption-based ransomwar... |
| teslacrypt | Ransomware | 9 | TeslaCrypt is a notorious ransomware family first detected in February 2015 that achieved widespread prominence by specifically targeting video gamers—encryptin... |
| bitman | Ransomware | 8 | Bitman (classified in antivirus detection telemetry under designations including Ransom:Win32/Bitman, Ransom.Win32.Bitman, and Win32/Bitman) is a crypto-ransomw... |
| cryakl | Ransomware | 8 | Ransom:Win32/Cryakl is a highly destructive, Russian-origin ransomware family first observed around 2014. It is designed to aggressively encrypt a wide range of... |
| datakeeper | Ransomware | 7 | Ransom:Win32/Datakeeper is a destructive ransomware family that targets both individual users and enterprise networks, utilizing strong cryptographic algorithms... |
| donex | Ransomware | 7 | Ransom:Win32/Donex is a destructive ransomware family that targets both individual users and enterprise networks, utilizing strong cryptographic algorithms to e... |
| hermes | Ransomware | 7 | Ransom:Win32/Hermes is a targeted, destructive ransomware strain first observed in early 2017 across Russian cybercrime underground forums. In October 2017, Her... |
| satwancrypt | Ransomware | 7 | Ransom:Win32/Satwancrypt is a destructive ransomware strain designed to infiltrate corporate networks, encrypt critical business data, and extort organizations ... |
| crypmodadv | Ransomware | 6 | Ransom:Win32/Crypmodadv is a generic detection for a class of highly destructive **Ransomware** and advanced Crypters. It is designed to aggressively infiltrate... |
| sagecrypt | Ransomware | 6 | Ransom:Win32/Sagecrypt (widely known as **Sage 2.0**) is a highly sophisticated ransomware family that gained prominence in 2017. It is notable for being heavil... |
| cryrar | Ransomware | 5 | Ransom:Win32/Cryrar is a severe threat classified as Ransomware. Uniquely, variants of this family (or families using similar techniques) often leverage legitim... |
| olympicdestroyer | Ransomware | 5 | Trojan:Win32/Olympicdestroyer (or simply **Olympic Destroyer**) is a highly sophisticated, destructive wiper malware deployed during the opening ceremony of the... |
| passcrypt | Ransomware | 5 | Ransom:Win32/Passcrypt (or Trojan:Win32/Passcrypt) is a severe threat generally classified as Ransomware or a destructive Password Stealer. It is designed to ex... |
| purga | Ransomware | 5 | Ransom:Win32/Purga (or Trojan:Win32/Purga) is a severe threat generally classified as Ransomware. It is designed to extort victims by strongly encrypting critic... |
| ranserkd | Ransomware | 5 | Ransom:Win32/Ranserkd is a highly destructive ransomware variant designed to systematically encrypt all valuable data on an infected endpoint or network share, ... |
| rantest | Ransomware | 5 | Ransom:Win32/Rantest is generally a heuristic classification for a test file, a proof-of-concept (PoC), or a benign simulator designed to mimic the behavior of ... |
| schwarzesonne | Ransomware | 5 | Ransom:Win32/Schwarzesonne (or Trojan:Win32/Schwarzesonne) is a severe threat generally classified as Ransomware or a highly destructive Trojan. It is designed ... |
| cryfile | Ransomware | 4 | Ransom:Win32/Cryfile is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, a... |
| cryptconsole | Ransomware | 4 | Ransom:Win32/Cryptconsole is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate da... |
| globeimposter | Ransomware | 4 | Ransom:Win32/Globeimposter is a highly prevalent, aggressive crypto-ransomware family that became notorious for its devastating attacks on healthcare organizati... |
| paradise | Ransomware | 4 | Ransom:Win32/Paradise is a prolific crypto-ransomware family operating under a Ransomware-as-a-Service (RaaS) model. It allows affiliates to distribute the malw... |
| polycrypt | Ransomware | 4 | Ransom:Win32/Polycrypt is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data,... |
| sigma | Ransomware | 4 | Ransom:Win32/Sigma is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, app... |
| spora | Ransomware | 4 | Ransom:Win32/Spora is widely regarded by threat analysts as one of the most sophisticated, 'professionally' developed crypto-ransomware families of its era. It ... |
| xdata | Ransomware | 4 | Ransom:Win32/Xdata is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, app... |
| crowti | Ransomware | 3 | Ransom:Win32/Crowti is Microsoft's internal detection designation for the infamous **CryptoWall** ransomware family. Emerging in the mid-2010s as a successor to... |
| deleter | Ransomware | 3 | Trojan:Win32/Deleter (often associated with Wiper malware) is a highly destructive trojan whose primary and singular objective is to permanently erase, corrupt,... |
| democry | Ransomware | 3 | Ransomware:Win32/Democry is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware variant... |
| myransom | Ransomware | 3 | Ransomware:Win32/Myransom is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware varian... |
| ransomkd | Ransomware | 3 | Ransom:Win32/Ransomkd is a generic heuristic detection used by antivirus engines to identify executables that exhibit behavior typical of **Cryptographic Ransom... |
| sage | Ransomware | 3 | Ransomware:Win32/Sage (specifically known as Sage 2.0) is a highly destructive crypto-ransomware family that gained significant notoriety in early 2017. A varia... |
| samsam | Ransomware | 3 | Ransom:Win32/SamSam (also known as Samas) is a highly destructive, **Targeted Ransomware** family that gained infamy for crippling hospitals, municipalities, an... |
| sigrun | Ransomware | 3 | Ransom:Win32/Sigrun is a highly destructive Cryptographic Ransomware family designed to extort money from victims by rendering their data inaccessible. Like mos... |
| thanatos | Ransomware | 3 | Ransom:Win32/Thanatos is a notorious **Cryptographic Ransomware** family, but it is infamous for a critical and catastrophic implementation flaw: it is effectiv... |
| tovicrypt | Ransomware | 3 | Ransomware:Win32/Tovicrypt is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware varia... |
| behav | Ransomware | 2 | Behav (classified in antivirus detection telemetry under designations including Ransom:Win32/Behav, Ransom.Win32.Behav, and Win32/Behav) is a crypto-ransomware ... |
| crypt0l0cker | Ransomware | 2 | Ransomware:Win32/Crypt0l0cker is a highly destructive ransomware variant, often considered a direct clone or spiritual successor to the original, infamous Crypt... |
| grandcrab | Ransomware | 2 | Ransomware:Win32/GandCrab (often detected as GrandCrab) is one of the most historically significant Ransomware-as-a-Service (RaaS) operations to ever exist. Act... |
| lockcrypt | Ransomware | 2 | Ransomware:Win32/Lockcrypt is a destructive ransomware family that encrypts user data and demands payment for the decryption key. Unlike 'spray-and-pray' ransom... |
| ranpax | Ransomware | 2 | Ransomware:Win32/Ranpax is a destructive cryptographic ransomware family. Upon execution, it systematically encrypts critical user data, business documents, dat... |
| redeye | Ransomware | 2 | Ransomware:Win32/Redeye is a destructive ransomware variant that encrypts user files and demands payment (usually in cryptocurrency) for the decryption key (`T1... |
| saturn | Ransomware | 2 | Ransomware:Win32/Saturn is a destructive crypto-ransomware family designed to extort organizations by encrypting critical data and demanding payment in cryptocu... |
| 27d3e5bc | Ransomware | 1 | 27D3E5Bc (classified in antivirus detection telemetry under designations including Ransom:Win32/27D3E5Bc, Ransom.Win32.27D3E5Bc, and Win32/27D3E5Bc) is a crypto... |
| adcrypterlib | Ransomware | 1 | Adcrypterlib (classified in antivirus detection telemetry under designations including Ransom:Win32/Adcrypterlib, Ransom.Win32.Adcrypterlib, and Win32/Adcrypter... |
| amber | Ransomware | 1 | Amber (classified in antivirus detection telemetry under designations including Ransom:Win32/Amber, Ransom.Win32.Amber, and Win32/Amber) is a crypto-ransomware ... |
| atom | Ransomware | 1 | Atom (classified in antivirus detection telemetry under designations including Ransom:Win32/Atom, Ransom.Win32.Atom, and Win32/Atom) is a crypto-ransomware desi... |
| badjoke | Ransomware | 1 | Badjoke (classified in antivirus detection telemetry under designations including Ransom:Win32/Badjoke, Ransom.Win32.Badjoke, and Win32/Badjoke) is a crypto-ran... |
| bansomqare | Ransomware | 1 | Bansomqare (classified in antivirus detection telemetry under designations including Ransom:Win32/Bansomqare, Ransom.Win32.Bansomqare, and Win32/Bansomqare) is ... |
| bitcovar | Ransomware | 1 | Bitcovar (classified in antivirus detection telemetry under designations including Ransom:Win32/Bitcovar, Ransom.Win32.Bitcovar, and Win32/Bitcovar) is a crypto... |
| blokrypt | Ransomware | 1 | Blokrypt (classified in antivirus detection telemetry under designations including Ransom:Win32/Blokrypt, Ransom.Win32.Blokrypt, and Win32/Blokrypt) is a crypto... |
| btcware | Ransomware | 1 | Btcware (classified in antivirus detection telemetry under designations including Ransom:Win32/Btcware, Ransom.Win32.Btcware, and Win32/Btcware) is a crypto-ran... |
| chimera | Ransomware | 1 | <h3>Executive Summary</h3> Chimera is a highly aggressive strain of enterprise ransomware that pioneered the "double extortion" tactic. It not only encrypts the... |
| cryptear | Ransomware | 1 | <h3>Executive Summary</h3> Cryptear is a variant of destructive Ransomware designed to infiltrate corporate networks, rapidly encrypt critical file systems, and... |
| cryptojoker | Ransomware | 1 | <h3>Executive Summary</h3> CryptoJoker is a highly destructive strain of file-encrypting Ransomware. It is designed to quickly infiltrate a system, encrypt all ... |
| cryptomix | Ransomware | 1 | Ransomware:Win32/Cryptomix is a well-known, historically significant ransomware family. Its primary objective is to encrypt the victim's files using strong cryp... |
| crypton | Ransomware | 1 | Ransom:Win32/Crypton is a destructive ransomware family that encrypts a victim's files and demands a cryptocurrency payment for the decryption key (`T1486`). Li... |
| cryptowall | Ransomware | 1 | CryptoWall is a family of file-encrypting ransomware analyzed by the Dell SecureWorks Counter Threat Unit (CTU). First analyzed in late February 2014 but distri... |
| cryptowire | Ransomware | 1 | <h3>Executive Summary</h3> Cryptowire is a variant of destructive Ransomware designed to infiltrate corporate networks, rapidly encrypt critical file systems, a... |
| cryptredol | Ransomware | 1 | Ransomware:Win32/Cryptredol is a destructive malware strain with a dual-impact payload: it functions primarily as ransomware, encrypting victim data (`T1486`), ... |
| cryptxxx | Ransomware | 1 | Ransom:Win32/Cryptxxx (also known as UltraCrypter) is a highly destructive, multi-faceted malware family. Unlike simple ransomware that only encrypts files, Cry... |
| diskscanfa | Advanced Threat | 1 | <h3>Executive Summary</h3> DiskScanFA is a classification for a specific family of Rogue Security Software, commonly referred to as "FakeAV" or "Scareware." It ... |
| e2f3f4d | Ransomware | 1 | <h3>Executive Summary</h3> "e2f3f4d" (and similar purely hexadecimal strings) represents a strict, static hash-based detection signature utilized by antivirus e... |
| eb149b | Ransomware | 1 | <h3>Executive Summary</h3> "Eb149b" is a generic detection identifier utilized by heuristic antivirus engines and endpoint protection platforms (EPP). It does n... |
| elite | Ransomware | 1 | <h3>Executive Summary</h3> Elite is a classification commonly associated with highly destructive ransomware variants (often adopting the "Elite" moniker in thei... |
| evillocker | Ransomware | 1 | <h3>Executive Summary</h3> EvilLocker is a highly destructive Ransomware family designed to extort financial payment from victims by encrypting their critical d... |
| fantom | Ransomware | 1 | <h3>Executive Summary</h3> Fantom is a highly deceptive Ransomware family that utilizes social engineering at the operating system level. It is designed to exto... |
| fastpc | Ransomware | 1 | <h3>Executive Summary</h3> FastPC (often branded under various iterations of "Fast PC Optimizer" or "PC Speedup") is a prevalent example of Rogue Security Softw... |
| flinject | Ransomware | 1 | <h3>Executive Summary</h3> FLInject (often flagged as Trojan.Inject or Injector.FLInject) is a specific, malicious utility designed solely to perform code injec... |
| genericrxbp | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxbp" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxdi | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxdi" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxed | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxed" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxeh | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxeh" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxex | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxex" is not a distinct malware family but a generic heuristic identifier utilized by various antivirus and endpoint protecti... |
| genericrxfh | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxfh" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxfp | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxfp" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxfs | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxfs" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| genericrxfu | Ransomware | 1 | <h3>Executive Summary</h3> "Genericrxfu" is an automated, heuristic detection identifier utilized by endpoint protection platforms (EPP) to flag highly suspicio... |
| grandcrap | Ransomware | 1 | <h3>Executive Summary</h3> Grandcrap (often a detection alias or misspelling of the highly notorious <strong>GandCrab</strong> ransomware family) represents a s... |
| jobcrypter | Ransomware | 1 | <h3>Executive Summary</h3> JobCrypter is a destructive Ransomware family designed to extort financial payment from victims by encrypting their critical data. It... |
| keyboarddisable | Ransomware | 1 | <h3>Executive Summary</h3> "KeyboardDisable" is not a fully-featured malware family, but rather a specific, malicious payload component or behavioral symptom of... |
| killall | Ransomware | 1 | <h3>Executive Summary</h3> KillAll is a classification for malicious scripts, utilities, or "HackTools" specifically designed to aggressively terminate running ... |
| killdisk | Wiper | 1 | Trojan:Win32/KillDisk is a catastrophic industrial wiper malware family developed and deployed by Russian military intelligence hackers belonging to the Russian... |
| kmsactivator | Ransomware | 1 | <h3>Executive Summary</h3> KMS Activator (often seen as AutoKMS or KMSpico) is a widely distributed "HackTool" designed to illegally bypass Microsoft's Key Mana... |
| krakencryptor | Ransomware | 1 | <h3>Executive Summary</h3> Kraken Cryptor (KrakenCryptor) is a sophisticated Ransomware-as-a-Service (RaaS) operation that encrypts victim data and demands paym... |
| kryptpck | Ransomware | 1 | <h3>Executive Summary</h3> Kryptpck (often a variant identifier for Cryptolocker-style ransomware or generic heavily packed ransomware) is a highly destructive ... |
| kryptyk | Ransomware | 1 | Ransomware:Win32/Kryptyk is a classification indicating the presence of a ransomware payload or a precursor trojan specifically designed to facilitate a ransomw... |
| lockyc | Ransomware | 1 | <h3>Executive Summary</h3> Lockyc (often detected as a direct variant or sophisticated copycat of the infamous Locky ransomware) is a highly destructive malware... |
| lucky | Ransomware | 1 | <h3>Executive Summary</h3> Lucky is a destructive Ransomware family, closely related to (and often considered a variant or evolution of) the notorious Satan ran... |
| milicry | Ransomware | 1 | <h3>Executive Summary</h3> Milicry is a destructive family of Ransomware designed to infiltrate Windows systems, rapidly encrypt valuable user data, and extort ... |
| obfusransom | Ransomware | 1 | Ransomware:Win32/Obfusransom is a highly critical, heuristic detection string utilized by antivirus engines (specifically Microsoft Defender) to flag a file tha... |
| payer | Ransomware | 1 | Ransom:Win32/Payer is a generic categorization applied to trojans that exhibit the unmistakable behavioral patterns of Ransomware or digital extortion (`T1486`)... |
| pckdflystudio | Ransomware | 1 | <h3>Executive Summary</h3> Pckdflystudio is a heuristic detection name indicating that an executable file has been compressed or obfuscated using FlyStudio, a k... |
| pycrypter | Ransomware | 1 | <h3>Executive Summary</h3> PyCrypter is a classification for file-encrypting Ransomware written entirely in Python. While traditionally ransomware was written i... |
| pyinstaller | Ransomware | 1 | <h3>Executive Summary</h3> PyInstaller is not malware. It is a highly popular, legitimate, open-source utility used by developers to bundle Python scripts and t... |
| ransim | Ransomware | 1 | <h3>Executive Summary</h3> RanSim (Ransomware Simulator) is technically a benign security testing tool designed by KnowBe4 to simulate ransomware behavior on en... |
| ransomheur | Ransomware | 1 | <h3>Executive Summary</h3> "RansomHeur" (short for Ransomware Heuristic) is a highly critical, generic detection signature utilized by advanced Endpoint Protect... |
| retribution | Ransomware | 1 | <h3>Executive Summary</h3> Retribution is a destructive family of Ransomware designed to infiltrate Windows systems, rapidly encrypt valuable user data, and ext... |
| saencrypt | Ransomware | 1 | <h3>Executive Summary</h3> SAEncrypt is a variant of destructive Ransomware designed to infiltrate corporate networks, exfiltrate sensitive data (in double-exto... |
| satana | Ransomware | 1 | <h3>Executive Summary</h3> Satana is a highly destructive, hybrid ransomware variant that combines traditional file encryption with the catastrophic capabilitie... |
| satancrypt | Ransomware | 1 | <h3>Executive Summary</h3> Satancrypt (often related to the "Satan" Ransomware-as-a-Service family) is a highly destructive strain of enterprise ransomware desi... |
| shezkrypt | Ransomware | 1 | <h3>Executive Summary</h3> Shezkrypt is a destructive ransomware and cryptor family designed to extort financial payment from victims by irreparably encrypting ... |
| shinolock | Ransomware | 1 | <h3>Executive Summary</h3> Shinolock is a variant of ransomware designed to extort financial payment from victims by encrypting their critical data and demandin... |
| sign0fmisery | Trojan | 1 | <h3>Executive Summary</h3> Sign0fmisery is a classification typically assigned to a specific HackTool or highly destructive Trojan framework. It is designed to ... |
| snocry | Ransomware | 1 | <h3>Executive Summary</h3> Snocry is a destructive ransomware family designed to extort financial payment from victims by encrypting their critical files and de... |
| snow | Ransomware | 1 | <h3>Executive Summary</h3> Snow (often associated with the Snow Ransomware family or a specific Trojan downloader) is a malicious threat designed to infiltrate ... |
| stampado | Ransomware | 1 | Ransom:Win32/Stampado is a notorious example of cheap 'Ransomware-as-a-Service' (RaaS). Unlike advanced ransomware families that demand massive payouts from cor... |
| trialkiller | Ransomware | 1 | <h3>Executive Summary</h3> TrialKiller (also known as a "Crack," "Keygen," or "Patcher") is classified as a HackTool. Its primary, stated purpose is software pi... |
| upackdam | Ransomware | 1 | <h3>Executive Summary</h3> Upackdam (or Upack) is a classification for a specific, aggressive executable packer/compressor used almost exclusively by malware de... |
| vortex | Ransomware | 1 | <h3>Executive Summary</h3> Vortex is a destructive family of Ransomware (closely related to or derived from the AES-NI ransomware family) designed to infiltrate... |
| wadhrama | Ransomware | 1 | <h3>Executive Summary</h3> Wadhrama is a sophisticated, highly disruptive variant of ransomware characterized by its use of robust encryption algorithms and its... |
| xxybsq | Ransomware | 1 | <h3>Executive Summary</h3> "Xxybsq" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). I... |
| xxybtw | Ransomware | 1 | <h3>Executive Summary</h3> "Xxybtw" is a generic detection identifier utilized by heuristic antivirus engines and endpoint protection platforms (EPP). It is not... |
| xxycbl | Ransomware | 1 | <h3>Executive Summary</h3> "Xxycbl" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). I... |
| xxycdl | Ransomware | 1 | <h3>Executive Summary</h3> "Xxycdl" is a generic detection identifier utilized by heuristic antivirus engines and endpoint protection platforms (EPP). It does n... |
| xxycec | Ransomware | 1 | <h3>Executive Summary</h3> "Xxycec" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). I... |
| xxycff | Ransomware | 1 | <h3>Executive Summary</h3> "Xxycff" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). I... |
| xxychs | Ransomware | 1 | <h3>Executive Summary</h3> "Xxychs" represents a generic threat identifier generated by heuristic analysis engines within endpoint protection platforms (EPP). I... |
| zepto | Ransomware | 1 | <h3>Executive Summary</h3> Zepto is a highly destructive ransomware variant that gained massive notoriety in mid-2016. It is a direct evolution (and effectively... |