Resources
Ransomware file extension index
Every encrypted file extension we have catalogued, in alphabetical order, mapped to the ransomware family behind it and its decryptor status. Randomized extensions are listed as patterns.
157 extensions catalogued
a
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.abcd | LockBit | Some versions decryptable | View details |
.adobe | Crysis / Dharma | Some versions decryptable | View details |
.aki | Akira | Some versions decryptable | View details |
.akira | Akira | Some versions decryptable | View details |
.akiranew | Akira | Some versions decryptable | View details |
.anubis | Anubis | No public decryptor | View details |
.Aphrodite666 | GlobeImposter | Some versions decryptable | View details |
.Apollon666 | GlobeImposter | Some versions decryptable | View details |
.arena | Crysis / Dharma | Some versions decryptable | View details |
.Ares666 | GlobeImposter | Some versions decryptable | View details |
b
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.babuk | Babuk | Some versions decryptable | View details |
.babuk2 | Babuk | Some versions decryptable | View details |
.babyk | Babuk | Some versions decryptable | View details |
.backmydata | Phobos | Free decryptor available | View details |
.baseus | Makop | No public decryptor | View details |
.basta | Black Basta | Some versions decryptable | View details |
.baxia | BeijingCrypt | No public decryptor | View details |
.beijing | BeijingCrypt | No public decryptor | View details |
.bip | Crysis / Dharma | Some versions decryptable | View details |
.bitenc | Mallox | Some versions decryptable | View details |
.bixi | BeijingCrypt | No public decryptor | View details |
.bkp | Crysis / Dharma | Some versions decryptable | View details |
.brz | BrzCrypt | No public decryptor | View details |
c
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.C_L_O_P | Clop | Some versions decryptable | View details |
.C4H | GlobeImposter | Some versions decryptable | View details |
.cezar | Crysis / Dharma | Some versions decryptable | View details |
.chaos | Chaos | No public decryptor | View details |
.clop | Clop | Some versions decryptable | View details |
.combo | Crysis / Dharma | Some versions decryptable | View details |
.CONTI | Conti | Some versions decryptable | View details |
.crypt | GlobeImposter | Some versions decryptable | View details |
.CRYPT | Gunra | Some versions decryptable | View details |
d
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.devos | Phobos | Free decryptor available | View details |
.df_win | DragonForce | No public decryptor | View details |
.dharma | Crysis / Dharma | Some versions decryptable | View details |
.direwolf | DireWolf | No public decryptor | View details |
.djvu | STOP / Djvu | Some versions decryptable | View details |
.dlock | DeadLock | No public decryptor | View details |
.doydo | Babuk | Some versions decryptable | View details |
.Dragon4444 | GlobeImposter | Some versions decryptable | View details |
.dragonforce_encrypted | DragonForce | No public decryptor | View details |
e
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.eight | Phobos | Free decryptor available | View details |
.eking | Phobos | Free decryptor available | View details |
.elbie | Phobos | Free decryptor available | View details |
.enc | Mantax Otax | No public decryptor | View details |
.ENCRT | Gunra | Some versions decryptable | View details |
.everest | Everest | No public decryptor | View details |
.EVEREST | Everest | No public decryptor | View details |
f
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.FARGO3 | Mallox | Some versions decryptable | View details |
.faust | Phobos | Free decryptor available | View details |
.faust | Space Bears | Some versions decryptable | View details |
.fc | BeijingCrypt | No public decryptor | View details |
.file | BeijingCrypt | No public decryptor | View details |
.flex | BrzCrypt | No public decryptor | View details |
g
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.genesis | BeijingCrypt | No public decryptor | View details |
.gero | STOP / Djvu | Some versions decryptable | View details |
.GNRA | Gunra | Some versions decryptable | View details |
.goodLock | GoodLock | No public decryptor | View details |
h
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.halo | BeijingCrypt | No public decryptor | View details |
.harma | Crysis / Dharma | Some versions decryptable | View details |
.harmagedon | Makop | No public decryptor | View details |
.held | STOP / Djvu | Some versions decryptable | View details |
.help | Phobos | Free decryptor available | View details |
i
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.id[8位ID-4位].[联系邮箱].8base | 8Base | Free decryptor available | View details |
.id[8位ID-4位版本].[联系邮箱].faust | Space Bears | Some versions decryptable | View details |
.inc | INC Ransom | No public decryptor | View details |
.INC | INC Ransom | No public decryptor | View details |
.interlock | Interlock | No public decryptor | View details |
j
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.java | Crysis / Dharma | Some versions decryptable | View details |
k
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.kat6.l6st6r | GlobeImposter | Some versions decryptable | View details |
.KREMLIN | Conti | Some versions decryptable | View details |
.KRYBIT | KryBit | No public decryptor | View details |
l
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.LIZARD | Phobos | Free decryptor available | View details |
.lockbit | LockBit | Some versions decryptable | View details |
.lockbit3 | LockBit | Some versions decryptable | View details |
.locked | Hunters International | No public decryptor | View details |
.locked | JadePuffer | No public decryptor | View details |
.locked | TellYouThePass | No public decryptor | View details |
.locked（Linux / ESXi 变种） | Mallox | Some versions decryptable | View details |
.locked1 | TellYouThePass | No public decryptor | View details |
.lynx | Lynx | No public decryptor | View details |
.LYNX | Lynx | No public decryptor | View details |
m
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.ma1x0 | Mallox | Some versions decryptable | View details |
.makop | Makop | No public decryptor | View details |
.mallab | Mallox | Some versions decryptable | View details |
.mallox | Mallox | Some versions decryptable | View details |
.malloxx | Mallox | Some versions decryptable | View details |
.malox | Mallox | Some versions decryptable | View details |
.mammon | Makop | No public decryptor | View details |
.medusa | Medusa | No public decryptor | View details |
.MEDUSA | Medusa | No public decryptor | View details |
.mkp | Makop | No public decryptor | View details |
.moloch | Makop | No public decryptor | View details |
.montana | BeijingCrypt | No public decryptor | View details |
n
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.nspire | NightSpire | No public decryptor | View details |
o
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.oled | Makop | No public decryptor | View details |
.origami | Makop | No public decryptor | View details |
.Ox4444 | GlobeImposter | Some versions decryptable | View details |
p
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.payload | Payload | No public decryptor | View details |
.peng | Wmansvcs | Some versions decryptable | View details |
.phobos | Phobos | Free decryptor available | View details |
.play | Play | No public decryptor | View details |
.PLAY | Play | No public decryptor | View details |
.powerranges | Akira | Some versions decryptable | View details |
.PUTIN | Conti | Some versions decryptable | View details |
q
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.qilin | Qilin | No public decryptor | View details |
.qinglong | SnowSoul | Some versions decryptable | View details |
r
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.radman | STOP / Djvu | Some versions decryptable | View details |
.Rat4444 | GlobeImposter | Some versions decryptable | View details |
.rhysida | Rhysida | Some versions decryptable | View details |
.rox | Weaxor | No public decryptor | View details |
.roxaew | Weaxor | No public decryptor | View details |
.rumba | STOP / Djvu | Some versions decryptable | View details |
.RUSSIA | Conti | Some versions decryptable | View details |
s
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.safepay | SafePay | No public decryptor | View details |
.Snake4444 | GlobeImposter | Some versions decryptable | View details |
.snowsoul | SnowSoul | Some versions decryptable | View details |
.sorry | Sorry | No public decryptor | View details |
.sorry | TellYouThePass | No public decryptor | View details |
t
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.Tiger4444 | GlobeImposter | Some versions decryptable | View details |
.tomas | Makop | No public decryptor | View details |
u
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.umc16h | The Gentlemen | Some versions decryptable | View details |
w
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.wallet | Crysis / Dharma | Some versions decryptable | View details |
.wax | Weaxor | No public decryptor | View details |
.WCRY | WannaCry | Some versions decryptable | View details |
.weax | Weaxor | No public decryptor | View details |
.wman | Wmansvcs | Some versions decryptable | View details |
.WNCRY | WannaCry | Some versions decryptable | View details |
.WNCRYT | WannaCry | Some versions decryptable | View details |
.wxx | Weaxor | No public decryptor | View details |
x
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.xollam | Mallox | Some versions decryptable | View details |
z
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.Zeus666 | GlobeImposter | Some versions decryptable | View details |
#
| Extension | Family | Decryptor | Details |
|---|---|---|---|
.__NIST_K571__ | Babuk | Some versions decryptable | View details |
.(__{ID}__).(__{email}__).brz | BrzCrypt | No public decryptor | View details |
.(__{ID}__).(__{email}__).flex | BrzCrypt | No public decryptor | View details |
.[[设备ID]].[[攻击者邮箱]].wman | Wmansvcs | Some versions decryptable | View details |
.[16位随机字符] | LockBit | Some versions decryptable | View details |
.[4位小写字母随机后缀] | STOP / Djvu | Some versions decryptable | View details |
.[5-10位随机字符] | REvil | Free decryptor available | View details |
.[5位随机大写字母] | Conti | Some versions decryptable | View details |
.[5位随机大小写字母数字] | Conti | Some versions decryptable | View details |
.[5位随机字符（0-9 与 a-z）] | SnowSoul | Some versions decryptable | View details |
.[6位字符] | The Gentlemen | Some versions decryptable | View details |
.[6位随机字符] | RansomHub | No public decryptor | View details |
.[7位随机字符] | BlackCat | No public decryptor | View details |
.[8位随机字符] | Scattered LAPSUS$ Hunters | No public decryptor | View details |
.[9位随机字符] | DragonForce | No public decryptor | View details |
.[9位随机字符] | LockBit | Some versions decryptable | View details |
.[十六进制受害者ID].dlock | DeadLock | No public decryptor | View details |
.[受害者专属随机字符串] | Qilin | No public decryptor | View details |
.[随机字符] | Black Basta | Some versions decryptable | View details |
.1nt3rlock | Interlock | No public decryptor | View details |
.2700 | Phobos | Free decryptor available | View details |
.360 | BeijingCrypt | No public decryptor | View details |
.520 | BeijingCrypt | No public decryptor | View details |
.8base | 8Base | Free decryptor available | View details |
.8hmlsewu | M3RX | No public decryptor | View details |
Extension not listed?
Many families use randomized extensions or rebuild frequently, so no index can cover everything. Use the identification tool together with the ransom note, or contact an engineer for sample analysis.