InsaneCrypt is a 2018 Windows ransomware, a variant of the desuCrypt family, that appends an email address in brackets plus .insane to every encrypted file, in the form .[insane[@]airmail[.]cc].insane. A text note named How_decrypt_files.txt is written to each folder holding encrypted files and only tells the victim to write to that address. It runs in a visible console window while it works, skips Windows and program-data folders, looks for attached external drives and deletes shadow copies. A free decrypter for the .insane variant is published, so do not pay; hold on to the locked files and note, clean the machine first, then have a responder run the tool on copies. Later builds of the same family use other bracketed extensions, so check the exact suffix before relying on it. GusCrypter is a later strain that code comparison links to InsaneCrypt and has its own page.
Sources: Trend Micro, SonicWall
File extensions: .[insane[@]airmail[.]cc].insane
Ransom note filenames: How_decrypt_files.txt
Decryptor: A decryptor is reported to exist, but we do not link to it. Checked 2026-10-30.
Sources: InsaneCrypt/DeusCrypt Decrypter (BleepingComputer)
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161