Magniber is a Windows ransomware strain aimed mostly at consumers and students. Every infection uses its own random extension of letters, such as .gtearevf, and leaves README.html in each folder with a link to a Tor payment portal. Builds have arrived as fake Windows 10 update MSI files, fake browser update APPX packages and, in late 2022, JavaScript files posing as security upgrades. Windows 10 and 11 desktops are the targets. Before encrypting, it bypasses UAC through fodhelper.exe, removes shadow copies and disables Windows recovery. No data theft or leak site is tied to it.
File extensions: .aaovsto, .abtkkmr, .adaxhycds, .ajyasmedl, .akhlextj, .aksxyur, .anyxahef.glmyaopcr, .apgfaicep, .aseribm, .asrmqrlq, .awmfzyi, .axhwimuu, .axlgsbrms, .bbersgae, .bbltuzloh, .bdpxlnurb, .beqcerma, .bgnkeirlw, .bicdzxf, .bilrxxtb, .biqwysf, .bvvtyxrrq, .bxmkqnwuy, .cjziuvtfn, .ckvqdjy, .cojymfvs, .cwmnocoq, .czqlxnrz, .damdzv, .dbbyzwv
Decryptor: A free decryptor is available.
Sources: No More Ransom
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161