File extensions: .Skynet, .marlock011, .marlock03, .marlock04, .marlock10, .marlock20, .marlock22, .marlock95, .read, deadfiles, keversen, ntlock18, ReadInstruction, .1btc, .247_davidhasselhoff (number in the extension may differ based on the ransomware's variant), .AKO, .alienlock, .allock8 (the number may differ depending on the sample), .alock, .attack[number] (e.g., .attack7, etc. depending on the variant), .attackfiles, .attacknew1, .attacksystem, .attackuk, .BB, .bulock16, .bulock16 (digit may vary depending on the ransomware variant), .bulwark7 (number can vary depending on the ransomware's variant), .busavelock53 (the number in the extension can vary), .cipher
Ransom note filenames: how_to_back_files.html, HOW_TO_RECOVER_DATA.html, Recovery_Instructions.html, !-Recovery_Instructions-!.html, !!!HOW_TO_DECRYPT!!!.mht, How_to_back_files.txt, how_to_back.html, How_To_Recovery.txt, Instructions for decryption.txt, INSTRUCTIONS.html, readinstruction.html
Decryptor: Decryptor availability has not been recorded.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161