Stampado is a ransomware kit written in AutoIt and sold cheaply on hacking forums from mid-2016. It encrypts files with AES-256 and renames them to end in .locked. Each buyer supplies an operator email, and later versions add a buyer-specific salt to the key. Free decryptors are the Stampado decryptor from Emsisoft and the Ransomware File Decryptor from Trend Micro. Targets were whoever individual buyers reached, mostly Windows home users. No data theft or leak site has been reported. Philadelphia, a later kit from the same author, shares its design.
Sources: In-house research
File extensions: .locked
Ransom note filenames: !STAMPADO_HOW_TO_DECRYPT.txt
Decryptor: A free decryptor is available. Checked 2026-11-05.
Data exfiltration risk: Low — Stampado is a cheaply sold AutoIt RaaS kit that threatens to delete a random encrypted file every six hours. It has no exfiltration capability.
Systems typically targeted: Local user directories, desktop items and mapped drives on individual Windows PCs.
Do this first: Terminate the malicious AutoIt process immediately, then run the free Emsisoft Stampado decrypter.
Link to decryptor: Emsisoft
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161