Ransomware Variant Library
A comprehensive library of known ransomware families and their behaviors. Continuously updated to provide visibility into attacker techniques and to strengthen Elastio’s zero-day detection and recovery assurance.
Quick Filter
Showing 50 of 2633 ransomware entries
| Name | Aliases | First Seen | File Extensions |
|---|---|---|---|
| $$$ | LokerAdmin | 2/1/2020 | .$$$.texyz.8NWm8Y |
| $ucyLocker | VapeHacksLoader | 6/1/2017 | .WINDOWS |
| 010001 | — | 10/1/2018 | .010001 |
| 05250lock | NuBe | 1/1/2020 | /\.[a-z]{4,5}$/ |
| 0XXX | — | 6/1/2021 | .0xxx |
| 0kilobypt | — | 3/1/2016 | .CRYPT.cr.val+2 |
| 0mega | — | 5/1/2022 | .0mega |
| 1337 | — | 11/1/2023 | .1337 |
| 1337-Locker | — | 5/1/2017 | .adr |
| 16x | — | 12/1/2020 | .16x |
| 2000USD | — | 6/1/2024 | .2000USD |
| 2023 | — | 10/1/2023 | .2023 |
| 20dfs | aksx | 6/1/2020 | .20dfs.aksx.crypt |
| 24H | — | 7/1/2018 | .24H |
| 2700 | — | 1/1/2024 | .2700 |
| 2QZ3 | — | 7/1/2023 | .2QZ3 |
| 3000USDAA | — | 1/1/2024 | .3000USDAA |
| 32aa | — | 10/1/2020 | .32aa |
| 3301 | — | 8/1/2017 | .3301 |
| 34678 | — | 10/1/2023 | .34678 |
| 360 | — | 3/1/2022 | .360 |
| 3AM | Three-AM-time, 3AM Doxware | 9/1/2023 | .threeamtime |
| 3nCRY | — | 9/1/2017 | .3nCRY |
| 4rw5w | — | 5/1/2017 | .4rwcry4w |
| 5ss5c | 5ss5cCrypt, DBGer | 1/1/2020 | .5ss5c.dbger |
| 64-Random-HEX | — | 11/1/2020 | /\.[A-F0-9]{64}$/ |
| 6y8dghklp | — | 9/1/2023 | .6y8dghklp |
| 725 | — | 1/1/2023 | .725 |
| 726 | — | 2/1/2023 | ..726 |
| 777 | Legion (Seven Legion) | 9/1/2015 | .777.legion |
| 777-2024 | — | 4/1/2024 | .777 |
| 7B Rage | — | 3/1/2025 | .zay |
| 7ev3n | — | 1/1/2016 | .R5A.R4A |
| 7ev3n-HONE$T | — | 4/1/2016 | .R5A |
| 7h9r | — | 6/1/2016 | .7h9r |
| 7z Portuguese | — | 6/1/2017 | .7z |
| 7zipper | — | 1/1/2017 | .7zipper |
| 8base | — | 6/1/2023 | .8base |
| 8lock8 | — | 4/1/2016 | .8lock8 |
| 9062 | — | 6/1/2025 | .9062 |
| AAC | — | 7/1/2017 | .aac |
| ABCLocker | — | 7/1/2017 | — |
| ACCDFISA | ACCDFISA v2.0, Anti-Porn Locker +1 more | 4/1/2012 | .aes |
| ADMON | — | 5/1/2023 | .ADMON |
| AES-Matrix | — | 8/1/2017 | — |
| AES-NI | — | 6/1/2017 | .lock.aes256 |
| AES-NI: April Edition | AES-NI : April Edition, SPECIAL VERSION: NSA EXPLOIT EDITION | 4/1/2017 | .aes_ni.aes_ni_0day |
| AESMew | AESMewLocker | 9/1/2020 | .locked |
| AES_KEY_GEN_ASSIST | — | 12/1/2016 | .pre_alpha |
| AIR | — | 7/1/2025 | .AIR |