Ransomware Research
16x Ransomware
16x is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on December 1, 2020, this ransomware has been actively targeting systems worldwide.
Quick Facts
- Ransomware Family
- 16x
- First Seen
- December 1, 2020
How 16x Ransomware Works
Targeted Files
Sample protected with Themida adc220109f73acdd307036a6d14bffa68103a48e2305c3a4f1533aab74d9deb8 -> doesn't encrypt files
File Encryption Patterns
16x modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..16xRansom Note and Payment Demands
After encrypting files, 16x displays ransom notes demanding payment for file recovery:
Ransom message:
notes/note.txt
Note locations:
OnceOnCompletionTechnical Indicators
Associated Executable Files
The following executable files are associated with 16x ransomware:
16x.bin.exe16x.exe
Elastio Can Help You
Don't let 16x ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This 16x ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like 16x.
Last updated: July 30, 2025