Willow encrypts files and appends the ".willow" extension to their filenames. For example, it renames "1.jpg" to "1.jpg.willow", "2.jpg" to "2.jpg.willow", and so on. It also changes the desktop wallpaper and creates the "READMEPLEASE.txt" file. Screenshot of a message encouraging users to pay
News-cofade[.]cc asks for permission to show notifications and redirects visitors to untrustworthy websites. There are lots of pages like news-cofade[.]cc on the Internet, for example, totalcoolblog[.]com, ukndaspiratioty[.]xyz, and freegiveawaystodayonly[.]com. Users do not visit them intentional
Rugj ransomware belongs to a family of ransomware called Djvu. This variant encrypts files and appends the ".rugj" extension to their filenames. For example, it renames "1.jpg" file to "1.jpg.rugj", "2.jpg" file to "2.jpg.rugj", and so on. Rugj also generates a ransom note, the "_readme.txt" file.
Totalcoolblog[.]com loads its content to get permission to deliver notifications and redirects visitors to various questionable web pages. This page gets opened through other dubious sites, advertisements, and (or) potentially unwanted applications (PUAs). Either way, it is unlikely that totalcool
WhiteHorse ransomware is a type of malware that encrypts files, modifies their filenames, and creates the "#Decrypt#.txt" file (a ransom note). It renames files by appending ".WhiteHorse" extension to their filenames. For example, it renames "1.jpg" to "1.jpg.WhiteHorse", "2.jpg" to "2.jpg.WhiteHo
Ukndaspiratioty[.]xyz has two purposes: get permission to show notifications and open questionable pages. A couple of examples of other pages like ukndaspiratioty[.]xyz are romantic-dates[.]top, music-home[.]info, and mateyhecrie[.]xyz. It is very uncommon for these pages to be opened/visited on p
Wanacry is a type of malware that encrypts files, appends the ".wanacry" extension to filenames. For example, it renames a file named "1.jpg" to "1.jpg.wanacry", "sample.jpg" to "sample.jpg.wanacry". Wanacry also creates a ransom note (the "HELP_DECRYPT_YOUR_FILES.txt" file). Screenshot of a m
Freegiveawaystodayonly[.]com has the same qualities as fastdatingroom[.]top, getlastnews[.]com, music-home[.]info, and plenty of other pages. It is designed to ask for permission to show notifications and redirect users to shady web pages. Most users end up on pages like freegiveawaystodayonly[.]c
Lsas belongs to the ransomware family called Dharma. It encrypts and renames files. For example, it renames "1.jpg" to "1.jpg.id-1E857D00.[sekurlsa@ml1.net].lsas", "2.jpg" to "2.jpg.id-1E857D00.[sekurlsa@ml1.net].lsas" (it appends the victim's ID, sekurlsa@ml1.net email address and the ".lsas" ext
Fastdatingroom[.]top redirects visitors to questionable websites. It also asks for permission to show notifications. Websites like fastdatingroom[.]top usually get visited accidentally, for example, through shady advertisements, other dubious pages. These sites can be opened by potentially unwante