DeroHE is malicious software classified as ransomware. Systems infected with this malware have their data encrypted and users receive ransom demands for decryption. During the encryption process, all affected files are appended with the ".DeroHE" extension. For example, a file originally named so
Websites such as purplemedia[.]biz are not often visited by users intentionally. In most cases, they are opened by other dubious websites, deceptive ads, or installed potentially unwanted applications (PUAs). More examples of web pages similar to purplemedia[.]biz are fast2captcha[.]com, mynicepo
The main purpose of peachtrackereu[.]com is to promote a potentially unwanted application (PUA), a VPN client that will supposedly protect users' devices. There are two main reasons not to trust such web pages: users often do not visit them intentionally and, once visited, most display fake vir
God is a malicious program, which is part of the VoidCrypt ransomware family. Systems infected with this malware have their data encrypted and users receive ransom demands for decryption. During the encryption process, files are renamed following this pattern: original filename, cyber criminals'
Blackheel encrypts files (and modifies their filenames), changes desktop wallpaper, and creates the "READ_ME.txt" file (ransom message). It renames files by appending ".a" as the extension. For example, "1.jpg" would be renamed to "1.jpg.a", "2.jpg" to "2.jpg.a", and so on. Note that Blackheel ra
"Emails Sync Failure" is a spam email campaign. The term "spam campaign" refers to a mass-scale operation, during which deceptive emails are sent by the thousand. The messages sent through this campaign are disguised as notifications concerning undelivered emails. The purpose of this scam is to t
Discovered by GrujaRS, Epsilon is a ransomware-type program. This malware is designed to encrypt the data of infected systems in order to demand payment for decryption. When Epsilon encrypts, all affected files are renamed following this pattern: original filename, cyber criminals' email address,
The ActiveToken application functions as adware (generates advertisements) and as a browser hijacker (changes browser settings without users' permission). It is likely that ActiveToken will also gather certain information. Note that, in most cases, users download and install adware/browser hija
ConsoleProgram is an untrusted app, which is classified as adware. As well as running intrusive advertisement campaigns (i.e. delivering various unwanted ads), this application also operates like a browser hijacker. I.e., ConsoleProgram modifies browser settings to promote fake search engines.
Dis is designed to encrypt files, modify the filenames of all encrypted files, display a pop-up window, and create the "FILES ENCRYPTED.txt" file. It renames encrypted files by adding the victim's ID, decrypt@disroot.org email address, and appending the ".dis" extension to filenames. For example,