Blackheel encrypts files (and modifies their filenames), changes desktop wallpaper, and creates the "READ_ME.txt" file (ransom message). It renames files by appending ".a" as the extension. For example, "1.jpg" would be renamed to "1.jpg.a", "2.jpg" to "2.jpg.a", and so on. Note that Blackheel ra
"Emails Sync Failure" is a spam email campaign. The term "spam campaign" refers to a mass-scale operation, during which deceptive emails are sent by the thousand. The messages sent through this campaign are disguised as notifications concerning undelivered emails. The purpose of this scam is to t
Discovered by GrujaRS, Epsilon is a ransomware-type program. This malware is designed to encrypt the data of infected systems in order to demand payment for decryption. When Epsilon encrypts, all affected files are renamed following this pattern: original filename, cyber criminals' email address,
The ActiveToken application functions as adware (generates advertisements) and as a browser hijacker (changes browser settings without users' permission). It is likely that ActiveToken will also gather certain information. Note that, in most cases, users download and install adware/browser hija
ConsoleProgram is an untrusted app, which is classified as adware. As well as running intrusive advertisement campaigns (i.e. delivering various unwanted ads), this application also operates like a browser hijacker. I.e., ConsoleProgram modifies browser settings to promote fake search engines.
Dis is designed to encrypt files, modify the filenames of all encrypted files, display a pop-up window, and create the "FILES ENCRYPTED.txt" file. It renames encrypted files by adding the victim's ID, decrypt@disroot.org email address, and appending the ".dis" extension to filenames. For example,
ExtendedMode is an adware-type application, which possesses certain characteristics of browser hijackers. Following successful infiltration, this app delivers intrusive advertisement campaigns and makes modifications to browser settings to promote fake search engines. Additionally, most adware-
Wbxd belongs to the Djvu ransomware family. It encrypts files and modifies their filenames by appending the ".wbxd" extension. For example, after encryption, "1.jpg" would be renamed to "1.jpg.wbxd", "2.jpg" to "2.jpg.wbxd", and so on. This ransomware also creates a ransom message ("_readme.txt"
SkillApplication generates unwanted ads, changes browser settings, and possibly collects browsing-related and/or other data. Therefore, this app is classified not only as adware but also as a browser hijacker. In most cases, users download and install these apps inadvertently and, therefore, Sk
LiveRadioSearch promotes liveradiosearch.com, a fake search engine. Like most apps of this type, LiveRadioSearch achieves this by changing browser settings without users' permission. Furthermore, this app gathers browsing-related data. People often download and install browser hijackers inadvert