The main purpose of peachtrackereu[.]com is to promote a potentially unwanted application (PUA), a VPN client that will supposedly protect users' devices. There are two main reasons not to trust such web pages: users often do not visit them intentionally and, once visited, most display fake vir
God is a malicious program, which is part of the VoidCrypt ransomware family. Systems infected with this malware have their data encrypted and users receive ransom demands for decryption. During the encryption process, files are renamed following this pattern: original filename, cyber criminals'
Blackheel encrypts files (and modifies their filenames), changes desktop wallpaper, and creates the "READ_ME.txt" file (ransom message). It renames files by appending ".a" as the extension. For example, "1.jpg" would be renamed to "1.jpg.a", "2.jpg" to "2.jpg.a", and so on. Note that Blackheel ra
"Emails Sync Failure" is a spam email campaign. The term "spam campaign" refers to a mass-scale operation, during which deceptive emails are sent by the thousand. The messages sent through this campaign are disguised as notifications concerning undelivered emails. The purpose of this scam is to t
Discovered by GrujaRS, Epsilon is a ransomware-type program. This malware is designed to encrypt the data of infected systems in order to demand payment for decryption. When Epsilon encrypts, all affected files are renamed following this pattern: original filename, cyber criminals' email address,
The ActiveToken application functions as adware (generates advertisements) and as a browser hijacker (changes browser settings without users' permission). It is likely that ActiveToken will also gather certain information. Note that, in most cases, users download and install adware/browser hija
ConsoleProgram is an untrusted app, which is classified as adware. As well as running intrusive advertisement campaigns (i.e. delivering various unwanted ads), this application also operates like a browser hijacker. I.e., ConsoleProgram modifies browser settings to promote fake search engines.
Dis is designed to encrypt files, modify the filenames of all encrypted files, display a pop-up window, and create the "FILES ENCRYPTED.txt" file. It renames encrypted files by adding the victim's ID, decrypt@disroot.org email address, and appending the ".dis" extension to filenames. For example,
ExtendedMode is an adware-type application, which possesses certain characteristics of browser hijackers. Following successful infiltration, this app delivers intrusive advertisement campaigns and makes modifications to browser settings to promote fake search engines. Additionally, most adware-
Wbxd belongs to the Djvu ransomware family. It encrypts files and modifies their filenames by appending the ".wbxd" extension. For example, after encryption, "1.jpg" would be renamed to "1.jpg.wbxd", "2.jpg" to "2.jpg.wbxd", and so on. This ransomware also creates a ransom message ("_readme.txt"