As we all know Ransomware is currently one of the biggest threat to any organisation and therefore we must understand how a ransomware works and its digital footprint. Every application when executed leaves a footprint on the system and sometimes we call them dropper. A footprint for Microsoft word is filename.doc for example.
Similarly, when ranswomware is executed it will leave certain files and have following extensions and files :
@Please_Read_Me@
@WanaDecryptor@
*.wnry
*.*cry
*.*crypto
*.crptrg
*.*darkness
*.*enc*
*.*exx
*.*kb15
*.*kraken
*.*locked
*.*nochance
*.*obleep
*.*oshit
*.0x0
*.1999
*.73i87A
*.7z.encrypted
*.aaa
*.abc
*.AES256
*.better_call_saul
*.bleep
*.btc
*.BTC
*.btcbtcbtc
*.cbf
*.ccc
*.cerber
*.chifrator@qq_com
*.clf
*.coverton
*.crime
*.crinf
*.crjoker
*.cry
*.crypt
*.crypted
*.crypto
*.crypto*
*.cryptolocker
*.cryptotorlocker*
*.CryptoTorLocker2015!
*.CrySiS
*.ctb2
*.CTB2
*.ctbl
*.ctbl
*.CTBL
*.czvxce
*.darkness
*.doc
*.dyatel@qq_com
*.ecc
*.enc
*.encedRSA
*.enciphered
*.EnCiPhErEd
*.Encrypted
*.encrypted*
*.encryptedAES
*.encryptedRSA
*.enigma
*.exx
*.exte
*.ezz
*.frtrss
*.fucked
*.fun
*.FUN
*.good
*.gruzin@qq_com
*.gsw
*.gws
*.GWS
*.ha3
*.HA3
*.hb15
*.helpdecrypt@ukr*.net
*.html
*.hydracrypt*
*.JUST
*.justbtcwillhelpyou
*.kb15
*.keybtc@inbox_com
*.kimcilware
*.KKK
*.kraken
*.lechiffre
*.LeChiffre
*.locked
*.locky
*.lol!
*.LOL!
*.magic
*.micro
*.mp3
*.nalog@qq_com
*.nochance
*.omg!
*.OMG!
*.oplata@qq_com
*.oshit
*.p5tkjw
*.pizda@qq_com
*.PoAr2w
*.pr0tect
*.pzdc
*.r16m*
*.R16M01D05
*.R5A
*.r5a
*.RADAMANT
*.rapid
*.rdm
*.RDM
*.relock@qq_com
*.remind
*.rokku
*.rrk
*.RRK
*.sanction
*.saturn
*.scarab
*.sport
*.supercrypt
*.SUPERCRYPT
*.surprise
*.toxcrypt
*.troyancoder@qq_com
*.ttt
*.vault
*.vvv
*.xort
*.xrnt
*.XRNT
*.xrtn
*.xtbl
*.XTBL
*.xxx
*.xyz
*.zzz
*@gmail_com_*
*@india.com*
*_H_e_l_p_RECOVER_INSTRUCTIONS*
*_LAST
*cpyt*
*crypt*
*decipher*
*help_restore*.*
*help_your_files*.*
*how_to_recover*.*
*install_tor*.*
*keemail.me*
*qq_com*
*restore_fi*.*
*ukr.net*
*want your files back.*
_crypt
_DECRYPT_INFO_*
_ryp
AllFilesAreLocked*.bmp
ATTENTION!!!.txt
confirmation.key
Decrypt.exe
DECRYPT_INSTRUCTION.HTML
DECRYPT_INSTRUCTION.TXT
DECRYPT_INSTRUCTIONS.HTML
DECRYPT_INSTRUCTIONS.TXT
DecryptAllFiles*.txt
DecryptAllFiles.txt
enc_files.txt
HELP_DECRYPT.HTML
HELP_DECRYPT.lnk
HELP_DECRYPT.PNG
HELP_DECRYPT.TXT
HELP_RESTORE_FILES.txt
HELP_TO_DECRYPT_YOUR_FILES.txt
HELP_TO_SAVE_FILES.txt
how to decrypt aes files.lnk
How_Decrypt.html
How_Decrypt.txt
HowDecrypt.txt
last_chance.txt
message.txt
MESSAGE.txt
oor*.
recovery_file.txt
recovery_key.txt
RECOVERY_KEY.TXT
restore_files*.txt
restore_files.txt
vault.hta
vault.key
vault.txt
*.canihelpyou
*.zepto
*.venusf
Recently updated WannaCry and SOREBRECT ransomware extensions.
Courtesy Bleeping Computer and kinomakino.
The extensions can be used during Hunting phase or timeline analysis where analysts are looking for suspicious/malicious files on a host. Further information can be found here.
Happy Hunting!!!
