Files Encrypted

The .encrypted extension is more generic since it is used by several types of known ransomware to include Crypt0L0cker (TorrentLocker), MedusaLocker, Roll Safe, Apocalypse (Esmeralda), CryptoWire, CryptoLite, Crypren, MauriGo, Smrss32, Globe2, HugeMe, RansomPlus and KeRanger OS X Ransomware. The .encrypted extension is also used by many unidentified ransomwares.

The only way to identify the different ransomwares that use a "generic extension" is the ransom note (including it's name and contents), samples of the encrypted files, possible filemarkers, the malware file itself responsible for the infection and information related to any email addresses OR hyperlinks provided by the cyber-criminals to request payment.

You can submit (upload) samples of encrypted files, ransom notes and any contact email addresses or hyperlinks provided by the malware developer to ID Ransomware (IDR) OR Emsisoft Identify your ransomware for assistance with identification and confirmation of the infection. This is a service that helps identify what ransomware may have encrypted your files, whether it is decryptable and then attempts to direct you to an appropriate support topic where you can seek further assistance. ID Ransomware can identify ransomwares which adds a prefix instead of an extension and more accurately ransomwares by filemarkers IF APPLICABLE. Uploading both encrypted files and ransom notes together along with any contact email addresses or hyperlinks provided by the criminals gives a more positive match with identification and helps to avoid false detections.

There are all kinds of ransomware using the extension .encrypted....