GridinSoft Threat Intelligence

Ransom detection reports

Ransomware families and files associated with encryption or extortion workflows.

Detection category

Ransom threat reports

Ransomware families and files associated with encryption or extortion workflows. ThreatInfo groups these records so analysts and users can review related filenames, hashes, and GridinSoft detection names from one place.

This category page groups related ThreatInfo records so users can compare file names, hashes, publishers, and GridinSoft detection names in one place.

Indexed reports 1,897

Latest shown 60

Detected 60

Observed detection families

Common Ransom verdicts

These are the most frequent GridinSoft detection names in the latest reports shown below. Repeated families help users recognize whether a file belongs to a broader campaign or bundled software cluster.

Ransom.Wacatac 8 reports

Ransom.Exp 6 reports

Ransom.Locky 4 reports

Ransom.Zpevdo 4 reports

Trojan.Agent 4 reports

Trojan.Packed 4 reports

Ransom.Gandcrab 3 reports

Trojan.Downloader 3 reports

Analyst focus

What to check first

Use this page as a starting point: open the exact file report, compare the MD5 hash, and run a local scan before deciding whether the file is safe.

A known filename appearing with an unexpected hash or location.
Publisher, product, or certificate data that does not match the file origin.
Repeated detections from the same family across recent reports.

Frequent metadata

Publishers and products

Publishers WinZip Computing, S.L. 4 Accmeware Corporation 2 Axialis Software 2 Carifred 2 4t Niagara Software 1 Ai4rei/AN 1

Products WinZip 4 FLAC to MP3 Converter 2 Tech tool store 2 4t Tray Minimizer 1 AvengersBox 1 Axialis IconWorkshop 1

GridinSoft Anti-Malware

Scan for Ransom detections

If a file from this category appears on your computer, verify the exact report and run a full system scan. GridinSoft Anti-Malware is used to detect and remove threats listed in ThreatInfo reports.

Download scanner

01 Match the hash

Use the MD5 value from the report. A filename alone is not enough because unrelated files can share the same name.

02 Review origin

Check the publisher, product name, certificate, and file path for mismatches or unfamiliar install locations.

03 Scan and remove

If the file is unexpected, scan the device and remove related startup entries, bundled components, and leftover files.

Recent reports

Latest Ransom file records

MediaImpression Slideshow.scr 55a0ab4f4d83edf1ce85a3cdd33f0444 Ransom.Gen 7f7ccaa16fb15eb1c7399d422f8363e8.exe 7f7ccaa16fb15eb1c7399d422f8363e8 Ransom.Ransom konboot_usb.exe eb9e6531d9eacdbe5474da9d6b73d99e Ransom.Gandcrab mssecsvc.exe.quarantined 478abb44dbba06e87decd2df49f3d986 Ransom.WannaCrypt JkDefragScreenSaver.scr c115ac21da61965c5ecf203772e0777f Trojan.DelShad mssecsvc.exe.quarantined 3d3b7e106612cc5086ef3e8aff697829 Trojan.WannaCrypt Fishdom Screensaver.scr d0d92aad1f57ebbe62375f2c3acbd1cf Trojan.Agent lnsciqwb.exe 98a8ced05b34189b8b36760049b2ea36 Ransom.Blocker AlcorMP.exe 6aa3d81dcd255b51d9f850f7b246c6c1 General Threat WINZIP32.EXE 0f33994b64d1e030591babe1cb065e75 Hijack.Explorer winzip32.exe 10f94491c0c518e34d01c7edf67242ec Trojan.Packed TechToolStore.exe fc443782dc6fa513de4a8f47ffe7d50c PUP.Gen WZIMGV32.DLL a2e978f5baf367befb197f2f6c0e48b6 Trojan.Packed TechToolStore64.exe be2e8a1ee7555c374d87360f5d323d00 PUP.Gen FLAC to MP3 Converter.exe 22fb51966774b6ea15617b02e3326ec6 Ransom.Locky 4t-min64.exe 7bc3aeedc18717d796f1c7ff8dbf0c17 Ransom.Locky loaderX2.exe c84e22d07f28fed6e366df5ba4383c7a Ransom.Samas ResGer.dll 3ad96cb4e7d547882f605daeb2f380bf Ransom.Locky winsvc.exe 60236fe463e180272b98cf8f93208a80 Trojan.Agent Setup-Ro.exe b634e46e3ed42aef63135b218446025e Ransom.Somhoveran FLAC to MP3 Converter.exe 11e95cabdbbf61aec35de512575960ce Ransom.Locky autoit.exe c16f18cab7067f293a530c7201670820 Trojan.Downloader voices.exe c6805aa45d706d5d2f969f04a3bfb112 Trojan.Downloader winsvcs.exe f4926ebd721231a04ccc053ba19b9ace Trojan.Kryptik 137301276840840.exe eff37e44093c0252f5cbca55cb25d590 Trojan.Injector CorelDRAW 2018.exe b1f0a6b2ddfc9f8442251dc91519dff1 Ransom.Skeeyah updatewin1.exe 716fc1f9d0a342fe97c70576cb84beda Ransom.STOP updatewin2.exe 778e0745b1d5e85e0141d390b4bc5783 Ransom.STOP b7277c74036338509e63aa2de0d418c3.zip b7277c74036338509e63aa2de0d418c3 Ransom.Zpevdo d098e97c79759b1a9d3df996ca2a4c91.zip d098e97c79759b1a9d3df996ca2a4c91 Ransom.Zpevdo 476fb3d64691c70eb889b0f145bd3a4b.zip 476fb3d64691c70eb889b0f145bd3a4b Ransom.Zpevdo csrss.exe 1813bf05214e48b41f1107c7404cb6dd General Threat tyav32u.dll cdff43108b834c4147575f02bd3876dd Ransom.Gandcrab winzip32.exe 40d673b7dcaa0a0850a30ba33b5a5142 Trojan.Packed clean1.exe 6fbe881f1d6480e2e15d3ebe0f493d2d Ransom.Occamy USB.Protection.&.Recovery-1.3.exe f99bfddac9cb3be6465347635c295975 Ransom.Presenoker Insaniquarium.scr 32cdbc9e95342182db48567c457642e7 Ransom.Sabsik 1f1affdcb7b7175e077b359abc7bbb4e.zip 1f1affdcb7b7175e077b359abc7bbb4e Ransom.Zpevdo DeviceManager.exe.quarantined c9d7b4f352a2362d676c850dc923f662 Ransom.Gandcrab d.exe 784f97b2fe3e5570a9af2b9f7370a23e Trojan.Wacatac New Year Fireplace.scr e0da4d3631ce221d90946dd6af05eeb1 Trojan.Heur! runw.exe 5829c81cf9565b4ebf6c36c17e9161d4 Trojan.Agent BrLogRx64.exe 12fe3811706db2c140f79501cc41d00d Ransom.Exp mongodump.exe 0535f7307efc8a47f99afc4bc0341072 Ransom.Exp mongorestore.exe bd078dc4a27c5259b15b1bd463b8b911 Ransom.Exp maketx.exe 246793998f9f27e061d20498c782c63f Ransom.Exp Avengers.exe 1784fd66059ff3ee715231c6f775d6fc Ransom.Wacatac check_windrvr6.exe 63b515bebf54f1e9701f1f90f8f11883 Ransom.Exp RecorderHD64.dll 0fd10af1971a2ad2196ffcd240cf4c12 Ransom.Wacatac FAHScreensaver.scr 451dabf61a47b9d124a39d6ef29faa46 RansomWin32.Gen winboxscan.exe ba8b9279e1468697d6ce6bcbe6c70f0a Ransom.Wacatac 9186.tmp.exe 02e00de4670422f074fb74a7ed8517b9 Trojan.Packed seed.exe 299fa0349b3e2536a9d40d95674cfa96 Ransom.Wacatac 360zip.sfx c0dc3ea79dab77df4e5cc8dde00b210c Ransom.Wacatac 5.exe a7ffc700eca3323c9bbe5aa9bd15f759 Ransom.Wacatac AntamediaInternetCaffe5211.exe 2345643c490b5fbb5c3b69cfaa5244d7 Ransom.Exp svchost.exe 61c33d015983d06570ff7f7300c551e2 Ransom.Wacatac updatewin1.exe 4a7f0327b2ea4fdd6e2c5d1f439094dc Trojan.Downloader csrss.exe a59b6178979a69c35e1d97b7bba77fb2 Ransom.Wacatac main.exe.dat aa126c647ff357f8798cd6e5762b55da Trojan.Agent

Questions

Ransom FAQ

How should I use this category page?

Use it to find recent reports in the same detection family, then open the exact file report and compare the hash, publisher, path, and detection name.

Why can the same filename have different verdicts?

Attackers and bundlers often reuse common filenames, so the MD5 hash and metadata are more reliable than the name alone.

What should I do if a listed file exists on my device?

Do not rely on the filename only. Verify the hash, review the file location, and run a full system scan before keeping or removing it.