Angry Duck is ransomware-type virus that uses encryption with AES-512 cryptography. Virus is very weird because it demands huge ransom (10 BitCoins or $6500), however, authors do not provide any contacts or instructions to pay this ransom like e-mail or electronic wallet. But Angry Duck actually encrypts files and appends .adk extension to all affected ones. Usually, ransomware targets pictures, videos, documents and other types of personal files. Feedback shows, that hackers never or rarely send decryption keys or decryption tools after users pay them.
Thor is another variant of Locky ransomware that uses RSA-2048 and AES-128 encryption algorithms to encode files. Virus got its name because it adds .thor extension to all ciphered files. It also modifies filenames using random characters and numbers, so it becomes hard to distinguish files. Mostly malware affects user documents, pictures, videos, game files. Thor ransomware demands ransom of 3 BitCoins (~$1950). Ransomware creates 2 files: _WHAT_is.html and _WHAT_is.bmp. This files contain instructions for users to pay the ransom and get decryptor.
Shit ransomware is new virus from Locky family. Actually, it infects files using the same way - like previous variants, ransomware is installed using a DLL that is executed by Rundll32.exe. After execution it attacks files of 380 various file extension and encrypts them using AES encryption. After this it appends .shit extension to all encoded files and demands ransom of 3 BitCoins (~$1950). Ransomware creates 3 files: _WHAT_is.html, _[2_digit_number]_WHAT_is.html, and _WHAT_is.bmp. This files contain texts encouraging users to pay the ransom.
Odin ransomware is new cryptographic virus from family of Locky and Zepto ransomware. It uses system process (rundll32.exe) to execute and encrypt user files. Usually, infection affects user personal files such as documents, photos, videos and music. In this version virus adds .odin extension and modifies filename, changing it to random set of numbers and letters. Virus creates 3 files: _5_HOWDO_text.html, _HOWDO_text.bmp, and _HOWDO_text.html. Image file is used as desktop background and contains text with instructions to pay the ransom.
JohnyCryptor is wide-spread ransomware virus, that uses AES encryption to encrypt important files (documents, photos, e-mails, music, video, gaming files). Virus adds .johnycryptor@aol.com.xtbl or .johnycryptor@hackermail.com.xtbl extension to encrypted files (depending on version), and creates "How to decrypt your files.txt" file on the desktop. This file contains instructions to pay the ransom and get the decryptor. Users have to pay from 0.5 to 1.5 ($250-$700) BitCoins to get the decryptor.
