Ransomware Research
Adfuhbazi Ransomware
Adfuhbazi is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on May 1, 2023, this ransomware has been actively targeting systems worldwide.
Quick Facts
- Ransomware Family
- Adfuhbazi
- First Seen
- May 1, 2023
How Adfuhbazi Ransomware Works
File Encryption Patterns
Adfuhbazi modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..adfuhbaziRansom Note and Payment Demands
After encrypting files, Adfuhbazi displays ransom notes demanding payment for file recovery:
HOW TO RESTORE YOUR ADFUHBAZI FILES.TXTRansom message:
notes/HOW TO RESTORE YOUR ADFUHBAZI FILES.TXT
Note locations:
EveryFolderTechnical Indicators
Associated Executable Files
The following executable files are associated with Adfuhbazi ransomware:
keqd.exe
Elastio Can Help You
Don't let Adfuhbazi ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This Adfuhbazi ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like Adfuhbazi.
Last updated: July 30, 2025