Ransomware Research

AnonCrack Ransomware

AnonCrack is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on October 1, 2017, this ransomware has been actively targeting systems worldwide.

Quick facts

Ransomware Family
AnonCrack
First Seen
October 1, 2017

How AnonCrack ransomware works

File modification behavior

AnonCrack updates file modification timestamps after encryption.

File encryption patterns

AnonCrack modifies encrypted files using specific patterns to mark them as encrypted:

Extensions added after encryption
  • .crack

Ransom note and payment demands

After encrypting files, AnonCrack displays ransom notes demanding payment for file recovery:

filePAGO.txt
notes/PAGO.txt

Location: Desktop

Technical indicators

Associated executable files

The following executable files are associated with AnonCrack ransomware:

  • Paypal Money Sender V2.0.exe
  • hidden tear based fake paypal app

About this analysis

This AnonCrack ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery, helping organizations defend against and recover from ransomware attacks like AnonCrack.

Last updated: February 24, 2023

Detection coverage

Elastio detects AnonCrack inside your data and backups.

The Hunt Engine uses Deep File Inspection to identify AnonCrack across live data, replicated data, and backups. If this family is in your environment, Elastio finds it before encryption completes. Run a hunt against your recovery points to confirm.