Ransomware Research
Jigsaw Ransomware
Jigsaw is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on November 1, 2017, this ransomware has been actively targeting systems worldwide.
Quick Facts
- Ransomware Family
- Jigsaw
- First Seen
- November 1, 2017
How Jigsaw Ransomware Works
Targeted Files
fdfb72874c3c1761475cbc23a51cbe422d09c8b6dcbdfb93f936adb56f23bcf5 - 100% working sample
File Encryption Patterns
Jigsaw modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..####CONTACT_US_pablukl0cker638yzhgr@2tor.com####
..FUCKMEDADDY
..CryptWalker
..LOCKED_by_pablukl0cker_ransomware!
..LOCKED_BY_pablukl0cker
..#
..justice
..locked
..contact-me-here-for-the-key-admin@adsoleware.com
..Bitconnect
..jes
..email-[powerhacker03@hotmail.com].koreaGame
..fun
..onion
..LolSec
..booknish
..choda
..coder007@protonmail.com
..##___POLICJA!!!___TEN_PLIK_ZOSTA
..black007
..invaded
..tedcrypt
..hacked.by.Snaiparul
..lockedgood
..pleaseCallQQ
..#__EnCrYpTED_BY_dzikusssT3AM_ransomware!__#
..FuckedByGhost
..data
..venom
..YOLO
..paycoin
..LOCKED_PAY
..exe
..zemblax
..btc
..homer
..evil
..cat
..HYDRA
..pennywise
..v315
..hac
..PAY
..zapium
Ransom Note and Payment Demands
After encrypting files, Jigsaw displays ransom notes demanding payment for file recovery:
Address.txt
Ransom message:
notes/Address.txt
Note locations:
Desktop
Ransom message:
notes/note.txt
Note locations:
OnceOnCompletion
Technical Indicators
Associated Executable Files
The following executable files are associated with Jigsaw ransomware:
LoL VIP RP HACK 4.0.exe
MicrosoftWordUpdate.exe
BIG DADDY COCK.exe
BitcoinBlackMailer.exe
ACCOUNTDETAILS.EXE
Ransome.exe
Google Chrome.exe
a.exe
mada.exe
Setup_install.exe
Genel Maliyetler.exe
Firefox.exe
firefox.exe
Xbox-One-Mod-Menu.exe
JigsawRansomware.exe
Carlos Matos.exe
GetFacebookPasswordV2.exe
Chrome.exe
BitcoinBlackmailer.exe
jigsaw_encrypted.exe
tool pour lobby.exe
BitcoinStealer.exe
invoice.exe
19000818.exe
acrord32.exe
ApophisRansomware.exe
drpbx.exe
ween.exe
ween ransomware.exe
svchost.exe
초다 랜섬웨어.exe
Jigsaw_choda Ransomware.exe
v2.exe
JIGSAW_DZIALAJACY!!!-.exe
NaziEdit.exe
BitcoinGenerator.exe
Mic.exe
net.exe
Ghost.exe
molotov.exe
OscarRansomware.exe
Oscar Ransomware.exe
Chrome_Installer.exe
Jigsaw.exe
EMAIL_CRACKER.EXE
zzzzz.exe
Isass.exe
isass.exe
firefox.rar
Invert.exe
Dolf.exe
java.exe
Chrome32.exe
Elastio Can Help You
Don't let Jigsaw ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This Jigsaw ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like Jigsaw.
Last updated: July 30, 2025