- Home
- Detectable Ransomware
- Radamant
Ransomware Research
Radamant Ransomware
Radamant is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on January 1, 2016, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: Radamant 1.0, 2.0, 2.1.
Quick Facts
- Ransomware Family
- Radamant
- First Seen
- January 1, 2016
- Known Aliases
- Radamant 1.0, 2.0, 2.1
How Radamant Ransomware Works
Targeted Files
Requires C&C https://www.hybrid-analysis.com/sample/e5e5ab14273251fda563f69735c12d36f9817fd526ef0dc46c233a52e657efaf/?environmentId=100&lang=en
File Encryption Patterns
Radamant modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..RDM
..RRK
..RADAMANT
..RAD
Ransom Note and Payment Demands
After encrypting files, Radamant displays ransom notes demanding payment for file recovery:
YOUR_FILES.url
Ransom message:
notes/YOUR_FILES.url
Note locations:
Desktop
Technical Indicators
Associated Executable Files
The following executable files are associated with Radamant ransomware:
DirectX.exe
StubNew.exe
myfile.exe
build
invoice_6307256.scr
a.exe
upatre
7105093.scr
TGrB1hNw.rar
zubZRvhbI.jpeg
zero
zero.exe
NcxGoTB.exe
directx.exe
directx
ransom_radam
Recovery and Decryption Tools
Good news! Decryption tools are available for Radamant ransomware:
0
Elastio Can Help You
Don't let Radamant ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This Radamant ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like Radamant.
Last updated: July 30, 2025