Ransomware Research
Rapid Ransomware
Rapid is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on November 1, 2017, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: Rapid NextGen.
Quick Facts
- Ransomware Family
- Rapid
- First Seen
- November 1, 2017
- Known Aliases
- Rapid NextGen
How Rapid Ransomware Works
Targeted Files
https://app.any.run/tasks/fc49c17b-c2e9-4ff5-b84a-989a7841a212/ https://app.any.run/tasks/d7754ced-e4d6-4cf8-a6de-9c4339bc54ef/ https://app.any.run/tasks/fefb8fb6-f268-45fe-b7fc-11572054285a/
File Encryption Patterns
Rapid modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..rapid
..RPD
..no_more_ransom
..GILLETTE
..guesswho
..mouse
..droprapid
..cryptolocker
Ransom Note and Payment Demands
After encrypting files, Rapid displays ransom notes demanding payment for file recovery:
How Recovery Files.txt
Ransom message:
notes/How Recovery Files.txt
Note locations:
EveryFolder
Decrypt DATA.txt
Ransom message:
notes/Decrypt DATA.txt
Note locations:
EveryFolder
!DECRYPT_DROPRAPID.txt
Ransom message:
notes/!DECRYPT_DROPRAPID.txt
!DECRYPT_FILES.txt
Ransom message:
notes/!DECRYPT_FILES.txt
Note locations:
EveryFolder
!files-recovery.txt
Ransom message:
notes/!files-recovery.txt
Note locations:
EveryFolder
Ransom message:
notes/kakdela.bmp
Note locations:
Desktop
#How Recovery Files.txt
Ransom message:
notes/#How Recovery Files.txt
Technical Indicators
Associated Executable Files
The following executable files are associated with Rapid ransomware:
8ee39b00409c4b1899ce3a77841eea1f7700946e
rapid_7UR2.exe
Relec.exe
N29hoWFmXsBxuPOuqXu8QhPgtKEcRn
657666.exe
info.exe
Info.exe
frenkmoddy@tuta.io.exe
rapid.exe
alexgen.exe
inst123.exe
M97eaPT4TEhecyYe.exe
ZjQPZquSkNFw0DORYIBM8xc2WrATrv.exe
j2CJDcJs3bg3s570Abdch3QYp9U.exe
YnkO8CymMp2SP5L5HrmS.exe
B4p7LUNzHJiFnr8b5wwMUOmtKa5.exe
ZByzjqzibgU6epxuH2.exe
QCLp91HNLE8zwoHI.exe
PeFebIBQFCgPa0r.exe
GEyIvSkLGjgHcu25uNqa.exe
RQwAuZNsz6hoc0fwowqqN5GBCh.exe
8iPhv4MiPAgPA9izIAq6a.exe
mPCZx7y818aAhSPYDjmAI.exe
vM45ijW46tX9YGLOpC2aMcy.exe
League of Legends
LeagueClientUx.exe
strikeCfcomJ.data
Rapid.exe
no_more_ransom.exe
Spp
eslf.exe
norapid.exe
temp01.exe
info.exe
userkey.dat
info.old.exe
Elastio Can Help You
Don't let Rapid ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This Rapid ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like Rapid.
Last updated: July 30, 2025