- Home
Detectable Ransomware Unlock92
Ransomware Research
Unlock92 Ransomware
Unlock92 is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on August 1, 2016, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: Unlock92 (v.1-2), Unlckr, Naampa.
Quick Facts
- Ransomware Family
- Unlock92
- First Seen
- August 1, 2016
- Known Aliases
- Unlock92 (v.1-2)UnlckrNaampa
How Unlock92 Ransomware Works
Targeted Files
57a7f98653453edf9d7cddafd0eb0ede7d3a2a1a719daaf4a0fa4f4bb7f21eab -> doesn't change filenames
File Encryption Patterns
Unlock92 modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..CRRRT
..CCCRRRPPP
..blocked
..kukaracha
..jse
..block
..cr020801
..crptd
..MAY3321LTO
..cdrpt
.@LOCKED
./\.[a-z0-9]{5,7}$/
Ransom Note and Payment Demands
After encrypting files, Unlock92 displays ransom notes demanding payment for file recovery:
--------ПРОЧТИ МЕНЯ--------.txt
Ransom message:
notes/--------ПРОЧТИ МЕНЯ--------.txt
Note locations:
EveryFolder
!_ИНСТРУКЦИЯ_!.txt
Ransom message:
notes/!_ИНСТРУКЦИЯ_!.txt
Note locations:
Desktop
!----README----!.jpg
Ransom message:
notes/!----README----!.jpg
Note locations:
Desktop
----как---вернуть---ваши---файлы----.jpg
Ransom message:
notes/----как---вернуть---ваши---файлы----.jpg
Note locations:
UserFolders
!!---HOW RESTORE YOUR FILES---!!.jpg
Ransom message:
notes/!!---HOW RESTORE YOUR FILES---!!.jpg
Note locations:
UserFolders
!!!!!!!!Как восстановить файлы!!!!!!!.txt
Ransom message:
notes/!!!!!!!!Как восстановить файлы!!!!!!!.txt
Note locations:
EveryFolder
ЧТO ДEЛAТЬ ДЛЯ ВОССТАНОВЛЕНИЯ ФAЙЛOB.txt
Ransom message:
notes/ЧТO ДEЛAТЬ ДЛЯ ВОССТАНОВЛЕНИЯ ФAЙЛOB.txt
Ransom message:
notes/LVYR.jpg
Note locations:
Desktop
Technical Indicators
Associated Executable Files
The following executable files are associated with Unlock92 ransomware:
типовой акт сверки сентябрь 2015.xlsx.scr
BTTP.exe
UNLOCK92
карта партнера.doc.exe
BCART.exe
pdf.exe
pdf.exe.bin
KSATAT.exe
заявка.xlsx.exe#
LAMAR.exe
LAMAR.e
MKEMBE.exe
MKEMBE2.ex
aa
3_Id591.zip
naampa.exe
MMSPERT.EXE
mmspert.exe
notrad.exe
rdptm4.x
naampa.exe (mmspert.exe)
onastt.exe
Recovery and Decryption Tools
Good news! Decryption tools are available for Unlock92 ransomware:
0
Elastio Can Help You
Don't let Unlock92 ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This Unlock92 ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like Unlock92.
Last updated: July 30, 2025