Ransomware Research

Unlock92 Ransomware

Unlock92 is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on August 1, 2016, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: Unlock92 (v.1-2), Unlckr, Naampa.

Quick Facts

Ransomware Family
Unlock92
First Seen
August 1, 2016
Known Aliases
Unlock92 (v.1-2)UnlckrNaampa

How Unlock92 Ransomware Works

File Encryption Patterns

Unlock92 modifies encrypted files using specific patterns to mark them as encrypted:

File extensions added after encryption:

..CRRRT..CCCRRRPPP..blocked..kukaracha..jse..block..cr020801..crptd..MAY3321LTO..cdrpt.@LOCKED./\.[a-z0-9]{5,7}$/

Ransom Note and Payment Demands

After encrypting files, Unlock92 displays ransom notes demanding payment for file recovery:

file--------ПРОЧТИ МЕНЯ--------.txt

Ransom message:

notes/--------ПРОЧТИ МЕНЯ--------.txt

Note locations:

EveryFolder
file!_ИНСТРУКЦИЯ_!.txt

Ransom message:

notes/!_ИНСТРУКЦИЯ_!.txt

Note locations:

Desktop
file!----README----!.jpg

Ransom message:

notes/!----README----!.jpg

Note locations:

Desktop
file----как---вернуть---ваши---файлы----.jpg

Ransom message:

notes/----как---вернуть---ваши---файлы----.jpg

Note locations:

UserFolders
file!!---HOW RESTORE YOUR FILES---!!.jpg

Ransom message:

notes/!!---HOW RESTORE YOUR FILES---!!.jpg

Note locations:

UserFolders
file!!!!!!!!Как восстановить файлы!!!!!!!.txt

Ransom message:

notes/!!!!!!!!Как восстановить файлы!!!!!!!.txt

Note locations:

EveryFolder
fileЧТO ДEЛAТЬ ДЛЯ ВОССТАНОВЛЕНИЯ ФAЙЛOB.txt

Ransom message:

notes/ЧТO ДEЛAТЬ ДЛЯ ВОССТАНОВЛЕНИЯ ФAЙЛOB.txt
screenshot

Ransom message:

notes/LVYR.jpg

Note locations:

Desktop

Technical Indicators

Associated Executable Files

The following executable files are associated with Unlock92 ransomware:

  • типовой акт сверки сентябрь 2015.xlsx.scr
  • BTTP.exe
  • UNLOCK92
  • карта партнера.doc.exe
  • BCART.exe
  • pdf.exe
  • pdf.exe.bin
  • KSATAT.exe
  • заявка.xlsx.exe#
  • LAMAR.exe
  • LAMAR.e
  • MKEMBE.exe
  • MKEMBE2.ex
  • aa
  • 3_Id591.zip
  • naampa.exe
  • MMSPERT.EXE
  • mmspert.exe
  • notrad.exe
  • rdptm4.x
  • naampa.exe (mmspert.exe)
  • onastt.exe

Recovery and Decryption Tools

Good news! Decryption tools are available for Unlock92 ransomware:

0

Elastio Can Help You

Don't let Unlock92 ransomware take over your data

Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.

Learn MoreRequest a Demo

About This Analysis

This Unlock92 ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like Unlock92.

Last updated: October 30, 2025

Recent Ransomware

Explore other threats in our database

View all ransomware
What is Unlock92 Ransomware? | Elastio