KeRanger Ransomware
KeRanger is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on March 1, 2016, this ransomware has been actively targeting systems worldwide.
Quick facts
How KeRanger ransomware works
File encryption patterns
KeRanger modifies encrypted files using specific patterns to mark them as encrypted:
Ransom note and payment demands
After encrypting files, KeRanger displays ransom notes demanding payment for file recovery:
notes/README_FOR_DECRYPT.txt
Technical indicators
Associated executable files
The following executable files are associated with KeRanger ransomware:
- Transmission-2.90.dmg
- 31b6adb633cff2a0f34cefd2a218097f3a9a8176c9363cc70fe41fe02af810b9_dmg
- KeRanger
- 2.dmg
- Transmission-2.90-infected.dmg
- 1d6297e2427f1d00a5b355d6d50809cb _Transmission-2.90.dmg_d1ac55
- Transmission-2.90.dmg.bin
- 1d6297e2427f1d00a5b355d6d50809cb _Transmission-2.90.dmg
- Transmission-2.90.dmg_d1ac55
- A.dmg
- Transmission-2.90.dmg_
- 1.dmg
- Transmission-2.90-2.dmg
- Transmission-2.90_1.dmg
- Transmission
- 8
- 56b1d956112b0b7bd3e44f20cf1f2c19 _Transmission
- KeRanger.3..Mach-O
- 1_Transmission
- General.rtf
- kernel_service
- 1.rtf
- test2
- 14a4df1df622562b3bf5bc9a94e6a783 _General.rtf_
- 58c99fe20b348702b936abb0
- General.upx
- 4.dmg
- Transmission-2.90-DO-NOT-touch.dmg
- Transmission-2.90.dmg_d7d765
- Transmission-2.901.dmg
- Transmission-2.90_d7d765.dmg
- Transmission-2.90_2.dmg
- Transmission-2.90.2dmg
- 7
- test1
- 3151d9a085d14508fa9f10d48afc7016 _Transmission
- 2_Transmission
- 5.rtf
- 861c3da2bbce6c09eda2709c8994f34c _General.rtf_
- General_.upx
About this analysis
This KeRanger ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery, helping organizations defend against and recover from ransomware attacks like KeRanger.
Last updated: December 30, 2025
Elastio detects KeRanger inside your data and backups.
The Hunt Engine uses Deep File Inspection to identify KeRanger across live data, replicated data, and backups. If this family is in your environment, Elastio finds it before encryption completes. Run a scan against your recovery points to confirm.
Recent ransomware
Explore other threats in our database