Paradise Ransomware

Quick facts

Ransomware Family

Paradise

First Seen

September 1, 2017

Known Aliases

• Paradise unencrypted
• Paradise decrypted
• Paradise .NET
• Paradise 2020

How Paradise ransomware works

File modification behavior

Paradise updates file modification timestamps after encryption.

File encryption patterns

Paradise modifies encrypted files using specific patterns to mark them as encrypted:

Ransom note and payment demands

After encrypting files, Paradise displays ransom notes demanding payment for file recovery:

notes/#DECRYPT MY FILES#.txt

notes/#DECRYPT MY FILES#.html

notes/PARADISE_README_paradise@all-ransomware.info.txt

notes/#DECRYPT MY FILES# vN6YLGIr.html

notes/Instructions with your files.txt

notes/%= RETURN FILES =&.html

notes/---%$$$OPEN_ME_UP$$$---.txt

notes/-=###_INFO_you_FILE_###=-.txt

notes/$%%! NOTE ABOUT FILES -=!-.html

notes/---==%$$$OPEN_ME_UP$$$==---.txt

notes/A3QloxkZlkV7avmKdHILo5qUEQez.hta

notes/%%_WHERE_MY_FILES_=#.html

notes/nooode.txt

Technical indicators

Associated executable files

The following executable files are associated with Paradise ransomware:

• DP_Main.exe
• DP_Main.exe1
• dp_main.exe
• myfile.exe
• badfail.exe
• paradise.exe
• 726q.exe
• 8gfg.exe
• Paradise Ransomware.exe
• Paradise.exe
• Bg1B.exe
• v9_40_.exe
• TT.exe
• v4_40_.exe
• 1.EXE.QUARANTINE
• CLJTNAEPAXCDIWCQBJFGRWM6K.EXE
• Homeworkhelp
• Trojan.Ransom.Paradise.exe
• 4643.exe
• CV.exe
• vxjqig.exe
• uvulko.exe
• key.exe
• 4RH207OE.exe
• blofrWNV.exe

About this analysis

This Paradise ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery, helping organizations defend against and recover from ransomware attacks like Paradise.

Last updated: April 2, 2025