Apps such as Stream Tube hijack browsers by modifying the settings. Users are then forced to open a specific address on certain occasions. Stream Tube promotes tailsearch.com (a fake search engine) in this way. It also collects browsing history. In most cases, users download and install browser h
Ufo blocks access to files by encryption, renames each encrypted file, displays a pop-up window ("info.hta") and generates a text file ("@READ_ME@.txt"). Ufo renames files by adding ".encrypted11", the happynewyear2021@tutanota.com email address, and appending ".ufo" as the file extension. For ex
department[.]limited cannot be trusted because it attempts to trick users into believing that their devices are infected, and into downloading a potentially unwanted application (PUA), which will supposedly remove detected threats. Typically, users do not visit websites such as department[.]lim
StreamsSearchWeb is a potentially unwanted application (PUA) that hijacks browsers by changing certain settings to streamssearchweb.com. In this way, it promotes this fake search engine. Apps such as StreamsSearchWeb are classified as PUAs, since they are often downloaded and installed by users i
Saher Blue Eagle was discovered by xiaopao. This ransomware encrypts and renames files, changes the desktop wallpaper, and displays a ransom message in full screen mode. It renames files by appending "..MaxSteel.Saher Blue Eagle" as the filename extensions. For example, "1.jpg" would be renamed t
Websites such as spaceshellvpn[.]com cannot be trusted because they often trick visitors into installing potentially unwanted applications (PUAs). Furthermore, these web pages are promoted via other bogus pages, deceptive advertisements, and PUAs. I.e., users do not often visit them intentionall
Easy belongs to the Phobos ransomware family. It is designed to encrypt files, rename each encrypted file, and generate "info.hta" and "info.txt" files (ransom messages). Easy renames files by adding the victim's ID, easybackup@aol.com email address, and appending the ".easy" extension. More prec
check-this[.]news is similar to chat-message[.]live, tlouslyrevor[.]top, yskimmed[.]top and many other rogue web pages. Typically, these sites are promoted via other dubious websites, deceptive advertisements, and potentially unwanted applications (PUAs). I.e., users do not often open/visit these
Bip is part of the Dharma ransomware family. Bip encrypts files, modifies their filenames, displays a pop-up window and creates the "FILES ENCRYPTED.txt" file, which contains instructions about how to contact the ransomware developers. Bip renames encrypted files by adding a unique vict
There are many pages similar to thefreshposts[.]com on the web. For example, chat-message[.]live, tlouslyrevor[.]top and etrolhidde[.]fun. Most users do not visit these sites intentionally - they are promoted via potentially unwanted applications (PUAs) that users do not download or install intent