Ducky Ransomware encrypts user data and asks them to contact the attacked on Telegram handle duckydecrypt or contact them at ballxball@protonmail.com in 48 hours for a ransom amount. Attacker threats the victims if they fail to contact them in due time ransom will be double.
ducky extension is added to all encrypted files, hence the name.
Ducky Ransomware Signatures
Family: Gen:Variant.Ransom.Duck.1
MD5: ce2ce909fa5c7b690e4f9088ec15bbe7
SHA256: 9925f2bbd8a65868dcef2699ed389fcaf617dd3d680ef45e2ee429b58d8f348f
Ducky Ransomware Download
