Ransomware Family Identifier — Public Indicators Only
Paste the ransom-note file name, the encrypted extension, or a few lines from the note. The lab matches a conservative public indicator list in your browser and returns a family hypothesis, a forensic log, and the only honest next step: No More Ransom. Files never leave this tab. There is no decrypt engine on ACSNETWORLD — that would be a lie.
What this lab actually computes
Same shape as the Email Header Forensic Analyzer: input in the browser, rules on the client, a verdict plus a log you can screenshot for IT. The difference is the evidence. Email forensics has RFCs. Ransomware identification has note titles, extensions, and a few stable phrases that vendors have published. We score those. We do not brute-force AES. We do not talk to a command-and-control server.
- No More Ransom — Europol, national police, and vendors. The public decryptor catalog: nomoreransom.org
- FBI IC3 — U.S. reporting for internet crime: ic3.gov
- CISA StopRansomware — federal guidance for victims and backups, not a magic key
Verdict levels
| Verdict | Meaning | You do |
|---|---|---|
| FAMILY HIT | Extension and/or note text matched this lab’s short list | Search that name on No More Ransom. If they list a tool for your version, that is the decryptor. If they do not, there is no honest blog key. |
| NO MATCH | This list does not know the sample | Not “you are clean.” Take the note to NMR Crypto Sheriff. Keep the note. |
| DECRYPT HERE | Does not exist on this site | Any site that asks you to upload .encrypted documents for instant unlock is treated as hostile. |
How to collect evidence without making it worse
1. Stop the bleeding
If files are still changing extensions, unplug Ethernet / turn off Wi-Fi. Do not power-cycle in a panic if you need memory forensics; for a home PC, isolation first is enough.
2. Do not open the ransom HTML as a program
Open the .txt note in Notepad. Copy the title and a few sentences. You do not need the Bitcoin address for identification, and you should not pay it.
3. Run identification
Paste here. Read the forensic log. Then NMR — not a YouTube “decryptor 2026” and not a Telegram bot.
4. Recover
Offline backup that was not mounted during the attack. If you paid already, still report to IC3; payment does not guarantee a key. Forum tools often add a second infection.
Why we refuse a Decrypt button
LockBit, Akira, ALPHV, and most current crews do not publish keys. Older STOP/Djvu IDs sometimes had vendor tools; new IDs often do not. A static Blogger page cannot keep a live key database. Shipping a fake progress bar would burn AdSense and burn you. Identification plus NMR is the professional product. Anything else is a scam wearing a lab coat.
FAQ
Does ACSNETWORLD upload my note?
No. Matching is JavaScript in this tab. Reload the page and the text is gone.
Can I send the encrypted zip to you?
No. We will not take victim files. NMR and your incident responder do that job when it is appropriate.
The sample buttons?
Harmless public phrases for testing the matcher. They are not live malware.