Skip to content
MalwareWiki

Malware

Trigona

According to PCrisk, Trigona is ransomware that encrypts files and appends the "._locked" extension to filenames.

Trigona is a Windows malware family.

Background

PCrisk describes Trigona as ransomware that encrypts files and tacks the "._locked" extension onto their names. It also writes a "how_to_decrypt.hta" file that displays a ransom note. For instance, Trigona would turn "1.jpg" into "1.jpg._locked" and "2.png" into "2.png._locked".

Within each encrypted file, it stores the encrypted decryption key together with the campaign ID and the victim ID.

Source: Malpedia (Fraunhofer FKIE).