Identify a ransomware with ID Ransomware: 2026 guide

Before attempting anything (payment, decryption, partial restoration), one question matters above all: which ransomware exactly hit you? The answer drives everything — decryptor availability, expected behavior, dwell time, double-extortion risk, legal status of the group. ID Ransomware, operated by MalwareHunterTeam since 2016, is the reference tool to answer this question in minutes.

This guide details the exact procedure, what you need to know before uploading, and how to act on the result depending on whether the strain is known or emerging.

Why precise identification changes everything

Many users facing ransomware treat the incident as if it were a single event category, and apply a generic response everyone reads (don't pay, restore from backup, file complaint). That's partially correct but ignoring the specific identification of the strain loses real recovery opportunities in about 30% of cases.

Precise identification changes the strategy on three critical axes. First axis: free decryptor availability. The No More Ransom project maintained by Europol, Dutch Police, Kaspersky and McAfee regularly publishes decryption tools when researchers succeed in breaking the cryptographic scheme of a ransomware family. In Q1 2026, about 140 distinct families have at least one published tool. If your strain is one of these 140, you can literally decrypt your files for free in hours. But if you don't identify the strain, you don't know such a tool exists.

Second axis: double extortion risk. Ransomware groups are not equivalent in exfiltration capability. The "top tier" operators (LockBit 3.0, BlackCat/ALPHV, Royal, Akira, Black Basta) systematically operate significant exfiltration before encryption and publish data on their leak sites if not paid. "Classical cybercrime" operators (Stop/Djvu, GandCrab heirs, some Phobos variants) generally don't exfiltrate and the risk is limited to local encryption. The notification strategy (regulators, customers, suppliers) and pressure on ransom calculation depend directly on this distinction.

Third axis: legal status and OFAC sanctions. Several ransomware groups are designated by US OFAC as sanctioned entities (LockBit in February 2024, Conti in 2022, Black Basta partially). Paying a ransom to a group under OFAC sanctions is illegal for any US person or company, and constitutes a significant legal risk even for European companies with US operations. Precisely identifying the group lets you know if payment is legally possible before even considering its ethics.

ID Ransomware: what the service actually does

ID Ransomware is a project maintained by Michael Gillespie (a.k.a. Demonslay335), a central researcher in the ransomware community since the mid-2010s. The service is free, requires no account, and accepts two input types: an encrypted file sample and the ransom note left by the attackers.

Identification logic

The tool cross-references several signals to decide:

• The extension appended to the encrypted file (.lockbit, .djvu, .conti, etc.).
• The binary structure of the file: header, marker placed at the beginning or end of the file, algorithm signature (AES, ChaCha20, Salsa20), sometimes a footer with metadata (version, victim ID, RSA-encrypted key).
• The ransom note hash: most families use a stable text template, varying only on dynamic fields (UID, amount, Tor link). Partial hash or lexical signature enables reliable identification.
• The note filename: README.txt, _readme.txt, HOW_TO_DECRYPT.txt, !!!HELP_FILE!!!.html, restore-my-files.txt, etc.
• The ransom wallpaper in some cases (an image substituted as the desktop background).

Triangulation of these signals brings the identification rate above 95% on indexed families. The database covers more than 1300 families in 2026, with the service processing roughly 1.5 million submissions per year.

Why not just the extension

About a dozen ransomwares share generic extensions like .locked, .encrypted or .crypto. Without cross-checking the note and binary structure, identification would routinely be wrong — and a decryptor applied to the wrong family permanently destroys the files.

Full procedure

Step 1 — Prepare a working environment

You need an uninfected device: smartphone, second PC, a relative's computer. Never use the compromised machine for identification — it may keep exfiltrating data or encrypt newly created files.

Prepare two supports:

1. A USB drive to transfer the ransom note and an encrypted file.
2. An evidence folder (screenshots, captures, event log).

Step 2 — Extract an encrypted file sample

Always work on a copy, never on the original. If you accidentally overwrite or modify the original, you lose the recovery opportunity even if a decryptor arrives later.

Pick a small encrypted file (ideally under 1 MB) — that is the upload limit on ID Ransomware. A modest .docx or .jpg works well. To examine the file's characteristics before upload, here is a PowerShell script that extracts the key information.

# Examine an encrypted file without modifying it
$file = "C:\Path\To\encrypted-sample.docx.lockbit3"

# Size and timestamps
Get-Item $file | Select-Object FullName, Length, CreationTime, LastWriteTime

# SHA-256 hash of the full file
Get-FileHash -Algorithm SHA256 $file

# First 256 bytes (header) in hex - useful to identify the marker
$bytes = [System.IO.File]::ReadAllBytes($file) | Select-Object -First 256
($bytes | ForEach-Object { $_.ToString("X2") }) -join " "

# Last 512 bytes (footer often carries the marker and the RSA key)
$all = [System.IO.File]::ReadAllBytes($file)
$tail = $all[($all.Length - 512)..($all.Length - 1)]
($tail | ForEach-Object { $_.ToString("X2") }) -join " "

# Search for a visible ASCII signature (UID, familiar marker)
$content = [System.Text.Encoding]::ASCII.GetString($all)
[regex]::Matches($content, "[A-Za-z0-9]{16,}") | Select-Object -First 5

This script never modifies the file (all operations are read-only) and returns the hash, header and footer — useful for the BleepingComputer forum if ID Ransomware does not recognize the strain.

Step 3 — Retrieve the ransom note

The note is typically dropped on the desktop, in the Documents folder, and inside every folder containing encrypted files. Common filenames in 2026:

• README.txt
• _readme.txt (STOP/Djvu)
• HOW_TO_DECRYPT.txt
• !!!HELP_FILE!!!.html
• restore-my-files.txt (LockBit)
• RECOVER_DATA.html (Akira)
• instructions_read_me.txt (BlackBasta)
• recover-files.txt (Royal)

Before upload, redact personal identifiers. The note almost always contains a UID, TID, transaction ID, personal Bitcoin address, or unique Tor link that identifies you to the attackers. Replace those strings with [REDACTED] in a copy of the note before sending it to ID Ransomware. Why: if you later decide to engage a professional negotiator, the attacker should not know that you publicly analyzed the note.

Step 4 — Upload to ID Ransomware

Open id-ransomware.malwarehunterteam.com. The interface offers two fields:

1. Ransom Note: the ransom note (text, HTML, image, TTS audio for some recent variants).
2. Sample Encrypted File: one encrypted file.

Limit: 1 MB per file. No account required, anonymous submission. The service processes the request within seconds.

Step 5 — Read the result

Three possible outcomes:

Positive identification with available decryptor. The result displays the family name, a direct link to the official decryptor (often Emsisoft, Avast, Kaspersky or No More Ransom), and a link to the relevant BleepingComputer topic. Download the decryptor from the official source only — booby-trapped fake decryptors exist.

Positive identification without decryptor. The strain is known but no free tool exists (case of LockBit 3.0, recent Akira, Royal, BlackCat, Play, 8base, BlackBasta). Note the exact name for the next steps (negotiation, complaint, data breach notification).

Uncertain or multiple identification. The service returns several candidates. Cross-reference with BleepingComputer and No More Ransom to break the tie.

Step 6 — Cross-reference with alternative databases

ID Ransomware is not alone. Useful complementary databases in 2026:

• No More Ransom — Crypto Sheriff (nomoreransom.org): joint initiative of Europol, Dutch police and several antivirus vendors. Database of 200+ free decryptors. Similar interface (upload note + sample).
• BleepingComputer Ransomware ID (bleepingcomputer.com/forums): community forum with volunteer analysts. More responsive on emerging strains.
• Emsisoft Ransomware Identification (emsisoft.com/ransomware-decryption): integrated into their decryptor catalog.
• Coveware (coveware.com): free identification for businesses engaging a paid response/negotiation mission.

Common ransomware families 2024-2026

Status can evolve: monitor No More Ransom and CISA bulletins regularly.

After identification — what to do based on the result

Case A — An official decryptor exists

Excellent news, but beware of pitfalls.

1. Download the decryptor from the official source only (link from ID Ransomware, No More Ransom or the vendor site).
2. Test first on a copy of an encrypted file. If the copy is properly decrypted, scale to the whole fleet.
3. Keep the original encrypted files until you confirm recovery is complete and stable (minimum 1 to 2 weeks).

See our guide Decrypt ransomware without paying for the per-family tool list.

Case B — No decryptor available

Do not panic — this is the most common case in 2026 on recent RaaS families. Several levers remain:

• Backup predating the attack: first recovery shot. Check cloud backup (OneDrive, Backblaze, iCloud), disconnected external disk, off-site NAS.
• Windows shadow copies not yet destroyed — see Shadow Copies Windows recovery.
• EaseUS Data Recovery Wizard to scan unencrypted fragments (Office temp files, Adobe autosaves, EXIF thumbnails). Method detailed in Recover files after ransomware.
• Synology / QNAP NAS hit: specific procedures in Ransomware on Synology and QNAP NAS.

Case C — Mandatory complaint and notification

Whatever the result:

• File a complaint with law enforcement. In the US: IC3.gov. UK: Action Fraud. France: cybermalveillance.gouv.fr. Spain: INCIBE.
• GDPR notification within 72 hours if you process personal data of third parties (customers, employees, contacts). Article 33 obligation in the EU/EEA. Equivalent obligations exist in California (CCPA), Brazil (LGPD), UK (UK-GDPR).
• Cyber insurance declaration if covered — a police complaint is typically required to trigger reimbursement.

False positives and common pitfalls

Variants based on leaked source code

Source code for Conti, LockBit Black, Babuk and HelloKitty leaked between 2021 and 2024. Amateur variants reuse these codebases with their own keys. ID Ransomware may classify them as the parent family, but the parent family decryptor will not work on those variants (independent keys). Always test on a copy before deployment.

Extension collisions

Multiple families use the same generic extensions:

• .locked: used by at least 12 different families (TeslaCrypt, Locked-In, Cerber, etc.).
• .encrypted: 8 known families.
• .crypt: 6 families.

Without the ransom note, extension-only identification is unreliable. Always upload both.

Fake decryptors

Underground forums and some black-hat SEO sites push booby-trapped decryptors (themselves ransomwares or credential stealers). Only download from:

• The official link on ID Ransomware.
• No More Ransom.
• Antivirus vendor sites (Emsisoft, Kaspersky, Avast, Bitdefender, Trend Micro).

Service security — points of attention

ID Ransomware does not expose the contents of your files: an encrypted file without the key is cryptographically unusable, even for MalwareHunterTeam. The ransom note, however, deserves care:

• Unique victim identifiers (UID, TID, transaction ID, personal Bitcoin address, unique Tor link). Mask them before upload.
• Structured business data sometimes injected by attackers (organization name, specific amounts). Preserve confidentiality before public submission.
• Retention policy: ID Ransomware retains submissions to enrich the research database but does not publish content. For sensitive cases (government, healthcare, critical infrastructure), go through a national CSIRT rather than the public tool.

In summary

Identifying the strain is the first useful action after isolating the machine. The procedure takes 10 to 15 minutes, costs nothing, and conditions everything that follows: available decryptor, threat model, legal obligations, recovery tool choice.

Start with id-ransomware.malwarehunterteam.com, cross-reference with No More Ransom and BleepingComputer, then decide. And if you are mid-attack without a plan, follow the full methodology in Recover files after ransomware — or start a diagnostic to estimate recovery odds.

Resources

• ID Ransomware — MalwareHunterTeam
• No More Ransom — Free decryption tools
• BleepingComputer — Ransomware Help & Tech Support
• Emsisoft — Ransomware Decryption Tools
• CISA — StopRansomware
• IC3 — Report cybercrime