Threat Database Ransomware '.342 File Extension' Ransomware

'.342 File Extension' Ransomware

By GoldSparrow in Ransomware

Threat Scorecard

Threat Level: 100 % (High)
Infected Computers: 25
First Seen: December 1, 2016
Last Seen: August 30, 2022
OS(es) Affected: Windows

The '.342 File Extension' Ransomware is an encryption ransomware Trojan that is being distributed using corrupted email spam attachments and links that lead to websites containing exploit kits. PC security analysts have identified the '.342 File Extension' Ransomware as a variant of the Locky Ransomware, a well-known ransomware family that has been responsible for countless threat attacks around the world. The '.342 File Extension' Ransomware belongs to a batch of variants in this threat family that includes threats such as the '.odin' File Extension Ransomware and the '.aesir' File Extension Ransomware, both of which use similar attack patterns.

How Your Files will be Encrypted by the '.342 File Extension' Ransomware

The most common way of distributing the '.342 File Extension' Ransomware is hidden in a corrupted Microsoft Word document that is attached to a spam email message. This corrupted file uses a macro that allows it to load the '.342 File Extension' Ransomware's corrupted script without triggering the victim's security software. This corrupted script will connect to one of the following online paths and download the '.342 File Extension' Ransomware's corrupted executable file onto the victim's computer:

How the '.342 File Extension' Ransomware Carries out Its Attack

Once the '.342 File Extension' Ransomware is dropped onto the victim's computer, it scans the contents of the victim's drives. Rather than wait until the infected computers boots, which is typical of these types of attacks, the '.342 File Extension' Ransomware starts encrypting the victim's files immediately.The '.342 File Extension' Ransomware will not only encrypt the victim's files but also search for shared network drives to spread to other computers. The '.342 File Extension' Ransomware seems to have been designed to target corporate computers, particularly small and medium businesses and Web servers.

The '.342 File Extension' Ransomware tends to target file types that are commonly used, mostly trying to affect work-related documents and media files. The ransom demanded by the '.342 File Extension' Ransomware can range from 2 to 4 BTC (from $1500 USD to $3000 USD approximately) depending on the scale of the attack and the amount of data that was affected during the attack. The list below contains some of the most common file types that are targeted for encryption during the '.342 File Extension' Ransomware attack:

.7z; .rar; .m4a; .wma; .avi; .wmv; .csv; .d3dbsp; .sc2save; .sie; .sum; .ibank; .t13; .t12; .qdf; .gdb; .tax; .pkpass; .bc6; .bc7; .bkp; .qic; .bkf; .sidn; .sidd; .mddata; .itl; .itdb; .icxs; .hvpl; .hplg; .hkdb; .mdbackup; .syncdb; .gho; .cas; .svg; .map; .wmo; .itm; .sb; .fos; .mcgame; .vdf; .ztmp; .sis; .sid; .ncf; .menu; .layout; .dmp; .blob; .esm; .001; .vtf; .dazip; .fpk; .mlx; .kf; .iwd; .vpk; .tor; .psk; .rim; .w3x; .fsh; .ntl; .arch00; .lvl; .snx; .cfr; .ff; .vpp_pc; .lrf; .m2; .mcmeta; .vfs0; .mpqge; .kdb; .db0; .DayZProfile; .rofl; .hkx; .bar; .upk; .das; .iwi; .litemod; .asset; .forge; .ltx; .bsa; .apk; .re4; .sav; .lbf; .slm; .bik; .epk; .rgss3a; .pak; .big; .unity3d; .wotreplay; .xxx; .desc; .py; .m3u; .flv; .js; .css; .rb; .png; .jpeg; .txt; .p7c; .p7b; .p12; .pfx; .pem; .crt; .cer; .der; .x3f; .srw; .pef; .ptx; .r3d; .rw2; .rwl; .raw; .raf; .orf; .nrw; .mrwref; .mef; .erf; .kdc; .dcr; .cr2; .crw; .bay; .sr2; .srf; .arw; .3fr; .dng; .jpeg; .jpg; .cdr; .indd; .ai; .eps; .pdf; .pdd; .psd; .dbfv; .mdf; .wb2; .rtf; .wpd; .dxg; .xf; .dwg; .pst; .accdb; .mdb; .pptm; .pptx; .ppt; .xlk; .xlsb; .xlsm; .xlsx; .xls; .wps; .docm; .docx; .doc; .odb; .odc; .odm; .odp; .ods; .odt.

Protecting Your Computer from the '.342 File Extension' Ransomware

The best way to protect your files from becoming encrypted by the '.342 File Extension' Ransomware is to have regular backups of all your files. If a business can recover the files from a backup, then the con artists have no leverage to demand a ransom. It is important to use delayed backup methods, to prevent the encrypted files from being uploaded to the backup storage.


Most Viewed