Merge pull request #424 from kevross33/patch-55

Add INC ransomware extension to known extensions
CAPESandbox · Apr 2, 2024 · 8b343b6 · 8b343b6
2 parents d010d2c + faa1a62
commit 8b343b6
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/modules/signatures/windows/ransomware_fileextensions.py b/modules/signatures/windows/ransomware_fileextensions.py
@@ -134,6 +134,7 @@ def run(self):
             (".*\.phoenix$", ["PhoenixCryptoLocker"]),
             (".*\.blackbyte$", ["BlackByte"]),
             (".*\.basta$", ["BlackBasta"]),
+            (".*\.inc$", ["INC"]),
         ]
 
         for indicator in indicators: