Add INC ransomware extension to known extensions

CAPESandbox · Apr 2, 2024 · faa1a62 · faa1a62
1 parent d010d2c
commit faa1a62
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/modules/signatures/windows/ransomware_fileextensions.py b/modules/signatures/windows/ransomware_fileextensions.py
@@ -134,6 +134,7 @@ def run(self):
             (".*\.phoenix$", ["PhoenixCryptoLocker"]),
             (".*\.blackbyte$", ["BlackByte"]),
             (".*\.basta$", ["BlackBasta"]),
+            (".*\.inc$", ["INC"]),
         ]
 
         for indicator in indicators: