Recovering from a ransomware attack can feel overwhelming, especially when every essential file on your system suddenly becomes unreadable and is appended with a complex extension like: yourfile.docx.[ID-C4D676C5][SuppDecFile@gmail.com].9pf This is the hallmark of the C77L Ransomware .9pf variant — a rapidly evolving threat within the X77C/C77L family. Victims frequently discover not only encrypted documents, databases,…
A New Evolution of the C77L Family A new ransomware variant known as C77L (also referenced as X77C) has emerged, detected in November 2025 in infection reports shared through cybersecurity communities.This version appends a unique 10-character random string followed by the “.OXOfUbfa” extension to encrypted files (e.g., photo.jpg.3n3Q2PsdhA.OXOfUbfa) and drops a ransom note titled “#Restore-My-Files.txt.”…
C77L (aka X77C) is a Win64 ransomware family that appends attacker email + an 8-hex “Decryption ID”/volume serial to filenames (examples: .[nullhex@2mail.co].8AA60918, .[ID-80587FD8][Dm_for_decrypt@protonmail.com].3yk). It uses hybrid crypto (AES for file content + RSA to protect keys), drops ransom notes such as #Restore-My-Files.txt, and threatens to leak stolen data. Related article: How to remove BQTLOCK Ransomware…