GOTHAM Ransomware

GOTHAM ransomware — a concise snapshot GOTHAM is a GlobeImposter-family crypto-ransomware observed in malware uploads to VirusTotal. Its principal marker is that it encrypts files and appends a .GOTHAM extension. After encryption it writes a ransom HTML file (how_to_back_files.html) that instructs victims how to buy Bitcoin and contact the attackers. The actors offer to decrypt…