--- title: AXLocker ransomware doesn’t change files’ extensions description: AXLocker is a ransomware that was found by malware researcher ‘S!ri,’ who posted it on Twitter. Later, it was discovered that AXLocker does not only encrypt files but also steals victims’ Discord credentials and uploads them to its own Discord server. Specifically, the AXLocker ransomware steals tokens stored on a local computer when the user logs in to Discord. It’s not packed or obfuscated. canonical_url: https://www.acronis.com/en/tru/posts/axlocker-ransomware-doesnt-change-files-extensions/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 28 November 2022 # AXLocker ransomware doesn’t change files’ extensions AXLocker is a ransomware that was found by malware researcher ‘S!ri,’ who posted it on Twitter. Later, it was discovered that AXLocker does not only encrypt files but also steals victims’ Discord credentials and uploads them to its own Discord server. Specifically, the AXLocker ransomware steals tokens stored on a local computer when the user logs in to Discord. It’s not packed or obfuscated. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** ## Summary * Discovered in November 2022 * Encrypts victims’ files with AES-128-CBC algorithm * Steals credentials from Discord and browsers * Discovers user and PC name, IP addresses and UUID * Exfiltrate discovered information to the Discord server * Doesn’t change files’ extension ## Introduction AXLocker is a ransomware that was found by malware researcher ‘S!ri,’ who posted it on Twitter. Later, it was discovered that AXLocker does not only encrypt files but also steals victims’ Discord credentials and uploads them to its own Discord server. Specifically, the AXLocker ransomware steals tokens stored on a local computer when the user logs in to Discord. It’s not packed or obfuscated. ![Image 1: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/510904aa9f9bfa4137206ed86189451e.png) The file manifest is written in Czech. ![Image 2: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/27a75fb8688491b5358ac86d07fd869a.png) ### Execution Once executed, AXLocker modifies its own attributes to hide itself. ![Image 3: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/f96c30a462e8b74eb4cb02e8f3f69f31.png) ![Image 4: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/a0a8f0aa3a049a9a6b13aba07ec3f584.png) Next, AXLocker calls the _startencryption()_ function, which will enter the “C:”' drive and encrypt the content. ![Image 5: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/56c43b6006faf18c4e25c9ab812f2286.png) The _ProcessDirectory()_ function checks all folders on the “C:” drive. It contains the saved list of folders that must be skipped during encryption; during execution, the saved list of folders will be compared with those that are found. ![Image 6: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/24a47ceb1645ad625a752af0dd8e462a.png) ### File encryption When AXLocker finds a file, it calls the ProcessFile() function, which compares the file extension with its own hardcoded list of extensions. If there is a match, the file will be encrypted; if not, it is skipped. ![Image 7: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/88af126de7c1d3c91f5616094dfa3459.png) The stored list of file extensions: _"7z","rar","zip","m3u","m4a","mp3","wma","ogg","wav","sqlite","sqlite3","img","nrg","tc","doc","docx","docm","odt","rtf","wpd","wps","csv","key","pdf","pps","ppt","pptm","pptx","ps","psd","vcf","xlr","xls","xlsx","xlsm","ods","odp","indd","dwg","dxf","kml","kmz","gpx","cad","wmf","txt","3fr","ari","arw","bay","bmp","cr2","crw","cxi","dcr","dng","eip","erf","fff","gif","iiq","j6i","k25","kdc","mef","mfw","mos","mrw","nef","nrw","orf","pef","png","raf","raw","rw2","rwl","rwz","sr2","srf","srw","x3f","jpg","jpeg","tga","tiff","tif","ai","3g2","3gp","asf","avi","flv","m4v","mkv","mov","mp4","mpg","rm","swf","vob","wmv"_ As the name suggests, the ‘EncryptFile()’ function encrypts files. The number of encrypted files will be counted, and later sent to the server. ![Image 8: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/57a4e9bdbc1fb1ce6282b4470ab544f8.png) First, AXLocker loads the stored password, which is used to derive an encryption key: _'WnZr4u7xh60A2W4Rzt'_ Then it calls the _AES\_Encrypt()_ function which encrypts files using the AES-128-CBC algorithm. AXLocker does not change file extensions after encryption. ![Image 9: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/2e7bdbb8d09a6112d19f4c043e98df91.png) ### Data collection Besides file encryption, AXLocker can steal Discord tokens by scanning certain directories: ![Image 10: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/977c4db281222b838e246a3304c6b1f5.png) When the malware enters the found folder, it searches files with the ‘.ldb’ extension — a lock information file created when a user opens a database. Then the malware uses RegEx to search for particular information in these files. If information found matches, it is saved to the list. ![Image 11: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/6491795ce75bcc178c6532e76f5a0c48.png) In addition to the tokens, AXLocker is looking for more information — such as computer and user names, IP addresses and UUID — to be sent to the server. ![Image 12: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/d1a3ab79366309638ba2b00a58b13a2e.png) ![Image 13: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/e043bc2a98952513f69719309d3e059b.png) ![Image 14: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/0ba7ea94ece970fc1ded0a425f2267f8.png) ### Network activity To obtain a victim's IP address, AXLocker connects to ‘https://_api.ipify.org_,_’_ which is a public service for obtaining IP addresses and geolocation. ![Image 15: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/798822149d209919d2c945c00a9a7205.png) When all information is collected and files are encrypted, it sends data to the Discord server: _https://discord.com/api/webhooks/1039930467614478378/N2J80EuPMXSWuIBpizgDJ-75CB6gzTyFE72NQ0DJimbA7xriJVmtb14gUP3VCBBZ0AZR_ ![Image 16: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/a2232cd6bc9d23ac580bd86a4272f367.png) ![Image 17: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/f1d503b8daca077e0d5cee3e0a03be3d.png) ![Image 18: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/be37b08de23b3429001dc882a08d09e9.png) The content of the HTTP request is shown below: ![Image 19: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/41e0615d41ab2a8de4be1151808abcc3.png) ### Ransom note A ransom note is stored in the resource section, and is not dropped as a file but is opened in a new window. The note contains a timer (which counts down until the victim must pay the ransom), a unique ID and an email address to contact the threat actors. The amount of the ransom is not mentioned; victims must contact the attackers first. ![Image 20: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/391181eabc648310a04a97c619948a12.png) ## Conclusion AXLocker is a form of ransomware that can steal Discord tokens and exfiltrate other information such as computer and user names, IP addresses and UUID. Discord is a VoIP and messaging platform and it is popular with not only gamers, but also with the cryptocurrency community and other areas dealing with money. Stealing accounts may allow the threat actors to scam other members and steal funds, and these accounts can be used in further attacks. Unusually for ransomware, AXLocker does not change files’ extensions. The ransom note does not contain any mention of the Discord account, so it is unclear if the threat actor will use the stolen account after the victim pays the ransom. ## Detected by Acronis ![Image 21: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/aaa4dc1b8c2711aa93aead1910e4acfa.png) ![Image 22: AXLocker ransomware doesn’t change files’ extensions](https://staticfiles.acronis.com/images/content/e7f5e341fc52db1c7dbccd359f997d91.png) ## IoCs ### Files SHA256 c8e3c547e22ae37f9eeb37a1efd28de2bae0bfae67ce3798da9592f8579d433c d51297c4525a9ce3127500059de3596417d031916eb9a52b737a62fb159f61e0 0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224 9e95fcf79fac246ebb5ded254449126b7dd9ab7c26bc3238814eafb1b61ffd7a d9793c24290599662adc4c9cba98a192207d9c5a18360f3a642bd9c07ef70d57 ### Network indicators URL https://discord.com/api/webhooks/1039930467614478378/N2J80EuPMXSWuIBpizgDJ-75CB6gzTyFE72NQ0DJimbA7xriJVmtb14gUP3VCBBZ0AZR https://api.ipify.org https://i.ibb.co/0frTD92/discord-avatar-512.png Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)