Agenda Ransomware Linux variant encrypts files with the following extensions:

3ds
3g2
3gp
7z
aac
abw
ac3
accdb
ai
aif
aiff
amr
apk
app
asf
asx
atom
avi
bak
bat
bmp
bup
bz2
cab
cbr
cbz
cda
cdr
chm
class
cmd
conf
cow
cpp
cr2
crdownload
cs
csv
cue
cur
dat
db
dbf
dds
deb
der
desktop
dmg
dng
doc
docm
dot
dotm
dotx
dpx
drv
dtd
dvi
dwg
dxf
eml
eps
epub
f4v
fnt
fon
gam
ged
gif
gpx
gz
h264
hdr
hpp
hqx
htm
html
ibooks
ico
ics
iff
image
img
indd
iso
jar
java
jfif
jpe
jpeg
jpf
jpg
js
json
jsp
key
kml
kmz
log
m4a
m4b
m4p
m4v
mcd
mdbx
mht
mid
mkv
ml
mobi
mov
mp3
mp4
mpa
mpeg
mpg
msg
nes
numbers
odp
ods
odt
ogg
ogv
otf
ova
ovf
pages
parallels
pcast
pct
pdb
pdf
pds
pef
php
pkg
pl
plist
png
pptm
prproj
ps
psd
ptx
py
qcow
qcow2
qed
qt
r3d
ra
rar
rm
rmvb
rtf
rv
rw2
sh
shtml
sit
sitx
sketch
spx
sql
srt
svg
swf
tar
tga
tgz
thmx
tif
tiff
torrent
ttf
txt
url
vdi
vhd
vhdx
vmdk
vmem
vob
vswp
vvfat
wav
wbmp
webm
webp
wm
wma
wmv
wpd
wps
xhtml
xlsm
xml
xspf
xvid
yaml
yml
zip
zipx