Thor is another variant of Locky ransomware that uses RSA-2048 and AES-128 encryption algorithms to encode files. Virus got its name because it adds .thor extension to all ciphered files. It also modifies filenames using random characters and numbers, so it becomes hard to distinguish files. Mostly malware affects user documents, pictures, videos, game files. Thor ransomware demands ransom of 3 BitCoins (~$1950). Ransomware creates 2 files: _WHAT_is.html and _WHAT_is.bmp. This files contain instructions for users to pay the ransom and get decryptor.