Most ransomware today encrypt files using known algorithms like RSA or RC4, or custom encryption. Ransomware like Cerber and Locky search for and encrypt target file types, which are usually document and media files. When the encryption is complete, the malware leaves a ransom note, which can be a text, image, or HTML file with instructions to pay a ransom in order to recover files.

More sophisticated ransomware like Spora, WannaCrypt (also known as WannaCry), and Petya (also referred to as NotPetya) add malicious behaviors, such as spreading to other computers in the network via network shares or exploits.

Older ransomware like Reveton don't encrypt files but they lock screens. They do this by displaying an image on full screen and then disabling Task Manager. The files are safe, but they can't be accessed. The image usually contains a supposed message from law enforcement that the computer was used in illegal cybercriminal activities and a fine needed to be paid. Because of this, Reveton is nicknamed "Police Trojan" or "Police ransomware."

This information is sourced from SPF-STAGING