Sage

The original version adds the ".sage" extension to encrypted files and charges 0 in bitcoins for the decryption key. A second version, Sage 2.0, charges ,000. Sage 2.2 was discovered in February 2017 and downloads its main payload to the %Temp% folder.