I think it is well past the point that ransomware should be divided into some sort of categories, depending on who codes it and how it is used. Most broadly:
1). Stuff done by Script Kiddies- these are usually reverse-engineered from existing ransomware and can be distinguished pretty ransom overlays as well as a decryptor being almost immediately available. There will be limited distribution.
2). Stuff from Blackhats who sell packages on the DarkWeb to wanna-be criminals. Once again, limited distribution, fast decryption, and may or may not have and actual Command Server.
3). The most interesting- beta builds of novel ransomware released in order to see if the mechanism of attack is successful. They may or may not ever go into production.
4). The real thing- coded and controlled by those who know what they are doing, both the malware itself as well as any command server will change a number of times daily. Worse, the distribution channel can be massive including (but not restricted to) Mail bombers and maladvertising. There will be no decryption for these, and if one is actually made a new ransomware version will be coded to patch the flaw. Cerber3 and newer Locky comes to mind here.
Don't get me wrong- one can be infected by 1-3, but the probability will be a great deal lower and the effects potentially less devastating than an infection with category 4 ransomware.
