The recent outbreak of a new ransomware has broken the heart for "promotion" of Bitcoin

Source: Shallot Blockchain

The Bitcoin ransomware named DeathRansom almost became a laughing stock in the early days, because the infected users found that the logic of the virus locking the file was very rough, just adding a ".wctc" extension to the original file name , And the user only needs to delete this extension, and the file can be restored to normal use. However, about a week ago, this Bitcoin ransomware virus, which was regarded as a "joke", showed signs of re-emerging. When the infected users wanted to delete the extension, they found that the virus had evolved significantly and was locked. The dead file was completely encrypted without changing its name, and the effects of the ransomware could no longer be eliminated by simple methods.

Since November 20, the number of infected submissions related to "DeathRansom" on the ransomware tagging website has skyrocketed. Although the number of infected submissions declined during the days following the outbreak on November 20, it is worth noting that in the past week, a considerable number of "new victims" have appeared every day As a result, this has alerted the market, as it most likely means that the ransomware is still being actively distributed.

• Ethereum Istanbul upgrade tentatively scheduled for December 6, here is everything you want to know
• How difficult is protecting privacy? Even anonymous coins may leak your secrets
• How will the halving of BTC rewards affect miners and currency prices?

But so far, no security agency has explicitly explained through which channels the ransomware was distributed, or how it spread.

Regarding this question, some netizens found that submission records on the Reddit and ID-Ransomware websites can see that many victims infected by DeathRansom have recently been infected with another ransomware virus STOP Ransomware. Because the STOP virus is distributed only through software bundling, DeathRansom may also be distributed in a similar manner.

Similar to the Bitcoin ransomware that has appeared before, whenever a user is infected by DeathRansom, the virus will delete the system backup and then encrypt all files on the infected computer, not just system files. In addition, the current version of DeathRansom does not add an extension to an encrypted file, but only retains its original name, but the data of the file is encrypted.

Currently the only way to identify that a file has been encrypted by DeathRansom is that the ABEFCDAB code will appear at the end of the string of the encrypted file.

In each folder where the encrypted files are located, the ransomware creates a document named read_me.txt containing the unique "LOCK-ID" of the infected computer and an email to contact the ransomware developer or agency address. Currently, security companies have started analyzing this ransomware, but so far no company or team has announced how to find or publish decryption methods.

"Interesting" is that in order to ensure that "victims" can successfully pay Bitcoins, the documents created by the ransomware will also contain instructions on how to buy Bitcoins, as well as links to LocalBitcoins, a cryptocurrency OTC platform, and even Link to a popular science article on Bitcoin published by Coindesk. In this regard, some netizens joked that the production team of the DeathRansom virus can be called the "industry conscience" to promote Bitcoin.

We will continue to update Blocking; if you have any questions or suggestions, please contact us!