Reported sample:
https://www.virustotal.com/en/file/d950 ... /analysis/
Message:
string text = "Hello, I'm nice Jigsaw or more commonly known as Jigsaws twin.\n\nUnfortunately all of your personal files (pictures, documents, etc...) have been encrypted by me,\nan evil computer virus know as 'Ransomeware'.\n\nNow now, not to worry I'm going to let you restore them but only if you agree to stop downloading\nunsafe applications off the internet.\n\nIf you continue to do so may end up with a virus way worse than me! You might even end up meeting\nmy infamous brother Jigsaw :(\n\nWhile you're at it, you can also read the small article below by Google's security team on how to\nstay safe online.\n\nOh yeah I almost forgot! In order for me to decrypt your files you must read the two articles below,\nonce you have click the \"Get My Decryption Key\" button.\n\nThen enter in your decryption key and click the \"Decrypt My Files\" button.\nEventually all of your files will be decrypted :)\n\nIf the timer reaches zero then all of your personal files will be deleted\nbecause you were too lazy to read two articles.\n\nSo " + Environment.UserName + " do you want to play a game?";
DialogResult dialogResult = MessageBox.Show("Are you sure '" + this.txtDecryptKey.Text + "' is the correct decryption key?\nIf the key doesn't match the one given to you then all of your files will become corrupted.", "Decryption", MessageBoxButtons.YesNoCancel, MessageBoxIcon.Exclamation);
public static int counter = 0;
public static string websiteURL = "http://localhost/ransome/";
public static List<string> list = new List<string>();
public static string googleLink = "https://security.googleblog.com/2010/09 ... wsing.html";
public static string jsLink = "http://www.bleepingcomputer.com/news/se ... he-ransom/";
A forum for reverse engineering, OS internals and malware analysis
