A new type of ransomware not only encrypts files but also removes files every hour and displays pornographic pictures on the Windows lock screen. The so-called Crypto Hitman ransomware is a variant of the Jigsaw ransomware, also known for deleting files after a certain timespan. The ransom is initially $150 to be paid in Bitcoin which is doubled after 36 hours.
Jigsaw was first discovered in April and the main difference with Crypto Hitman is that the latter shows pornographic images on the lockscreen. It also adds the extension .porno to encrypted files.
Victims of both Jigsaw and Crypto Hitman are lucky, security research Michael Gillespie has developed a tool a that is able to decrypt the files that are encrypted by the ransomware. Gillespie also notes that the Bitcoin address to which users normally pay the ransom, already shows 4 transactions, meaning the cybercriminals behind it earned at least $600.
Hunting #ransomware: adds extension .porno. Awesome search... Only a victim with encrypted files, no ransom note: https://t.co/47JMy1PwwH
— Michael Gillespie (@demonslay335) May 11, 2016
