WanaCray2023+ Ransomware
There is a new strain of ransomware spotted in the wild. The new variant is called WanaCray2023+ and is a new branch in the Xorsist ransomware family.
The name of the ransomware looks like an attempt at a homage to the infamous WannaCry ransomware but made by someone who can barely read and write. The ransomware behaves like you would expect it to - it encrypts popular file types and renders them unusable.
Encrypted files receive the ".WanaCray2023+" extension appended after their original one. This means that a previously existing file named "panorama.jpg" will transform into "panorama.jpg.WanaCray2023+" once it has been given a once-over by the encryption process.
Once encryption finishes, the ransomware drops a file containing its ransom note. The file is called "HOW TO DECRYPT FILES.txt" and is curiously written in the Czech language. The full text of the ransom note goes as follows:
Vytvoøil jsem video se dvìma obrazovkami. První èást ukazuje video, které jste sledoval (máte dobrý vkus, haha ...), a druhá èást zobrazuje záznam z Vaší webové kamery. Mùžete skenovat poèítaè nebo cokoliv jiného. (Všechna data jsou již nahrána na vzdálený server.) A vaše zašifrována všechna . 6000 Kè je spravedlivá cena za naše malé tajemství. Zaplatíte pøes Bitcoin Do vašeho pøístroje jsme nainstalovali jeden software RAT. Pro tento okamžik je váš emailový úèet napaden (viz , nyní mám pøístup k vašim úètùm).. Stahoval jsem všechny dùvìrné informace z vašeho systému a dostal jsem další dùkazy. Nejzajímavìjším okamžikem, který jsem objevil, jsou videozáznamy o vás masturbující. BTC PENEZENKA_ [alphanumeric string] Zveøejnil jsem virus na pornografickém webu, a pak jste jej nainstalovali do svého operaèního systému. Po klepnutí na tlaèítko Pøehrát na porno video, v tom okamžiku byl mùj trojan stažen do vašeho zaøízení. Po instalaci vám pøední fotoaparát natáèí video.Kontakt decryptmypc at onionmail
The rough idea of the text is that the hackers claim they have recorded the ransomware victim through his webcam, while the victim was supposedly visiting adult websites. This is a common template used in extortion spam emails. Of course, there is no recording and this is all smoke and mirrors on part of the hackers.
The ransom note asks for 6000 Czech korunas in ransom, which is roughly $250. Of course, there is zero guarantees that paying the ransom will get you a working decryption tool.
