New Ransomware Wants Nude Picture To Unlock PC

New Ransomware Wants "Nude Picture" To Unlock PC

A few months ago, two ransomware scams made news for asking users to play video games in order to get their files back.





Now, a similar but a perverted kind of ransomware attack has hit the road that does not ask users for a ransom in Bitcoin but to submit their nude pictures, and in return, they might get their files back.

On Thursday, MalwareHunterTeam researchers found a malware called nRansomware. What’s different about this ransomware is that it wants your nude snaps. Strange, huh! A screenshot of the ransomware was posted on Twiter by the researchers, according to a report by Motherboard.

View image on Twitter

 Follow

MalwareHunterTeam @malwrhunterteam

Not sure about this...

Sample: https://www.virustotal.com/en/file/c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5/analysis/1506022612/ …@BleepinComputer@demonslay335
cc @x0rz @malwareunicorn

1:12 AM - Sep 22, 2017

•  5858 Replies
 
•  248248 Retweets
 
•  383383 likes

“Your computer has been locked. You can only unlock it with the special unlock code,” says the message. It further goes on to tell victims that they need to make a new email address on ProtonMail, an anti-NSA encrypted email service and send at least 10 explicit images of themselves.

“Go to Protonmail.com and create an account. Send an email to 1_kill_yourself_1@protonmail.com. We will not respond immediately. After we reply, you must send at least 10 nude pictures of you.”

Furthermore, it informs victims that their pictures will be verified to ascertain if they belonged to them or not. Once it is done; they will sell their pictures on the Deep Web.

The victim has to send an email to the attackers including ten nude photos. The attackers will then verify that images belong to the victim and provide the unlock code without charging any money.

According to the VirusTotel’s sample provided by the security researcher, AegisLab’s anti-virus detected it as “Troj.W32.Inject.tnKf” which is described by Kaspersky as malicious software that “perform actions which are not authorized by the user: they delete, block, modify or copy data, and they disrupt the performance of computers or computer networks.”





However, in a conversation with MotherBoard, the security researcher said that “It is a screen locker, so files aren’t encrypted. “We have no information about anyone getting infected with this.”