Another weird case of a ransomware crook asking for iTunes gift cards instead of (undetectable) Bitcoin

May 1, 2016 17:35 GMT  ·  By

A team of security researchers have discovered, analyzed and then cracked a new ransomware version known as Alpha Ransomware, spotted during the past week.

The ransomware works in a strange way compared to other versions. When it infects a victim, Alpha selectively encrypts files.

On the system drive (usually, C:), it only targets 249 file types in the Desktop, My Pictures, and the Cookies folders. On other drives, it encrypts all files except INI files. On shared folders, it encrypts all files it finds.

Crooks asks for $400 in iTunes gift cards

The ransomware uses AES-256 encryption to lock files, and then it appends each file's name with the .encrypted extension.

After the encryption process ends, the ransomware adds a ransom note in text format in each folder where it encrypted files, changes the user's wallpaper (see image attached to article), and then deletes itself.

According to the ransom note, the crook asks for $400 worth of iTunes gift cards. If used improperly, these gift cards can be traced back to the crook and reveal their real identity. Bitcoin, which is an anonymous crypto-currency, currently untraceable, is not used at all.

This is the third piece of ransomware in the last week that has been seen asking for gift cards instead of Bitcoin. Researchers previously discovered the Cyber.Police and the TrueCrypter ransomware families. TrueCrypter is also decryptable.

Alpha Ransomware decrypter available for download

Security researcher Michael Gillespie is the one who crafted the Alpha Ransomware decrypter after spotting a weakness in its encryption routine.

The security researchers who analyzed and broke down Alpha Ransomware are Katja Hahn, S!Ri, and MalwareHunterTeam. The decrypter is available for download via the Bleeping Computer website.

The decrypter has a high detection rate on VirusTotal for the Razy trojan. We reached out to MalwareHunterTeam and Mr. Gillespie about this issue, who said it was because of the source code obfuscation. Michael Gillespie, MalwareHunterTeam, and Bleeping Computer provided many other ransomware decrypters in the past, which did not show up as infected on VirusTotal scans, so you can rest assured they're the good guys.