BTCWare Ransomware

The BTCWare Ransomware is a ransomware family that has been highly active since April of 2017. Several variants in the BTCWare Ransomware family have been released in 2017, most using similar ransom demand messages and appending similar extensions to the encrypted files. The BTCWare Ransomware variants may ask for different ransoms, although most average approximately $500 USD in BitCoin. They also have been branded in different ways. Fortunately, PC security researchers have reported on the release of a decryptor application that can help computer users recover from the BTCWare Ransomware attacks.

Is the BTCWare Ransomware’s Name a Tribute to the Currency Favored by Extortionists?

The BTCWare Ransomware carries out a typical ransomware attack, encrypting the victims' files using a strong encryption algorithm and then demanding a ransom payment from the victim in exchange for the decryption key necessary to recover the affected files. Up until now, the only solution for computer users was to restore the affected files from a backup copy. Fortunately, a decryptor released in late May can help computer users recover their files from most of the BTCWare Ransomware variants (although it is expected that the BTCWare Ransomware's developers will change their tactics to release new variants that are not affected by this decryptor). The BTCWare Ransomware decryptor was developed after the BTCWare Ransomware master key was released on computer security forums (perhaps by one of the BTCWare Ransomware developers or one of its competitors looking to sabotage the con artists' efforts). The BTCWare Ransomware is quite active currently, with new variants released almost daily since March 2017. The rate of the BTCWare Ransomware infections made it comparable to better-known ransomware Trojans such as Locky.

Recovering Your Files from a BTCWare Ransomware Attack

The decryptor released by PC security researchers can help computer users recover their files if the following file extensions have been added to them:

• .[< email address >].btcware
• .[< email address >].cryptobyte
• .[< email address >].cryptowin
• .[< email address >].theva

This decryption program may help computer users recover from other BTCWare Ransomware variants. PC security researchers are updating this decryptor to help computer users deal with newer BTCWare Ransomware variants as they are released. In May a variant known as Onyonware, which used the '.onyon' and other extensions was released, and this decryptor is being updated to include these variants. It is possible that the people responsible for the BTCWare Ransomware attacks, however, have already moved onto new variants of this ransomware threat.

The BTCWare Ransomware Attack is Very Common

The BTCWare Ransomware infection is typical of these encryption ransomware attacks. The BTCWare Ransomware ransom note tends to be contained in files with names such as '#_HOW_TO_FIX_!.hta.htm' or '!#_RESTORE_FILES_#!.inf' and may contain a variant of the following message:

'[WHAT HAPPENED]
Your important files produced on this computer have been encrypted due a security problem
If you want to restore them, write us to the e-mail: look1213@protonmail.com
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.
After payment we will send you the decryption tool that will decrypt all your files.
[FREE DECRYPTION AS GUARANTEE]
Before paying you can send to us up to 3 files for free decryption.
Please note that files must NOT contain valuable information
and their total size must be less than 1Mb
[HOW TO OBTAIN BITCOINS]
The easiest way to buy bitcoin is LocalBitcoins site.
You have to register, click Buy bitcoins and select the seller
by payment method and price
https://localbitcoins.com/buy_bitcoins
[ATTENTION]
Do not rename encrypted files
Do not try to decrypt your data using third party software, it may cause permanent data loss
If you not write on e-mail in 36 hours - your key has been deleted and you cant decrypt your files
Your ID: -'

When the victims of the BTCWare Ransomware attack visit the BTCWare Ransomware payment portal or website, they may be greeted with the following instructions:

'Recovery files. Telegram: @decryps
To decrypt files, you will have to pay 0.5 BTC
1. You should register Blockchain wallet
2. Buy bitcoins to your wallet.
3. Send 0.5 BTC to Bitcoin address: -
4. Enter you transaction ID: -
5. Press Win+R, type cmd and press Enter In appeared console:
1) Enter cd %appdata%
2) Enter biz net.exe -d your_decrypt_key and wait for decryption...
6. Finish. All the files decrypted.'

SpyHunter Detects & Remove BTCWare Ransomware