Fuck_You Ransomware
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 6,693 |
| Threat Level: | 100 % (High) |
| Infected Computers: | 243 |
| First Seen: | March 9, 2017 |
| Last Seen: | October 3, 2026 |
| OS(es) Affected: | Windows |
The Fuck_You Ransomware is a ransomware Trojan used to force computer users to pay large amounts of money. The Fuck_You Ransomware receives its title because of the title of the message it uses to extort computer users. The Fuck_You Ransomware is one of the countless ransomware Trojans based on the Hidden Tear project, an open source ransomware Trojan that was supposedly released for educational purposes in 2015 but that has been modified countless times to allow con artists to release numerous ransomware Trojans since its release. The Fuck_You Ransomware was first observed when it was uploaded to an online security platform. PC security researchers suspect that the Fuck_You Ransomware is still under development, meaning that the final version of the Fuck_You Ransomware that may be released for attacks on computer users may be very different from the Fuck_You Ransomware analyzed by PC security analysts.
Table of Contents
Besides Cursing You the Fuck_You Ransomware Will Encrypt Your Files
The Fuck_You Ransomware is not one of the sophisticated ransomware Trojans out there, but it still carries out an effective attack. The Fuck_You Ransomware is designed to work in portable mode. It may be embedded into DOCX or RTF documents to take advantage of a vulnerability in macros that allows con artists to execute corrupted code on the victim's computer. These corrupted files may bve distributed using spam email attachments or spam messages on social media platforms. The Fuck_You Ransomware uses a combination of the RSA and the AES encryption to make the victim's files inaccessible completely. The Fuck_You Ransomware will encrypt all files found on the affected computer's drives, creating an encryption key that is included in the Fuck_You Ransomware's code. The current version of the Fuck_You Ransomware affects numerous file types, including the following:
.3GP, .7Z, .APK, .AVI, .BMP, .CDR, .CER, .CHM, .CONF, .CSS, .CSV, .DAT, .DB, .DBF, .DJVU, .DBX, .DOCM, ,DOC, .EPUB, .DOCX .FB2, .FLV, .GIF, .GZ, .ISO .IBOOKS,.JPEG, .JPG, .KEY, .MDB .MD2, .MDF, .MHT, .MOBI .MHTM, .MKV, .MOV, .MP3, .MP4, .MPG .MPEG, .PICT, .PDF, .PPS, .PKG, .PNG, .PPT .PPTX, .PPSX, .PSD, .RAR, .RTF, .SCR, .SWF, .SAV, .TIFF, .TIF, .TBL, .TORRENT, .TXT, .VSD,.WMV, .XLS, .XLSX, .XPS, .XML, .CKP, .ZIP, .JAVA, .PY, .ASM, .C, .CPP, .CS, .JS, .PHP, .DACPAC, .RBW, .RB, .MRG, .DCX, .DB3, .SQL, .SQLITE3, .SQLITE, .SQLITEDB, .PSD, .PSP, .PDB, .DXF, .DWG, .DRW, .CASB, .CCP, .CAL, .CMX, .CR2.
After encrypting the victim's files, the Fuck_You Ransomware will drop a ransom note named 'READ_IT.txt' on the infected computer's desktop. The full text of this ransom note reads as follows:
'Fuck_You was Encrypt your File
Send 50 USD BTC Address [RANDOM CHARACTERS]
Then meet me
my email unixc47@gmail.com'
Protecting Your Data from the Fuck_You Ransomware and Similar Attacks
The best protection against threats like the Fuck_You Ransomware is to have file backups. Malware researchers recommend that computer users back up their data regularly using the cloud or an external memory device. Having file backups allows computer users to recover from a the Fuck_You Ransomware attack quickly, simply by deleting the encrypted files and restoring them with backup copies (after removing the Fuck_You Ransomware infection itself with a reliable security program that is fully up-to-date). Avoid paying the Fuck_You Ransomware ransom. It is common for con artists to ignore the payment or go back and ask victims to pay even more money after they make the payment. More importantly, paying the Fuck_You Ransomware ransom allows con artists to continue creating these threats, financing other attacks and compromising an increasing number of computers. Apart from file backups, computer users should establish strong security protocols to avoid these infections. This means learning to handle email messages and attachments safely and avoiding common online sources for these threats. A reliable security program that is fully up-to-date also should be used to intercept and remove these infections.
Analysis Report
General information
| Family Name: | HEUR.Ransomware.MSIL.Generic |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
b98b3b36a6b91c63e4968f91943974a8
SHA1:
33e3edde26b656ca10dd2a5a55af0944fdb50f68
SHA256:
A521534C20569EB1D2E83119D7481A8CA75B9782B29D5A2270EA3B92E2A8F105
File Size:
3.64 MB, 3636736 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is .NET application
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 2.6.71.0 |
| Company Name | Bogdan Pătrăucean |
| File Description | Wintoys |
| File Version | 2.6.71.0 |
| Internal Name | Wintoys.dll |
| Legal Copyright | Copyright © Bogdan Pătrăucean |
| Original Filename | Wintoys.dll |
| Product Name | Wintoys |
| Product Version | 2.6.71.0 |
File Traits
- .NET
- Run
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 8,229 |
|---|---|
| Potentially Malicious Blocks: | 29 |
| Whitelisted Blocks: | 6,227 |
| Unknown Blocks: | 1,973 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| User Data Access |
|
