PACMAN Wakka Wakka Ransomware
The PACMAN Wakka Wakka Ransomware Trojan is an encryption ransomware Trojan. The PACMAN Wakka Wakka Ransomware was first observed on April 1, 2019. The PACMAN Wakka Wakka Ransomware carries out a typical encryption ransomware attack, taking the victim's files hostag. Then the victims must pay a ransom to get a decryption tool. While the PACMAN Wakka Wakka Ransomware attack itself is identical to most similar threats, the PACMAN Wakka Wakka Ransomware stands out because of its branding, which includes a GIF animation of the classic video game PACMAN.
How the PACMAN Wakka Wakka Ransomware Carries Out Its Attack
The PACMAN Wakka Wakka Ransomware is typically delivered to the victim's computer through corrupted spam email attachments or corrupted file downloads. Once the PACMAN Wakka Wakka Ransomware is installed, this malware threat scans the victim's computer for the user-generated files, such as databases, media files, configuration files and numerous others. The following are examples of the files that threats like the PACMAN Wakka Wakka Ransomware search for in these attacks:
.jpg, .jpeg, .raw, .tif, .gif, .png, .bmp, .3dm, .max, .accdb, .db, .dbf, .mdb, .pdb, .sql, .dwg, .dxf, .cpp, .cs, .h, .php, .asp, .rb, .java, .jar, .class, .py, .js, .aaf, .aep, .aepx, .plb, .prel, .prproj, .aet, .ppj, .psd, .indd, .indl, .indt, .indb, .inx, .idml, .pmd, .xqx, .xqx, .ai, .eps, .ps, .svg, .swf, .fla, .as3, .as, .txt, .doc, .dot, .docx, .docm, .dotx, .dotm, .docb, .rtf, .wpd, .wps, .msg, .pdf, .xls, .xlt, .xlm, .xlsx, .xlsm, .xltx, .xltm, .xlsb, .xla, .xlam, .xll, .xlw, .ppt, .pot, .pps, .pptx, .pptm, .potx, .potm, .ppam, .ppsx, .ppsm, .sldx, .sldm, .wav, .mp3, .aif, .iff, .m3u, .m4u, .mid, .mpa, .wma, .ra, .avi, .mov, .mp4, .3gp, .mpeg, .3g2, .asf, .asx, .flv, .mpg, .wmv, .vob, .m3u8, .dat, .csv, .efx, .sdf, .vcf, .xml, .ses, .qbw, .qbb, .qbm, .qbi, .qbr , .cnt, .des, .v30, .qbo, .ini, .lgb, .qwc, .qbp, .aif, .qba, .tlg, .qbx, .qby , .1pa, .qpd, .txt, .set, .iif, .nd, .rtp, .tlg, .wav, .qsm, .qss, .qst, .fx0, .fx1, .mx0, .fpx, .fxr, .fim, .ptb, .ai, .pfb, .cgn, .vsd, .cdr, .cmx, .cpt, .csl, .cur, .des, .dsf, .ds4, , .drw, .eps, .ps, .prn, .gif, .pcd, .pct, .pcx, .plt, .rif, .svg, .swf, .tga, .tiff, .psp, .ttf, .wpd, .wpg, .wi, .raw, .wmf, .txt, .cal, .cpx, .shw, .clk, .cdx, .cdt, .fpx, .fmv, .img, .gem, .xcf, .pic, .mac, .met, .pp4, .pp5, .ppf, .nap, .pat, .ps, .prn, .sct, .vsd, .wk3, .wk4, .xpm, .zip, .rar.
The PACMAN Wakka Wakka Ransomware will then use a strong encryption algorithm to make the victim's files inaccessible. The PACMAN Wakka Wakka Ransomware encrypts the files in a way that they will no longer function and will be marked with the string '.encrypted' added to the files' names. Notably, the PACMAN Wakka Wakka Ransomware adds this string to the file's name before its normal extension rather than after, unlike most other ransomware threats.
The PACMAN Wakka Wakka Ransomware's Ransom Demands
The PACMAN Wakka Wakka Ransomware delivers a ransom note. To do this, the PACMAN Wakka Wakka Ransomware creates a program window with the title 'Pacman,' which includes the PACMAN GIF, as well as the following text message for the victim:
'[English|BUTTON] [Deutsch|BUTTON]
Sorry, your files have been eaten (encrypted) by Pacman...
To decrypt your files, a fee paid in Bitcoin is required. Pacman will scan the Bitcoin Blockchain to check for your payment and automatically decrypt your files, after the payment has been made.
Amount USD [1500]
Amount BTC [0.2]
Bitcoin Address [17yKCVNb7EQQpr5ABKGcVpGSPVWFTxhReR]
[Check for payment|BUTTON]
Help
How to buy Bitcoin? (click)
Further Assistance? Write to pacman.support@protonmail.com'
Computer users should refrain from paying the PACMAN Wakka Wakka Ransomware's ransom of 0.2 BTC or 1,500 USD. It also is recommended to refrain from contacting the criminals responsible for the PACMAN Wakka Wakka Ransomware via email, which just serves to make the victim vulnerable to further tactics and infections. Instead, computer users should use file backups and disk images to restore any data compromised by the PACMAN Wakka Wakka Ransomware attack.
