Wannabitcoin Ransomware

WannaBitcoin is a ransomware threat designed to encrypt files and make them inaccessible for affected users. A characteristic feature of this malware is that it appends the ".wannabitcoin" extension to the encrypted files’ names. For example, if the original name of a file is "1.jpg", it would be modified to "1.jpg.wannabitcoin”.

Once the encryption is over, the WannaBitcoin Ransomware generates three ransom notes. The WannaBitcoin Ransomware shows the first ransom note in the form of a pop-up window. The second one is created as a text file named "READ ME TO RECOVER YOUR FILES.wannabitcoin.txt." Finally, WannaBitcoin changes the desktop wallpaper on the infected computer.

The last two ransom notes instruct victims to send 1 ETH to the provided Ethereum wallet, while the message in the pop-up window says that data recovery would cost the user 0.5 BTC (Bitcoin). Unlike many other ransomware attacks, the attackers behind the WannaBitcoin Ransomware do not provide any contact information.

Unfortunately, it is usually not possible to decrypt files without a working decryptor tool provided by the cybercriminals who developed the ransomware. Moreover, paying the ransom is no guarantee that you will receive a decryption tool. Therefore, it is best to prevent ransomware attacks from happening by using a certified anti-malware program and limit potential damages by keeping your data well backed up.

The text in the WannaBitcoin pop-up message:

'WannaBitcoin

Your files have been encrypted !

Your files have been encrypted !

Your file will can't recovery permanently on -

Your files have been encrypted !

What Happened?

Your important files are encrypted.

Your documents, photos, video, databases and other files are can’t access because your files have encrypted by RSA-8192.

Can I Recover My Files ?

You can decrypt your files using our decrypt but you need to pay for it. It cost 0.05 BTC.

How Do I Pay ?

Payment is accepted in Bitcoin only. For more information, click .

Please check the current price of Bitcoin and buy some bitcoins. For more information, please click .

Remember to send the correct amount to the address specified in window.

After your payment, click .

Once the payment is checked, you can start decrypting your files immediately.

[What is ethereum?]

[Check payment]”

The following text is located in the text file:

“All of your files have been encrypted by WannaBitcoin.

To dercrypt your files 1 to: 0xF37552d92C1EB2b3e57965649fa2c5f94bE8F18A

After you sent 1 ETH, please click on the Check Payment button.

Encryption Log:

----------------------------------------

-“

The text in the wallpaper says the following:

“Your files have been encrypted !

Sent 1 ETH to "0xF37552d92C1EB2b3e57965649fa2c5f94bE8F18A"

For more detail, please open

"READ ME TO RECOVER YOUR FILES.wannabitcoin'