Wanna Decrypt0r 4.0 Ransomware

The Wanna Decrypt0r 4.0 Ransomware is a newly detected data-encrypting Trojan. This Trojan belongs to the JigSaw Ransomware family.

Propagation and Encryption

There are multiple infection vectors that can be utilized in the distribution of ransomware threats. Among them are malvertising campaigns, torrent trackers, bogus software updates and downloadvertisements, etc. One of the most well liked used tricks is spam emails. The targeted users receive an email from a seemingly trustworthy party that urges them to open the attached file. The attachment often appears to be nothing more than a simple document file. However, if the users trust the email’s fake message and open the attachment, they will allow the Wanna Decrypt0r 4.0 Ransomware to compromise their PC.

The Wanna Decrypt0r 4.0 Ransomware likely goes after numerous filetypes to ensure that maximum damage is done to the targeted host. If the Wanna Decrypt0r 4.0 Ransomware infects your computer, it will lock all your images, audio files, documents, videos, databases, archives, presentations, spreadvertisementsheets, etc. The targeted data is locked with an encryption algorithm. The affected files’ names will be changed after the Wanna Decrypt0r 4.0 Ransomware has concluded its encryption process. This data-encrypting Trojan adds a ‘.WNCRY’ extension to the newly locked files. This means that a file that was named ‘golden-glass.jpeg’ originally, will be renamed to ‘golden-glass.jpeg.WNCRY.’ Bu using the ‘.WNCRY’ extension, it would appear that the authors of the Wanna Decrypt0r 4.0 Ransomware are attempting to mimic the infamous WannaCry Ransomware that left thousands of users with encrypted data several years ago. However, as we already mentioned, the Wanna Decrypt0r 4.0 Ransomware is not a variant of the WannaCry Ransomware but the JigSaw Ransomware.

The Ransom Note

The Wanna Decrypt0r 4.0 Ransomware would spawn its creators’ ransom message in a new window. The victim has one hour to complete the payment, as there is a countdown displayed in the window that contains the ransom message. The authors of the Wanna Decrypt0r 4.0 Ransomware demand to be paid at least $50 in Bitcoin as a ransom fee. They warn users that their decryption key will be deleted permanently if they seek help from cybersecurity experts. The victim is asked to send an email to ‘wannacry.decryptor_v4@protonmail.com’ to receive further instructions.

The good news is that you may be able to recover your data without having to deal with the cybercriminals responsible for the Wanna Decrypt0r 4.0 Ransomware. Since the Wanna Decrypt0r 4.0 Ransomware is a copy of the JigSaw Ransomware, you may be able to decrypt your locked files with the help of the ‘JigSaw Decryptor’ tool, which is freely available online. Make sure your PC is protected by a reputable antivirus software suite so that you do not fall victim to ransomware again.