Jigsaw (ransomware)
{{Short description|Encrypting ransomware created in 2016}}
{{Infobox computer virus
| fullname = Jigsaw
| image = File:Jigsaw_ransomware.png
| common_name =
| technical_name = BitcoinBlackmailer
| aliases =
| family =
| classification = Ransomware
| type =
| subtype =
| isolation_date = 2016
| origin =
| infection_vector =
| author =
| ports_used =
| OS = Windows
| filesize = 284 KB
| language = VB.net
}}
Jigsaw is a form of encrypting ransomware malware created in 2016. It was initially titled "BitcoinBlackmailer", but later came to be known as "Jigsaw" due to featuring an image of Billy the Puppet from the Saw film franchise. The malware encrypts computer files and gradually deletes them, demanding payment of a ransom to decrypt the files and halt the deletion.{{cite web|last=Osborne |first=Charlie |url=https://www.zdnet.com/article/tick-tock-jigsaw-ransomware-deletes-your-files-as-you-wait/ |title=Tick, tock: Jigsaw ransomware deletes your files as you wait |publisher=ZDNet |date=2016-04-22 |access-date=2018-02-20}}
History
Jigsaw was designed in April 2016 and released a week after creation. It was designed to be spread through malicious attachments in spam emails.{{cite web|url=http://www.ibtimes.co.uk/jigsaw-ransomware-saw-inspired-malware-deletes-files-bit-by-bit-hourly-until-you-pay-1554862 |title=Jigsaw ransomware: Saw-inspired malware deletes files bit by bit hourly until you pay |work=International Business times |date=2016-04-14 |access-date=2018-02-20}} Jigsaw is activated if a user downloads the malware program which will encrypt all user files and master boot record.{{cite web |url=https://www.geek.com/news/jigsaw-ransomware-wants-to-play-a-game-with-you-1652249/ |title=Jigsaw ransomware wants to play a game with you |publisher=Geek.com |date=2016-04-13 |access-date=2018-02-20 |archive-date=2018-07-18 |archive-url=https://web.archive.org/web/20180718171530/https://www.geek.com/news/jigsaw-ransomware-wants-to-play-a-game-with-you-1652249/ |url-status=dead }} Following this, a popup featuring Billy the Puppet will appear with the ransom demand in the style of Saw's Jigsaw (one version including the "I want to play a game" line from the franchise) for Bitcoin in exchange for decrypting the files. If the ransom is not paid within one hour, one file will be deleted.{{cite web|url=https://www.bleepingcomputer.com/news/security/jigsaw-ransomware-decrypted-will-delete-your-files-until-you-pay-the-ransom/ |title=Jigsaw Ransomware Decrypted: Will delete your files until you pay the Ransom |publisher=Bleeping Computer |date=2016-04-11 |access-date=2018-02-20}} Following this for each hour without a ransom payment, the amount of files deleted is exponentially increased each time from a few hundred to thousands of files until the computer is wiped after 72 hours. Any attempt to reboot the computer or terminate the process will result in 1,000 files being deleted. A further updated version also makes threats to dox the victim by revealing their personal information online.{{cite web|first=Dan |last=Goodin |url=https://arstechnica.com/information-technology/2016/06/meet-jigsaw-the-ransomware-that-taunts-victims-and-offers-live-support/ |title=Meet Jigsaw, the ransomware that taunts victims and offers live support |publisher=Ars Technica |date=2016-06-28 |access-date=2018-02-20}}
Jigsaw activates purporting to be either Firefox or Dropbox in the task manager. As Jigsaw stores the decryption key statically in the binary, it can be extracted from the binary using a hex editor or .NET decompiler to remove the encryption without paying the ransom.{{cite web|url=https://www.theregister.co.uk/2016/04/20/jigsaw_ransomware/ |title=Saw-inspired horror slowly deletes your PC's files as you scramble to pay the ransom |publisher=The Register |access-date=2018-02-20}}
Reception
The Register wrote that "Using horror movie images and references to cause distress in the victim is a new low." In 2017, it was listed among 60 versions of ransomware that utilised evasive tactics in its activation.{{cite web|url=https://www.prnewswire.com/news-releases/minerva-labs-releases-evasive-malware-2017-year-in-review-300570595.html |title=Minerva Labs Releases Evasive Malware 2017 Year in Review |publisher=Prnewswire.com |date=2017-12-07 |access-date=2018-02-20}}
References
{{reflist}}
{{Hacking in the 2010s}}
{{Saw (franchise)}}