BTCWare Ransomware

Posted: March 27, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	102,315

First Seen:	March 27, 2017
Last Seen:	November 28, 2024
OS(es) Affected:	Windows

The BTCWare Ransomware is a Trojan capable of locking your files with encryption, an attack that supplements the extortion notes it generates for soliciting money. Since the extortionists don't abide by the terms of such agreements necessarily, any victims should use other ways of retrieving their content, when possible. Most anti-malware products can guard against different variants of this threat by removing the BTCWare Ransomware both before and after it starts locking your local content.

The Many Names of a Program that Wants Your Bitcoins

Large families of file-encrypting Trojans are becoming the expected standard, rather than the exception quickly, as Ransomware-as-a-Service continues taking hold of the underground marketplace for threatening software. One family with months of field experience, but with relatively few variants in distribution, is the BTCWare Ransomware. This Trojan's name derives from the under duress demands for Bitcoins or BTC, a cryptocurrency that lets con artists take payments without risking refunds from their dissatisfied victims.

Some variants of the BTCWare Ransomware are as old as several months, such as the Crptxxx Ransomware, although others, like the Master Ransomware, are relatively new. In either case, the primary differences include the format of choice for the BTCWare Ransomware's extortion-themed messages and what types of contact information the Trojan appends to the filenames of any content it attacks. The attack, an encryption-based enciphering routine, also locks you out of opening data such as documents, spreadsheets or pictures.

Examples of ransoming notes malware analysts can confirm within the BTCWare Ransomware family include HTM (Web page) and INF (text) documents. These messages serve little purpose beyond providing a way for the victim to download TOR (a Web-browsing application with additional anonymity features) and plug into the BTCWare Ransomware's Bitcoin ransom-collecting site. Some variants, such as the Master Ransomware, also may prefer to redirect you to an anonymous instant messaging client for the same purpose.

Potentially, a victim can pay these cryptocurrency fees to receive the decryption key, although malware experts recommend using different recovery options (see below).

Stacking Your Files out of a Bitcoin Thief's Sights

The most efficient way of protecting your content from threats of the BTCWare Ransomware's scope is to keep spare backups not saved on a locally-accessible drive, such as detachable USB device or a password-protected cloud server. When such recovery choices are unavailable, victims also can try third-party decryption software, which various security organizations make available for free. The anti-malware sector recently developed a specialized decryptor application for the BTCWare Ransomware that may help you recover any encrypted media without any data loss.

As of the latest attacks under analysis by malware experts, some of the BTCWare Ransomware infections also correlate with network issues, Remote Desktop (or RDP) exploits. This level of access allows a remote attacker to install Trojans like the BTCWare Ransomware, disable important security features or collect your information easily. Removing the BTCWare Ransomware and other known threats should take priority over data recovery, but you also should change passwords and reset network settings that could be responsible for the breach of your PC's security.

Detecting the BTCWare Ransomware by symptoms like a new '.onyon' or '.master' extension on your files is simple, but also risky. For anyone who can't afford to lose what they're saving, keeping a close eye on their networks and Web-browsing habits can prevent them from seeing these symptoms and their attendant problems at all.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

file.exe

File name: file.exe
Size: 311.8 KB (311808 bytes)
MD5: 497c5a51d631d1cd79d5eae21eb2cb92
Detection count: 225
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 26, 2020

%APPDATA%\111svhost.exe

File name: 111svhost.exe
Size: 192.51 KB (192512 bytes)
MD5: d0859aea3795ab294366ca5b5d3ef6cb
Detection count: 40
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%
Group: Malware file
Last Updated: September 19, 2017

%ALLUSERSPROFILE%\!#_READ_ME_#!.hta

File name: !#_READ_ME_#!.hta
Size: 4.12 KB (4126 bytes)
MD5: 0a13b8f171275dc65e883fef727fbf77
Detection count: 35
Mime Type: unknown/hta
Path: %ALLUSERSPROFILE%
Group: Malware file
Last Updated: August 23, 2017

More files

Registry Modifications

The following newly produced Registry Values are:

File name without path#_HOW_TO_FIX_!.htaRegexp file mask%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\vaqet.exe