Pennywise Ransomware

Posted: November 3, 2017
Threat Metric
Threat Level: 1/10
Infected PCs 319

Pennywise Ransomware Description

The Pennywise Ransomware is a variant of the Jigsaw Ransomware, a Trojan that can block or delete media according to its threat actor's parameters, such as targeting specific formats or folders. Because it represents an active and ongoing risk to the data on your PC, all users should abide by security standards that can block this threat from installing and avoid notable infection vectors, such as e-mail attachments. Malware experts also recommend being cautious about triggering further attacks unintentionally before you can remove the Pennywise Ransomware infections with a traditional anti-malware solution.

A Clown Performing for Your Files

Although its authors designed it as being a Halloween-themed threat presumably, the Pennywise Ransomware is a still in construction Trojan, with features drawing from the previous and somewhat infamous Jigsaw Ransomware. Recent samples of the Pennywise Ransomware's executable only operate in a debugging mode without any attacks. However, a complete version could indulge in activities that block or delete content on an infected PC, along with displaying ransom messages that it may use for locking the screen, as well.

Although the Pennywise Ransomware's only GUI, for the victim, is its ransoming pop-up, the Trojan also runs continuously in the background as multiple memory processes, all of which include names to misrepresent them as being other software, such as the Firefox browser. Besides being able to encode and block different files, including GIF pictures, DOCX documents, and other media, the Pennywise Ransomware also appends '.beep' extensions to their names. Like other Jigsaw Ransomware variations, the Pennywise Ransomware also has the potential capability of deleting one encoded file every hour and will erase an additional thousand every time it opens (which it does by default when Windows starts).

The Pennywise Ransomware's pop-up carries the threat actor's ransom demands and includes a timer referencing the file-erasing feature, along with a decryption field for unlocking your data. Due to being incomplete, the Pennywise Ransomware doesn't display a current ransom payment request, although malware experts anticipate future versions to use non-refundable methods like Bitcoin or Paysafecard. The only significant change from the old Jigsaw Ransomware is the Pennywise Ransomware's use of Pennywise the Clown-themed image, instead of the previous depiction of the villain of the movie franchise Saw.

Quitting the Clowning Around with Your PC

While the Pennywise Ransomware isn't ready for a live deployment, most of the work of programming its payload is already complete, thanks to the original Jigsaw Ransomware. Victims could trigger the mass erasure of their media unintentionally by rebooting their PCs and relaunching the Pennywise Ransomware accidentally. Even if they avoid any additional, file-deleting attacks, the Pennywise Ransomware can block local files permanently by encoding their contents. While free decryption programs do exist for the Jigsaw Ransomware, new updates like the Pennywise Ransomware often require additional work from cybersecurity professionals to patch the solutions into having renewed compatibility.

Threats of the Pennywise Ransomware's classification often circulate with the help of spam campaigns that use e-mails to trick their victims into opening unsafe content, such as document macros. Other attacks may use corrupted website scripts to exploit vulnerabilities in your PC that could enable the Pennywise Ransomware's automatic installation. Professional anti-malware products usually include multiple defenses against these attacks, and malware experts strongly recommend using them for uninstalling the Pennywise Ransomware with as little delay as possible.

The Pennywise Ransomware is a new face for an old fear: a con artist's plan for extortion that's held up by a foundation of hourly, file-destroying threats. Clownish performance pieces like the Pennywise Ransomware do well to show that forgetting to backup your files and mind your security guidelines can be mean many things, but funny isn't one of them.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Pennywise Ransomware may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Home Malware Programs Ransomware Pennywise Ransomware

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.