WannaDie Ransomware

The WannaDie Ransomware is a Trojan that blocks your files and uses visual and text-based delivery methods for its accompanying ransom demands. Note that while the Trojan's symptoms are similar to those of the WannaCryptor Ransomware or the '.wcry File Extension' Ransomware, this program is an unrelated threat that requires a custom unlocking solution. Due to the potential absence of such solutions, malware experts recommend that you protect your computer with a combination of backups and anti-malware products that can delete the WannaDie Ransomware immediately.

A Trojan that's Dying to Meet Your Files

Threat actors are finding more of interest to attack in Russia, and file-locking Trojans such as the BadRabbit Ransomware and the Relock Ransomware are demonstrating campaigns that are slightly more unique than the usual fork of Hidden Tear routinely. Another Trojan of this ilk, the WannaDie Ransomware, has begun imitating a preexisting family, which might help keep its files locked for long enough to force payments from the victims. The WannaDie Ransomware is very similar to the WannaCryptor Ransomware symptomatically, including the cosmetic choices in how it negotiates with the user.

Malware researchers are finding both encryption-functional and non-functional variants of the WannaDie Ransomware, which may be the result of the creator's testing AV databases at different stages of development. Versions of the WannaDie Ransomware that use working data-encoding attacks can block several formats of files, such as documents, with a still-unknown cipher, and also add '.wndie' extensions to their names.

Without the decryption key that reverses this encoding routine, the media is unusable, although the WannaDie Ransomware's threat actors offer to sell the key to the decryption module. They deliver these ransoming demands through an interactive HTA pop-up that also includes a timer (before the price increases or he deletes the key) and a Bitcoin address for collecting the payment. Malware experts are identifying Russian versions of the WannaDie Ransomware's imitative ransom note only, although the file-locking feature should work equally well on Windows PCs using other language settings.

Preventing Errant Threats from Making Their Way to Your Media

Although its most detailed instructions are inside the HTA pop-up component, the WannaDie Ransomware also has a handful of other symptoms, including swapping the user's default background and opening a custom-generated Notepad document automatically. While all of these characteristics promote the WannaDie Ransomware's ransom-based decryptor, malware experts sometimes rate these decryption solutions as imperfect or fraudulent. Contact appropriate security researchers for any help you may need with acquiring a free decryption program or use backups to keep your files out of the reach of the WannaDie Ransomware's attacks.

The WannaDie Ransomware campaign has yet to reach a stage of wide distribution against either public or private entities. Infection methods that often help distribute file-locking threats include fake documents and archives attaching themselves to spam e-mails, intentionally misnamed downloads on torrent networks, and the exploit kits that the cybercrooks host on compromised websites. Most methods are preventable with anti-malware programs detecting and deleting the WannaDie Ransomware before any of the symptoms in this article ever occur.

Going by sight with a Trojan infection sometimes is a greased slide towards incorrect conclusions, with more file damage being a common consequence. Users only should take file-locking threats like the WannaDie Ransomware at their word if they don't care whether or not the solutions they're buying are real or fake.