ws Ransomware

The ws Ransomware is a cryptovirus capable of encrypting the data on targeted computers in an effort to extort money from the victims to the data return. Since its architecture bears a striking resemblance to the notorious ZQ ransomware threat, the ws Ransomware might as well be a modified variant of the ZQ Ransomware. Once inside the targeted PC system, the ws Ransomware starts encrypting various data types – documents, photos, multimedia and other valuable files. Each infected file gets a new extension, namely
‘[w_unblock24”qq.com].ws.’

That extension is quite similar to what the ZQ Ransomware appends when attacking PC users – [w_decrypt24”qq.com].zq, – which is yet another point in favor of the suspected connection between the two threats. Whether such similarity exists between the ransom notes, however, has yet to be confirmed. What is known is that PC users falling victim to the ws Ransomware get a note in the form of a text file dubbed
‘{HELP24DECRYPT}.txt.’ The note in question is one of the shortest ever recorded. Apart from urging the victims to contact the threat actors at w_unblock24”qq.com, the note provides next to none further details. The latter are provided on request. Considering that the vast majority of ransomware actors demand payment in Bitcoin which often reaches hundreds (and even thousands) of dollars, the team behind the ws Ransomware is very likely to require an identical amount of money or thereabouts.

Most ransomware threats in circulation rely on spam email campaigns and malvertising techniques to reach their targets, and the ws Ransomware does not go off the beaten path, either. That is why steering clear of suspicious-looking emails and websites is of paramount importance to maintaining a malware-free PC experience.