In fact, the ransom process has only just started, as you will see if you open the save_your_files.txt file, where the reason for the unlikely claim above is revealed:Īs well as playing the “charitable giving” card as an excuse for blackmail, the crooks have also introduced what we’re calling an affiliate program, by which you can get your files decrypted for free if you infect two other victims who pay up: The crooks haven’t got their ransomware workflow quite right yet, because the save_your_files.html file that appears on the Desktop starts off by thanking you for paying and implausibly claiming that all the ill-gotten gains will be given to the needy: This is just a cover story, or decoy, for what happens next, which leaves you at a page like this:īy this point, files in MyDocuments, MyPictures, MyMusic and your Desktop folder will be encrypted and renamed to end in.

Ironically, considering how many malware attacks involve some sort of well-hidden download along the way, often triggered by document macros or a disguised JavaScript program, Popcorn Time isn’t downloading anything at this point. We aren’t aware of any emails in which this malware has been spammed out, so we’ll start at the point where, for some reason, you’ve either agreed to or been tricked into downloading and running the malware.įirst, it pretends to be downloading and installing something:

Pop corn ti