December 09, 2016

Yesterday a new in-development ransomware was discovered by MalwareHunterTeam called Popcorn Time that intends to give victim's a very unusual, and criminal, way of getting a free decryption key for their files. With Popcorn Time, not only can a victim pay a ransom to get their files back, but they can also try to infect two other people and have them pay the ransom in order to get a free key.

To make matters worse, there is unfinished code in the ransomware that may indicate that if a user enters the wrong decryption key 4 times, the ransomware will start deleting files.

It should be noted, that this ransomware is not related to the Popcorn Time application that downloads and streams copyrighted movies.

Want a free decryption? Just be a scumbag!

In a move that we have not seen with any other ransomware, the ransomware developer offers a "nasty way" for a victim to get a free decryption key by having them help to spread the ransomware. If two people become infected via the victim's "referral" link" and pay the ransom, then the victim will supposedly get a free key.

To facilitate this, the Popcorn Time ransom note will contain a URL that points to a file located on the ransomware's TOR server. At this time the server is down, so it is unsure how this file will appear or be disguised in order to trick people to install it.

                                                                             Popcorn Time Referral URL

Enter the wrong decrypt code 4 times and you files may be deleted

When Popcorn Time is executed it will display a lock screen as shown below, but filled in with various information relating to your particular installation. For example, [UID] will be replaced with the victim's unique ID and the [WADDRESS] field will be replaced with the bitcoin address you should send payment too.

There is also a field where a victim can enter the decryption code that will be given to them if they pay the ransom.

                                                                                 Popcorn Time Screen

The source code for this ransomware indicates that the developer may add a function that deletes a victim's files if you enter the wrong decrypt code 4 times.

                                                                              Delete Files Source Code

Since the ransomware is still in development, it is unknown whether this is just a scare tactic or if the code for deleting files will eventually be added. As this developer has already sunken to new lows by offering the chance of free decryption keys to those who help spread the ransomware, it would not be surprising if this feature was added.

How the Popcorn Time Ransomware Encrypts a Computer

Once started, the Popcorn Time ransomware will check to see if the ransomware has been run already by checking for various files such as %AppData%\been_here and %AppData%\server_step_one. If the been_here file exists, it means the computer has already been encrypted and the ransomware will terminate itself. Otherwise, it will either download various images to use as backgrounds or start the encryption process.

As this ransomware is currently in development, it only targets a test folder on the victim's desktop called Efiles. It will search this folder for files that match certain extensions and then encrypt them using AES-256 encryption. When a file is encrypted it will have the .filock extension appended to it. So a file called test.jpg would be encrypted as test.jpg.filock.

The targeted extensions are:
While encrypting the files, it will display a screen that pretends to be the installation of the program.

                                                                                 Fake Installation Screen

When the infection has finished encrypting a computer it will convert two base64 strings and save them as ransom notes called restore_your_files.html and restore_your_files.txt. It will then automatically display the HTML ransom note.

                                                                                        HTML Ransom Note

As already stated, this ransomware is currently in development, so many things may change over time.  As this ransomware develops, we will release new information.

Files associated with the Popcorn Time Ransomware
Registry entries associated with the Popcorn Time Ransomware
Network Communication associated with the Popcorn Time Ransomware
Installer Hashes
News Courtesy : https://www.bleepingcomputer.com/news/security/new-scheme-spread-popcorn-time-ransomware-get-chance-of-free-decryption-key/