Ranstop blocks Bansomqare ransomware

Test subject Bansomqare ransomware

“Bansomqare Wanna” is relatively new ransomware with some particularities, even though it has partly similar code with the infamous WannaCry. It is distributed using email campaigns and infected documents, and it disguises itself as the popular mobile app WhatsApp to trick the user into running the executable.

Bansomqare ransomware test facts

Once executed, the malware will gather some info on the victim’s system, like computer name, configuration files, IP address and then immediately starts encrypting user files, including executables. It will not wait for the encrypting process to finish and will display the ransom note with recovery steps as well. While the user finally realizes that he has been the victim of ransomware, all the files are probably already encrypted.

The attacked files are easily recognizable by their new extension, which is “.bitcoin”. The ransom itself is not a fortune (approx $100 worth of bitcoin), but without paying it, there’s no way to decrypt the files. Another ransom note is dropped on the desktop once encryption finishes, in a text file called bitcoin2018.txt, containing the wallet where the payment is to be made. While it is tempting, we will never recommend going down this road, as the cybercriminals may use the extracted data to damage the victim’s assets further.

Bansomqare ransomware test results

TEMASOFT Ranstop detects Bansomqare ransomware shortly after it starts encrypting files. When Ranstop finds the threat, the user is alerted, the malicious process is killed, and its executable quarantined. The affected files are automatically restored so that the user doesn’t lose any valuable document.

Click here to watch TEMASOFT Ranstop blocking Bansomqare ransomware (video)!

Learn how to protect against ransomware!

About TEMASOFT Ranstop

TEMASOFT Ranstop is an anti-ransomware software that detects present and future ransomware, based on file access pattern analysis with a high degree of accuracy. At the same time, it protects user files so that they can be restored in case of malware attacks or accidental loss.

For more information, follow us on social media and subscribe to our newsletter.

Follow @TemasoftSRL