CoderWare Ransomware Extorts $1,000 Payments From Its Victims

A file-encrypting s by the name of CoderWare has been spotted  extorting payments from innocent victims. CoderWare ransomware follows the classic patterns of encrypting data, blackmailing victims, and collecting Bitcoin payments.

Researchers warn that CoderWare is developed solely for ransom extortion purposes. The creators of this menace are ruthless criminals who will not hesitate to double-cross their victims.

CoderWare’s Distribution Vector

Like many other ransomware threats, CoderWare relies on mass-distribution techniques, such as phishing messages, torrent platforms, unofficial software activation tools, and malicious advertisements. Trojan horse viruses could also drop the threat as second-stage malware.

However, researchers point out that the most common cause of ransomware infections is the phishing message. Whether through emails or instant messages, criminals exploit the current news and events to create socially-engineered traps. These tricksters also deploy a technique called "spoofing" to make their malicious messages seem sent from legitimate sources.

How Does CoderWare Ransomware Operate

Upon infiltration, CoderWare will establish persistence by creating entries in the system registry. The ransomware will also attempt to prevent quick file recovery operations by deleting the shadow volume copies (automatic backups used by Windows OS).

CoderWare will also launch a scan that detects the user-generated files, such as pictures, databases, archives, and presentations. The threat is looking for files containing valuable information that could be used as leverage in future ransom negotiations.

The ransomware will use cryptographic algorithms to encrypt the detected files and restrict the user's permissions. This oration won't delete the data but will instead "lock" it so that it is inaccessible to the user.

As a final step of the encryption operation, CoderWare will rename the corrupted files by adding the".DEMON" extension to them. For example, a file named "presentations.rar" will be renamed to "presentations.rar.DEMON."

Ransom Demands

Upon completing the file encryption procedure, CoderWare will display a pop-up window and create a text file called "README.txt,"  both of which contain a ransom demanding message.

Ransom Note Text:

CoderWare's ransom note contains detailed instructions on how a ransom should be paid. Victims are told to transfer $1,000-worth of Bitcoin to a specified cyber wallet. Upon completing the transaction, they are instructed to prove that the payment is successful by forwarding the transaction receipt to the tuhafcoderus@protonmail.com email address.

Victims have only 10 hours to finalize the payment transaction. They are warned that the only decryption key will be permanently deleted if they fail to meet the tight deadline.

However, researchers advise against paying the ransom as such actions will encourage the criminals to continue their illegal operations.

Data recovery

Sadly, as CoderWare was discovered only recently, there are no alternative decryption tools for its lock yet. Of course, backups stored on external and cloud devices could be used for data recovery.

However, victims are recommended not to get in touch with the threat operators because these criminals are experienced manipulators who promise miracles but rarely deliver.

Practice shows that when ransomware victims face challenges with the decryption procedure, the criminals often choose to ignore their pleas. Experts explain that this could be due to the fact the threat operators are people who lack the technical skills to provide support to their victims. It is also possible that the criminals focus their attention on finding new victims rather than wasting time with the ones who already paid.