BTCWare

According to PCRisk, BTCWare is an updated version of a ransomware-type virus called Crptxxx. This ransomware is distributed via a malicious application called "Rogers Hi-Speed Internet". Once infiltrated, BTCWare encrypts files and appends filenames with the ".btcware" extension. Newer variants of this ransomware append .shadow, .payday, .wyvern, .nuclear, .aleta, .gryphon, .nopasaran, .blocking, .xfile, .master, .onyon, .theva, .cryptobyte or .cryptowin extensions to encrypted files. BTCWare then creates an HTM file ("#HOW_TO_FIX!.hta.htm"), placing it on the desktop. Other variants of this ransomware use !#RESTORE_FILES#!.inf file to store their ransom demanding message.

Family metadata imported from Malpedia (Fraunhofer FKIE).