FANDOM


WannaCryOnClick is a ransomware trojan that is a copycat of WannaCry. Although it is not as sophisticated or threatening as WannaCry, it is capable of carrying out an effective encryption ransomware attack and uses a ransom note that is very similar to the one used by WannaCry. Although it is an effective ransomware trojan, it seems that it is not functional completely, and the version of WannaCryOnClick studied by malware researchers was still under development. It will fail to encrypt the victim's data frequently but will display a ransom note regardless. WannaCryOnClick was first observed in July 2017, and it is likely that it is a version of a ransomware trojan that is still under development.

Payloads

WannaCryOnClick encrypts the victim's files taking them hostage, and then demanding the payment of a large ransom in exchange for the decryption key necessary to recover the affected files.

Ransomware demands an extraordinarily large ransom amount in exchange for the decryption key, $7000 USD to be paid in BitCoins (2.83280 BTC at the current exchange rate). After encrypting the victim's files, it will display a ransom note after encrypting the victim's files. The ransom note appears in a program window named 'Local,' which displays a text written in Turkish. Below is an English translation of WannaCryOnClick's ransom note:

All data in your system is fully encrypted, including your backups. The only way to get your data back fully is 
to send $7,000 to the following bitcoin address. Right now we have full access to your system. We destroyed 
all the data you wanted. Your local and Nas servers and your terminal machines have not been damaged. We 
had no access to the contents of the information and documents. However, if you pay within the prescribed 
period, your files will be restored. If you do not pay and you do not cooperate with us, we will not stop data 
from going public. Once you have completed the transfer, you will have to click on the "Check Payment" 
button. The program will notify us. Do not interrupt the server's internet connection ... When the bitcoin 
transfer is successful, the button will be active.
About Bitcoin How to buy Bitcoins Contact Us [RANDOM CHARACTERS]
Check Payment Decrypt
Community content is available under CC-BY-SA unless otherwise noted.