Jigsaw (ransomware)

Jigsaw
Jigsaw
Technical name	BitcoinBlackmailer
Classification	Ransomware
Isolation date	2016
Technical details
Platform	Windows
Size	284 KB
Written in	VB.net

Jigsaw is a form of encrypting ransomware malware created in 2016. It was initially titled "BitcoinBlackmailer", but later came to be known as "Jigsaw" due to featuring an image of Billy the Puppet from the Saw film franchise.^[1] The malware encrypts computer files and gradually deletes them, demanding payment of a ransom to decrypt the files and halt the deletion.^[2]

History

Jigsaw was designed in April 2016 and released a week after creation.^[1] It was designed to be spread through malicious attachments in spam emails.^[3] Jigsaw is activated if a user downloads the malware program which will encrypt all user files and master boot record.^[4] Following this, a popup featuring Billy the Puppet will appear with the ransom demand in the style of Saw's Jigsaw (one version including the "I want to play a game" line from the franchise) for Bitcoin in exchange for decrypting the files.^[5] If the ransom is not paid within one hour, one file will be deleted.^[5] Following this for each hour without a ransom payment, the amount of files deleted is exponentially increased each time from a few hundred to thousands of files until the computer is wiped after 72 hours.^[2] Any attempt to reboot the computer or terminate the process will result in 1,000 files being deleted.^[5] A further updated version also makes threats to dox the victim by revealing their personal information online.^[6]

Jigsaw activates purporting to be either Firefox or Dropbox in the task manager.^[2] As Jigsaw stores the decryption key statically in the binary, it can be extracted from the binary using a hex editor or .NET decompiler to remove the encryption without paying the ransom.^[1]

Reception

The Register wrote that "Using horror movie images and references to cause distress in the victim is a new low."^[1] In 2017, it was listed among 60 versions of ransomware that utilised evasive tactics in its activation.^[7]