| Jigsaw | |
|---|---|
| Technical name | BitcoinBlackmailer |
 | |
| Classification | Ransomware |
| Isolation date | 2016 |
| Technical details | |
| Platform | Windows |
| Size | 284 KB |
| Written in | VB.net |
Jigsaw is a form of encryptingransomwaremalware created in 2016. It was initially titled "BitcoinBlackmailer", but later came to be known as "Jigsaw" due to featuring an image ofBilly the Puppet from theSaw film franchise.[1] The malware encrypts computer files and gradually deletes them, demanding payment of a ransom to decrypt the files and halt the deletion.[2]
Jigsaw was designed in April 2016 and released a week after creation.[1] It was designed to be spread through malicious attachments in spam emails.[3] Jigsaw is activated if a user downloads the malware program which will encrypt all user files andmaster boot record.[4] Following this, a popup featuring Billy the Puppet will appear with the ransom demand in the style ofSaw'sJigsaw (one version including the "I want to play a game" line from the franchise) forBitcoin in exchange for decrypting the files.[5] If the ransom is not paid within one hour, one file will be deleted.[5] Following this for each hour without a ransom payment, the amount of files deleted is exponentially increased each time from a few hundred to thousands of files until the computer is wiped after 72 hours.[2] Any attempt to reboot the computer or terminate the process will result in 1,000 files being deleted.[5] A further updated version also makes threats todox the victim by revealing their personal information online.[6]
Jigsaw activates purporting to be eitherFirefox orDropbox in thetask manager.[2] As Jigsaw stores the decryption key statically in the binary, it can be extracted from the binary using a hex editor or .NET decompiler to remove the encryption without paying the ransom.[1]
The Register wrote that "Using horror movie images and references to cause distress in the victim is a new low."[1] In 2017, it was listed among 60 versions of ransomware that utilised evasive tactics in its activation.[7]
