New DeepWeb Site Offers Free Ransomware Creation

Posted by: DeepDotWeb

May 27, 2015

Not long we reported about a new market selling Zero day exploits, and it seems that exploits are becoming more common than ever on the deepweb. Recently a new site was launched and started offering free creation of ransomware – in exchange for 30% of the BTC profits made from ransoms. According to the site itself (toxicola7qwv37qj.onion):

What is Tox?

We developed a virus which, once opened in a Windows OS, encrypts all the files.
Once this process is completed, it displays a message asking to pay a ransom to a bitcoin address to unlock the files.

How do I make money with Tox?

You can subscribe (no mail or other shit needed) and create your virus. You will have to decide the ransom to unlock the files.
Once you have downloaded your virus, you have to infect people (yes, you can spam the same virus to more people). How? That’s your part. The most common practice to spam it as a mail attachment. If you decide to follow this method be sure to zip the file to prevent antivirus and antispam detection.
The most important part: the bitcoin paid by the victim will be credited to your account. We will just keep a 30% fee of the income, so if you specify a 100$ ransom, you will get 70$ and we’ll get 30$, isn’t this fair?

F.A.Q.
Are you serious?
Yes, why not? This is the best way for us to infect a lot of people and make a lot of money.
Am I safe?
Sure, as long as you use tor and don’t use personally identifiable information: we don’t need to know you, and you don’t need to know us. The only thing we’ll ask you is the bitcoin address to withdraw your part.
Are you going to steal my profit?
Nope, why should we? The best way for us to make money is having you helping us.
Then why aren’t you spreading the virus yourself?
We are! But with you, we’re going to have a bigger income.
Why is the file a .scr?
Because in this way people will not suspect anything (who knows what is a .scr?). If you wish, you can change it to .exe it’ll work the same.
How does the virus look?
Sexy. The virus has a .src extension (same as .exe files) and it has the icon of a word document, so the victim wont be suspecting anything.
Will you actually decrypt the files once the ransom is paid?
Yes, we will. We want people to trust us, so that more people will pay the ransom.
How dow I withdraw the money?
In the virus section you can monitor the status of all your viruses. When you have bitcoins to withdraw, just enter your address and press the Withdraw button

We did not take the ransomware to a test drive, but a blog post from mcafee.com shows exactly how it works. It was reported by other blogs that several anti virus softwares are able to detect the ransomware.

Updated: 2015-05-27