Before cybercriminals used crypto mining scripts to illegally exploit CPU, ransomware like WannaCry infected computers around the world. However, this threat has not gone away, as every now and then, a new and interesting ransomware makes its appearance again.
And that's where "Barack Obama's Everlasting Blue Blackmail Virus" comes in. The ransomware was first reported by MalwareHunterTeam (via Bleeping Computer). It appears that for now, the malware only encrypts .EXE on Windows machines.
Being ransomware, it obviously comes with a ransom note. In this case the note displays an image of Barack Obama and a “tip” to unlock the files. The tip mentions the ransom payment instructions and asks the user to contact a specific email address for more information.
As for the encryption performed by the ransomware, it does not add any special or custom extension. The new extension is added as secondary to render the files unusable.
It also deletes all Shadow Volume Copies from Windows machines. This is done to make it difficult to recover files. The malware also modifies registry keys associated with files and executes itself whenever someone attempts to open an .EXE file.
It is obvious that users are urged to avoid paying any kind of ransom to criminals. Such an action will likely encourage them to extort them even more.
