Hello everyone, today we're taking a look at Rensenware
A new ransomware that just came out a few days ago.
In fact I got tweeted about it three times in the span of five minutes,
So I knew it must be pretty good.
However,
this ransomware comes with a twist,
where instead of paying Bitcoins to decrypt your files,
You are forced to play Touhou on the hardest difficulty
and achieve a certain amount of points.
And once you do, your files are automatically decrypted.
You can see I have it here on Windows 10, however if we look at our drives here
We have an "A:" drive, our "C:" drive where everything is running, of course,
Our disk drive, and then our shared folders.
And, very unfortunately, but Rensenware
Will crash when you run it on this because it will try to encrypt files on all drives,
And if it comes across one that it can not actually encrypt,
Then it will crash. Such as the optical disk drive, you can't write to it
And Rensenware can't handle that, so, poof, there it goes. It's gone.
So, let's switch to another operating system where everything is set up just right
So Rensenware can activate.
Alright, so we're here on Windows 7,
and we've actually set this virtual machine up so we have nothing but the "C:" drive,
And so we are good to go, to have Rensenware encrypt our files.
So we have some dummy files here on the desktop.
Just a bunch of sample pictures, jpegs...
We have some music
from Age of Empires II.
Which, you know, it's great.
But we're going to lose it because it's going to be encypted.
We also have our "good document.txt".
"it is good"
Close out of it..
And we have a .zip file
containing the ransomware itself,
which will also be encrypted.
So we will just go ahead and run this.
And it takes no time at all..
..to tell us: "Warning!
Your system have been encrypted by Rensen"
but it actually gets.. uh..
cut off the side here.
So it's encrypted by Rensenware
"What the HELL is it?"
Well.
This anime chick right here..
..i'm assuming.
encrypted all of your files.
Well, all the files of the correct file type.
And now you must play Touhou
to the score of .2 billion on Lunatic level
in order to decrypt it!
So.
Good luck.
Everybody.
It is time to play Touhou and unfortunately the game
does not come bundled with the Ransomware, you have to go out and find it.
Which I did.
And turns out I'm really bad at it, but we're gonna try it anyway.
We'll fire it on up here.
And, I must warn you again: I have no idea what I am doing in this game
because I am terrible.
At bullet hells and shoot 'em ups.
And, we've gotta switch to Lunatic mode.
Well, now it's not even detecting that we're actually running this game.
So, this could be bad..
Oh, there we go. The process is working.
And we gotta choose our anime girl.
I choose you.
I don't know what I'm doing..
..so I choose that.
Sounds good!
Alright! Let's shoot!
Let's get it!
We gotta get our .2 billion points so our files are okay!
If we don't... we're screwed.
Cause we've got some really important stuff on--
Oh no, we died.
Alright - we've got this. That was just a little slip up. It's okay.
We're shooting!
We're shooting things.
We're getting 'em!
Get that guy..
He died.. alright.
We're doing okay!
We're making it.
We are doing..
stuff.
Get that thing! I don't know what that is.
but we need it.
Oh, wow! We've made it quite aways
We're over a hundred thousand points,
we've definitely got this, alright?
Just gotta do that...
...a lot more...
...and we're good!
Blow 'em up!
Get 'em!
Our files are on the line here!
D'ohh... shit.
Well. I lost.
And I did not quite make it to .2 billion
In fact I didn't get anywhere close to that!
But..
...fortunately...
we don't actually have to get there..
because this Ransomware was created as a joke.
I don't know if it was actually supposed to be released,
and picked up by Bleeping Computer and other malware blogs..
But the author did release a Rensenware forcer.
Which is basically Cheat Engine....
directly for this.. ransomware.
It detects when we're actually running the game...
.. and in Lunatic mode..
and will allow us to decrypt our files.
So, if it would hurry up and load..
We can.. do it!
Choose the red girl, why not?
Alright.
So we're just gonna..
(type) Nine, nine, nine, NINE, nine, nine, nine!
And..
FORCE IT!
And.. there we go!
Since we have achieved the score it wants..
it decrypts our files.
Oh, the game crashed. Cool.
Oh god, what happened.
Okay! Decryption actually completed.
So thankfully the game crashing did not lead to us losing any files.
But, if there any..
if there were any files left encrypted..
it actually drops the key to your desktop..
And you can use the manual decryptor here.
To..
..select the file.
You choose your key..
..from the desktop.
You choose your IV file..
and then you choose any file..
that might still be encrypted..
and using
the two previous files.
It will decrypt it for you!
And you'll get your files back.
So all of our files are now good once again - they're no longer totally encrypted.
We can see our, pretty penguins.
And, we're good. We have an exit button now.
And we can exit!
So, that is about it for Rensenware.
Hopefully you enjoyed this video.
Hopefully I did not..
completely crush the hopes and dreams of any weeaboos out there
by being terrible at this game.
And yeah, that's about it.
Thank you for watching.
Take care.
♫