The malware claims to encrypt victim files, throws up a landing
page and demands 0.2BTC before piling on the pressure by claiming
that for each click made on the compromised system which is not
related to payment, files are deleted.
This, however, is a complete lie.
“There is no longer honor amongst thieves,” Talos noted. “Ranscam
simply delete victims’ files, and provides yet another example of
why threat actors cannot always be trusted to recover a victim’s
files, even if the victim complies with the ransomware author’s
I’ll bet this really pisses off the “honest” ransomware thieves.