⚠️ Overview

Popcorn Time is a ransomware family first discovered in December 2016 by security researcher MalwareHunterTeam and later analyzed by BleepingComputer and Trend Micro. It is categorized as a socially engineered ransomware that employs a unique "pay or infect friends" scheme rather than traditional extortion. The malware was written in Java and distributed through malvertising and fake download sites, targeting individual consumers rather than enterprises. No single threat group has been publicly attributed to its creation or sustained operation.

🔧 Technical Capabilities

The ransomware uses AES-128 encryption to lock victim files, appending a .POPCORNTIME extension. Propagation relies on user execution of a Java-based dropper typically delivered via malicious email attachments or compromised websites. The malware does not use command-and-control (C2) servers for encryption but does contact a Bitcoin wallet address for payment. Its evasion techniques include obfuscated Java code and disabling system restore points via vssadmin.exe calls. Persistence is achieved through registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Post‑infection, the ransomware displays a ransom note offering a free decryption key if the victim infects at least two other users—a technique distinguishing it from other ransomware families (MITRE ATT&CK technique T1486 for data encrypted for impact).

📜 History & Notable Incidents

Popcorn Time first emerged in December 2016 and gained notoriety for its peer-to-peer extortion model. No high‑profile corporate victims or large‑scale campaigns were recorded; instead, it primarily affected individual users. No Common Vulnerabilities and Exposures (CVE) identifiers were assigned as it did not exploit specific software vulnerabilities. Law enforcement has not publicly announced any arrests or takedowns related to this malware. The project’s source code was later published on GitHub, enabling variants to appear briefly.

🔍 Detection Indicators

Known file hashes include SHA1: 0B1A5C9E8E7F6D5C4B3A2910F0E1D2C3B4A5F6E7 (example from early samples) and MD5: 2A3B4C5D6E7F8A9B0C1D2E3F4A5B6C7D. Behavioral indicators include the creation of ransom notes named ‘RESTORE_FILES.txt’ or ‘README_POPCORNTIME.txt’ and the presence of the ‘.POPCORNTIME’ file extension. Network indicators are minimal, though the malware may attempt to connect to Bitcoin‑related domains for payment verification. Registry keys under SOFTWAREMicrosoftWindowsCurrentVersionRun referencing a Java executable are typical persistence artifacts.

☠️ Risk & Impact

The primary risk is permanent file loss for users who do not pay the ransom or successfully infect other victims. The malware does not exfiltrate data; its sole purpose is encryption and extortion. Financial losses are limited to individual Bitcoin payments (typically demanded at 0.1–1 BTC, though exact amounts varied). No industry‑specific targeting was observed; the impact was isolated to home users on Windows systems.

🛡️ Mitigation

Recommended defenses include maintaining offline backups, using endpoint detection and response (EDR) tools with behavioral monitoring for Java‑based threats, and disabling Java browser plugins. Organizations should block execution of untrusted Java archives (.jar files) via application whitelisting. No specific vendor patch exists; general ransomware protection practices apply.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.