Researchers from Bleeping Computer and the MalwareHunterTeam found a prototype build of a ransomware variant on the Dark Web that is unique in how it handles decryption keys.

Paying It Forward?

The malware, called Popcorn Time — not to be confused with the video app of the same name — offers its victims two choices to supposedly get their data back. The first option is simple: Pay a fixed amount of bitcoins to a hidden address. This standard ransomware demand was the “fast and easy” way to resolve the problem, according to the ransom note.

But the second option — the “nasty way” — brings a Faustian bargain to the ransomware table. The malware offers to let victims off the hook if they spread the threat to two friends. If they then pay the ransom, the original victim will receive a free decryption key.

Bleeping Computer summed it up nicely: “Want a free decryption? Just be a scumbag!”

Let’s be very clear here: Infecting others with this ransomware is illegal and actionable. You can pay quite a stiff penalty for engaging in this kind of criminal activity, which is generally easily traceable.

Sorry, Not Sorry

Popcorn Time’s creators go to great pains to give themselves a sympathetic legend, claiming that the ransomware will fund food, medicine and shelter for Syrians that have been affected by war. They even go so far as to apologize, but they still want someone else’s money.

The server that actually implements this referral program is currently unresponsive. The URL given on the ransom note points to a file located on the ransomware’s Tor server, which contains details on how the program is administered.

In another trick up its sleeve, the malware will start to delete files if a victim enters the wrong decryption key four times.

Popcorn Time Not Ready for Prime Time

This is not an infection-ready piece of code by any means, but it is a work in progress. Expect the creators to implement more nasty features as Popcorn Time finds its legs in the ransomware world. The concept of referral ransomware, however, is here to stay.

The genie is out of the bottle, and referral programs are no longer just for branded goods. Marketing tools can be applied to many areas, including cybercrime. Malware creators will be watching to see if this particular approach works. If it does, imitation cannot be far behind.