BTCWare

BTCWare PayDay is a variant of BTCWare ransomware discovered by security researcher Michael Gillespie. Once infiltrated, it encrypts stored files and appends filenames with extensions like '.[developer's_email]-id-***.payday'. The ransomware opens a browser window displaying ransom demands and drops a text file ('!! RETURN FILES !!.txt'). It typically demands between $500-$1500 in Bitcoin payments. The malware uses various email addresses including variations with [email protected], [email protected], and [email protected] domains.