A new ransomware-as-a-service (RaaS) product named Fatboy has shown up on Russian cybercriminal boards. According to Recorded Future, the Fatboy ransomware was first advertised on cybercrime boards at the end of March.

The source stated the code’s author claimed to be seeking “limited partnerships.” Partners will deal with each other directly, cutting out the third-party vendor that has historically been present in RaaS schemes.

Attacking With Location-Specific Pricing

The malware has a novel way of pricing its bitcoin ransom: It is determined by the victim’s location. Using this strategy, the author has earned more than $5,000 through the use of this malware since Feb. 7, 2017, SecurityWeek said.

Fatboy varies the payment, but it is based on The Economist’s Big Mac Index. Using this index assures that victims in areas associated with a higher cost of living will end up being charged more to have their data decrypted.

Recorded Future added that the author described the malware in some detail on a cybercriminal forum. He stated the base load of the malware is 15.6 KB and was written in C++. He also claimed that it will work on all Windows versions, and scans all disks and network folders.

There is also a user interface (UI) that has been implemented in 12 languages. This variety means Fatboy ransomware is not geographically limited in its operations, which would enhance the utility of the location-based rates.

Upping the Game With Customizeable Encryption

Other characteristics of the malware include a custom encryption routine: It encrypts the victim’s file using AES-256, generating an individual key for each of the files at the same time. The malware then takes all of the individual keys and encrypts them through RSA-2048.

The author addressed certain concerns of potential partners. For example, the money flow uses a new bitcoin wallet number for each client, as well as offering the instant transfer of funds once the victim has paid up. Fatboy also covers its tracks by deleting itself from the victim’s system once the ransom is paid.

Adding in Direct Service With Fatboy Ransomware

RaaS products always mutate and innovate during their lifetime, but Fatboy shows how a concierge-level service could be added to a criminal enterprise not traditionally known for its service capabilities. The author may also be trying to widen the malware’s audience by appealing to less sophisticated criminals.

These potential partners might be influenced by how Fatboy can be used in a highly customizable and low maintenance manner. While these users require extra help to become profitable, the author has demonstrated a commitment to meeting those needs. Fatboy is just one example of how ransomware is not only becoming smarter, but also targeting users on a global scale.