Ransomware Research
JSWorm Ransomware
JSWorm is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on April 1, 2019, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: JSWorm, JSWorm 2.0, JSWorm 3.0-3.1, JSWorm 4.0.2-4.0.3.
Quick Facts
- Ransomware Family
- JSWorm
- First Seen
- April 1, 2019
- Known Aliases
- JSWormJSWorm 2.0JSWorm 3.0-3.1JSWorm 4.0.2-4.0.3
How JSWorm Ransomware Works
Targeted Files
Encrypts first 0x27100 kb Full extension of encrypted files -> .[ID-XXXXXXXXX][MAIL].JSWORM https://www.bleepingcomputer.com/forums/t/700990/jsworm-ransomware-jsworm-jurasik-jswrm-support-topic/
File Encryption Patterns
JSWorm modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..JSWORM
..JURASIK
..JSWRM
..UNNAMED
..TRUMP
Ransom Note and Payment Demands
After encrypting files, JSWorm displays ransom notes demanding payment for file recovery:
JSWORM-DECRYPT.html
Ransom message:
notes/JSWORM-DECRYPT.html
Note locations:
EveryFolder
UNNAMED-DECRYPT.txt
Ransom message:
notes/UNNAMED-DECRYPT.txt
Note locations:
EveryFolder
JSWORM-DECRYPT.txt
Ransom message:
notes/JSWORM-DECRYPT.txt
Note locations:
EveryFolder
JSWORM-DECRYPT.hta
JSWRM-DECRYPT.hta
Ransom message:
notes/JSWRM-DECRYPT.hta
Note locations:
EveryFolder
TRUMP-DECRYPT.txt
Ransom message:
notes/TRUMP-DECRYPT.txt
Note locations:
EveryFolder
31NSXXX-DECRYPT.hta
JBUIIGF-DECRYPT.hta
Ransom message:
notes/JBUIIGF-DECRYPT.txt
Technical Indicators
Associated Executable Files
The following executable files are associated with JSWorm ransomware:
JSWorm.exe
build.exe
MANWARD6
MANWARD6.exe
5527.exe
jsworm.exe
svchost.exe
Elastio Can Help You
Don't let JSWorm ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This JSWorm ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like JSWorm.
Last updated: July 30, 2025