Evil: A poor man’s ransomware in JavaScript

This report analyzes the "Evil" ransomware discovered in January 2017: the malware is implemented in JavaScript, uses an external AESCrypt binary to perform strong encryption (files renamed with the .file0locked extension), obtains encryption keys from a remote server via an X-Token header (preventing local key recovery), removes executables from TEMP and startup locations to hinder analysis/recovery, and displays a ransom note directing victims to contact a provided email; a sample hash and other IOCs are included.