New Ransomware-as-a-Service ‘Jokeroo’ promoted on underground hacking forums

• Jokeroo RaaS has been offered in multiple membership packages ranging from $90 to $300 and $600.
• Jokeroo RaaS was first promoted as GandCrab Ransomware RaaS in an underground hacking forum.

A new Ransomware-as-a-Service (RaaS) named ‘Jokeroo’ is being promoted on the underground hacking forums and via Twitter.

What is a RaaS - A Ransomware-as-a-Service allows cybercriminals and would-be hackers to gain access to ransomware and distribute the ransomware by signing up to the service where the service provider offers ransomware and a payment server.

The member will distribute the ransomware to infect victims and get ransom payments from the victims. The payment amount is then shared by the member and the service provider.

GandCrab Ransomware RaaS to Jokeroo RaaS

A security researcher named Damian noted that Jokeroo RaaS was first promoted as GandCrab Ransomware RaaS in underground hacking forum Exploit.in. Later, another security researcher named David Montenegro tweeted that the GandCrab Ransomware Rass name has been changed to ‘Jokeroo’.

Since then, the service providers have been promoting their service ‘Jokeroo RaaS’ via Twitter.

Membership packages

Jokeroo RaaS has been offered in multiple membership packages ranging from $90 to $300 and $600. In the basic package, a member earns 85% of the ransom payments. As members go up the package ladder, they get extra benefits such as Salsa20 encryption, different ransomware variants, and different payment cryptocurrency options.

The basic $90 slab package offers the following benefits:

• The $90 package offers members to choose the ransomware and can customize it as per their requirements.
• In the $90 package, members can choose their own logo, icon, and extension.
• Members can create 1 ransomware and infect an unlimited number of victims.
• Members will earn 85% of the ransom payment.
• This package offers members with antivirus software undetectable protection.
• This package allows members to carry out transactions in bitcoins (Payment and withdrawal).
• Members can manage all their victims in the dashboard. The dashboard displays the IP of the victims.

Worth noting

• The Jokeroo RaaS dashboard will display members the list of their victims, time of infection, the ransom amount, and the payment status.
• Members will also be able to see victims’ IP addresses, Windows OS version, and geographic location.
• Members will also be provided with an option to create their own ransom note depending on the membership package they have chosen.