Goodwill ransomware encrypts it victim data and then requires them to show kindness to strangers and confirm this with a message on social networks, as well as record a video in order to be able to return their files. Moreover, you need to show benevolence three times, i.e. in three ways: give new clothes/blankets to the needy on the side of the road, feed five poor children at Domino, Pizza Hut, KFC or similar fast food cafes, pay for the treatment of the needy in the hospital. Encrypted files are appended with the extension:
.gdwill The ransom. The ransomware is attributed to Indian malicious groups because it contains string "error hai bhaiya" which translates to "there is an error, brother".
GoodWill Ransomware Signatures
Family: Ransom:MSIL/Filecoder!MSR
MD5: cea1cb418a313bdc8e67dbd6b9ea05ad
SHA256: 0facf95522637feaa6ea6f7c6a59ea4e6b7380957a236ca33a6a0dc82b70323c
GoodWill Ransomware Download
