BartCrypt

BartCrypt (or "Bart") is a ransomware virus distributed using malicious attachments that appear as .zip files. The names of these files often vary (e.g., "pictures.zip", "photos.zip", "images.zip", and other words that describe a graphic image). The zip file contains a .js (JavaScript) file that downloads and installs the RockLoader malware, which in turn downloads the BartCrypt ransomware. Once infiltrated BartCrypt immediately starts encrypting various types of files (e.g. .doc, .jpeg, .mp3, .mp4, etc.) stored in the victim's computer. This ransomware also changes the victim's desktop wallpaper to "recover.bmp" and creates a "recover.txt" file, which is placed in every folder containing the encrypted files.