Ransomware has gotten strange. It used to be that it was an always-deadly exploit that required immediate payments or your data would be deleted forever; the use of any decrypter tool was out of the question.

But it seems that some of the latest variants are strictly amateur material. Case in point: Alpha ransomware, which Softpedia noted has shown up in the wild recently.

More on Alpha

Alpha works like most other ransomware: The main executable is injected and creates an autorun called Microsoft. This lets the threat continue the encryption process even if it is rebooted. This executable is automatically removed after the encryption process finishes.

On the system drive, which is C: on most Windows systems, Alpha will only encrypt 249 specific file types in the Desktop, My Pictures and Cookies folders. On other drives and shared folders, however, it encrypts all the files that it can, Softpedia reported.

Strange Requests and a Decrypter

Here’s where things get weird: The ransom note displayed asks for $400 in iTunes gift cards, with the codes to be sent to certain email addresses.

This kind of payment is not anonymous like bitcoin would be. The malware authors can be traced by the use of these cards or the email drop points. Leaving this potential breadcrumb trail pointed to the idea that amateurs are likely behind Alpha.

A free Alpha decrypter was developed by security researcher Michael Gillespie. Users who find themselves in the lurch can leverage this tool to avoid paying the ransom. Bleeping Computer is offering the decrypter as a free download.

Graham Cluley noted that TrueCrypter has also asked for gift cards as ransom payments in recent weeks. That particular exploit was so poorly constructed that not only has a decrypter tool been developed, but the malware may self-decrypt. If the malware cannot reach the command-and-control server — which is true about 40 percent of the time — it will just decrypt without payment.

If these ransomware infections are any example, the lure of easy money is attracting less technically competent thieves.