Forcepoint researchers said they had decided to do some preliminary analysis to understand the economics of the malware, where it was traded from and level of sophistication of the author.
Once a system is infected, Jigsaw issues a warning to the user that a certain number of files will be deleted at differing time intervals, unless a ransom of US$150 is paid to a specified Bitcoin account.
This led the researchers to believe that the malware was being rebuilt by different people with some modifying the source so as to avoid detection by standard anti-virus programs.
Searching for these copyright notices using the full text, it was easy to find the author. All the links, bar one, that came up in a search led to reports generated by automated malware analysis tools; the odd one out led to a Tor site belonging to the author of Jigsaw.
Here the source code for Jigsaw, which is written in C#, was offered for sale for a price of US$139. Forcepoint said it appeared that the author had made 24 sales.
However, return on investment seems to be very low. Forcepoint extracted the ransom Bitcoin addresses for four samples and found that in two cases the extortionist received no ransom payment at all. In one case they received US$1 worth of Bitcoin (which may have been merely a test) and the most successful one received a total of US$89 worth of Bitcoin.
Forcepoint also noted that though the Jigsaw author had provided instructions on how to configure and build the malware, some who had done so had left their names in the build strings for the executable.
"This could have been funny if it were not true," the Forcepoint team wrote in its analysis. "A mediocre and greedy techie writes a 2nd rate piece of malware that is designed to scare people into parting with their money. He (or she) sells it to a group of customers who are not that techno-savvy but are equally greedy and devoid of any morals. Hardly a happy story.
"But, if we needed an illustration of bad programmers selling to somewhat inept 'wannabe' criminals via the unregulated 'dark web', this is probably good enough for now."