Meet Ransom32: The first JavaScript ransomware | Emsisoft Blog

At first glance Ransom32 looks like a dime a dozen among many similar malware campaigns. Signups are handled via a hidden server in the Tor network. A simple Bitcoin address where you want the funds generated by your ransomware to be sent to is enough to signup.

Source: Meet Ransom32: The first JavaScript ransomware | Emsisoft Blog