iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Trump-themed Windows malware did display ransom demands, but the reports behind the “fake ransomware” label describe more than one sample—and not all behaved the same way. The 2019 Trump.exe samples generally failed to encrypt files effectively; the 2017 Trump Locker sample could encrypt some files, delete Windows shadow copies, and demand 0.145 Bitcoin. That historical demand was reported as about $165 at the time, not one dollar.
What was Trump-themed ransomware?
“Trump Locker” and “Trump.exe” are names used in reports about Windows malware that invoked Donald Trump’s name or image to frighten victims into paying. They were not an official product or software endorsed by Trump. The labels refer to samples discussed in separate reports, so their behavior should not be treated as identical.
In February 2017, BleepingComputer reported on Trump Locker, linking its behavior and code to the VenusLocker ransomware family. In November 2019, Security Newspaper described Trump.exe samples as fake ransomware, attributing the technical assessment to Cisco Talos expert Nick Biasini. Biasini said: “The collected samples do not encrypt the victim’s data, or in some cases only partially and poorly do so.” BleepingComputer’s 2017 Trump Locker report and Security Newspaper’s 2019 Trump.exe report describe different evidence and should be read separately.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsDid Trump Locker actually encrypt files?
Yes, the 2017 Trump Locker report documented file encryption, but the malware did not handle every file in the same way. It fully encrypted certain extensions and appended .TheTrumpLockerf to those filenames. Many other files were only partially encrypted—reportedly just the first 1,024 bytes—and renamed with the .TheTrumpLockerp suffix. It also base64-encoded original filenames.
#1 Best Overall
That differs from the 2019 Trump.exe assessment, which said the collected samples generally did not encrypt victims’ data, or did so only partially and poorly. “Fake” therefore describes the weak or absent encryption in those samples, not a guarantee that every Trump-themed sample was harmless or incapable of affecting files.
Was the ransom really one dollar?
No. The Trump Locker report recorded a default demand of 0.145 Bitcoin, which BleepingComputer valued at about $165 at the time in 2017. Its ransom note gave victims 72 hours, demanded payment in Bitcoin, and instructed them to email a personal ID to the operators. That is a historical amount and exchange-rate estimate, not a current Bitcoin conversion. The retrieved 2019 report does not establish a one-dollar demand for Trump.exe; its headline’s “a buck” should not be mistaken for Trump Locker’s documented price.
How did Trump Locker try to keep victims from recovering files?
The 2017 sample interfered with recovery and made itself conspicuous. BleepingComputer reported that it used wmic.exe shadowcopy delete to delete local shadow copies, changed the desktop wallpaper, displayed a Trump image, and created a startup entry so the ransom note would reappear.
- Shadow-copy deletion: removing local copies can make some built-in Windows recovery options unavailable.
- Startup persistence: the malware created
HKCUSoftwareMicrosoftWindowsCurrentVersionRunTheTrumpLockerto relaunchRansomNote.exewhen the user signed in. - Command-and-control contact: TrumpLocker.exe contacted an endpoint to receive a public key and ransom amount before encrypting files.
What should you do if you see a Trump-themed ransom screen?
A ransom screen is not proof that files were successfully encrypted, and its branding is not proof of legitimacy. Do not pay or email the operators based only on the screen. If this is happening on a real device, treat it as a malware incident: disconnect it from networks to limit further activity, avoid deleting files or running cleanup tools before preserving anything needed for investigation, and get help from your organization’s IT/security team or a reputable incident-response professional. For a personal computer, use a trusted security vendor’s current malware-removal guidance and scan from a clean, updated environment. Restore files only from backups you know were not exposed to the infection.
Rank #3
The 2017 report’s filenames, registry path, and command are useful indicators for a qualified responder, but they identify the documented Trump Locker sample, not necessarily every infection with Trump-themed branding. The 2019 report mentions “several cases” but gives no reliable victim count.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How does Trump Locker differ from the later Trump.exe samples?
| Reported sample | Encryption evidence | Other documented behavior | Attribution and demand |
|---|---|---|---|
| Trump Locker (2017) | Some extensions fully encrypted; many others partially encrypted, including only the first 1,024 bytes. | Deleted shadow copies, changed wallpaper, displayed a Trump image, and added a startup registry entry for the ransom note. | BleepingComputer linked its behavior and code to VenusLocker. Default demand reported as 0.145 Bitcoin, about $165 at the time; 72-hour threat. |
| Trump.exe samples (2019 report) | According to the report’s account of Cisco Talos expert Nick Biasini, samples generally did not encrypt data or did so only partially and poorly. | Described as fake ransomware built around screen locking and intimidation; further comparable technical details are not stated in that report. | The report does not establish a reliable victim count or a one-dollar demand. |
Sources: BleepingComputer, February 22, 2017; Security Newspaper, November 6, 2019.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
