Ransomware called HolyCrypt is written in Python and compiled into a Windows executable using PyInstaller. This version of HolyCrypt will only encrypt files located under the %UserProfile% folder. It is unknown if the password will be dynamically generated in future versions. The final version of this version will use a TOR payment site for it’s victims. It will encrypt a file using the AES encryption algorithm and will encrypt it using the encrypted string. When encrypting a file, it will create a. alert.jpg file from a base64 encoded string and save it to the same location that the. ransomware was executed from. This alert.jpg will then be set as the Windows desktop wallpaper.
Source: https://www.bleepingcomputer.com/news/security/new-python-ransomware-called-holycrypt-discovered/