set an image named AllFilesAreLocked.bmp as desktop wallpaper.The cybercriminals demand that the user pay ransom in Bitcoins (Figures 2, 3) display a window demanding ransom and containing a list of files that have been encrypted.

Data fragment with a list of file extensions used by the encryptor search all the fixed, removable and network drives for files matching a list of extensions (see Figure 1) įigure 1.after launching, the malware copies its body to (CSIDL_COMMON_APPDATA) and adds the task to launch the file to the Task Scheduler.The high-level algorithm used by the malicious encryptor is quite ordinary and is as follows: All this makes a highly dangerous threat and one of the most technologically advanced encryptors out there. Specifically, hiding the command and control servers in Tor anonymity network complicates the search for the cybercriminals, and the use of an unorthodox cryptographic scheme makes file decryption impossible, even if traffic is intercepted between the Trojan and the server. Its developers used both proven techniques ‘tested’ on its predecessors (such as demanding that ransom be paid in Bitcoin) and solutions that are completely new for this class of malware. This encryption malware belongs to a new generation of ransomware. This new family is detected by Kaspersky Lab as.

Analysis showed that the Trojan had nothing in common with other known families and a number of features that suggested it was a completely new creation. There are also lots of lesser-known families that have spread in Russia and the CIS.Īt the end of June 2014 Kaspersky Lab detected a new encryptor. CryptoLocker, CryptoDefence (and its successor CryptoWall), ACCDFISA, and GpCode are some of the most notorious examples. In order to decrypt these files the criminals demand a payment – often a significant sum. The data can include personal photos, archives, documents, databases (e.g., databases used in 1C:Enterprise software intended for automation of business activities), diagrams, etc. The Ransomware class is now based on so-called encryptors – Trojans that encrypt every kind of data that may be of value to the user without his or her knowledge.

In the last few years it has evolved from simple screen blockers demanding payments to something far more dangerous. Ransomware is now one of the fastest growing classes of malicious software.

Decrypt crypto locker encrypted files