RansomWare Strikes Again: CryptoLocker

CLockerPic

That nasty thing above is the screen for a new, on the rise RansomWare called CryptoLocker.  We’ve discussed RansomWare before in a previous couple of posts here and here.   As a review of what this malware does – it locks your computer and then holds it for – yep, you guessed it – a ransom fee.  Hence the name.

However with this particular RansomWare it encrypts all your files and then offers, as above in the screen shot, a way to decrypt them –  for a price – anywhere from $100 – $700 or in some cases, 2 Bitcoins – 10 Bitcoins ( $450 – $2100).   In fact, with this new attack, they offer a “Decryption Service” that allows victims to purchase a “decryption key”.  Of course, that’s the last thing you want to do.  Bottom line: your files get encrypted and you may lose them forever and ever.  Amen.  …unless you have the decryption key.

How do you get infected?

CryptoWare is spread through email attachments and it ihas been noted that the hackers are targeting companies through phishing attacks.

What kind of files are  being targeted on an infected computer?

The file extensions, according to MalwareBytes, are listed below:

3fr, accdb, ai, arw, bay, cdr, cer, cr2, crt, crw, dbf, dcr, der, dng, doc, docm, docx, dwg, dxf, dxg, eps, erf, indd, jpe, jpg, kdc, mdb, mdf, mef, mrw, nef, nrw, odb, odm, odp, ods, odt, orf, p12, p7b, p7c, pdd, pef, pem, pfx, ppt, pptm, pptx, psd, pst, ptx, r3d, raf, raw, rtf, rw2, rwl, srf, srw, wb2, wpd, wps, xlk, xls, xlsb, xlsm, xlsx

How far has this malware spread?

According to The Hacker News, “…64% of its victims are from the US.”   It targets Windows systems.

Removal:

Regretfully, there is no specific tool known to be able to decrypt and restore asymmetrically encrypted files except a private key.  MalwareBytes will detect CryptoLocker as “Trojan.Ransom” but it also cannot restore your encysted files.  Your best defense is to back up your files frequently.  And since this malware can cross through external drives such as USB and mapped drives, don’t leave X-drives mounted.   Keep your anti-virus up to date and work at using file sharing services rather than relying on email attachments.

Speak Your Mind

*

This site uses Akismet to reduce spam. Learn how your comment data is processed.