Here’s a list of files Cryptolocker looks for: Cryptolocker then uses that key pair to encrypt many different types of files on your computer. The private key is only stored on the attacker’s C&C servers, but the public key is saved in a registry entry on your computer. Once Cryptolocker contacts its C&C, it generates a public/private cryptographic key for your specific computer, using very strong and standard RSA and AES 2048-bit encryption. Some sample Crytpolocker domains might look like this: The malware uses a random domain name generation algorithm to try and find a current C&C server. It then also tries to contact its command and control (C&C) server. If you run Cryptolocker, it infects your computer like normal malware, placing its files in Windows directories, and creating registry entries that allow it to restart when you reboot. Since Windows doesn’t display file extensions by default, this file may look like a PDF file rather than an executable. Often, Cryptolocker arrives as a file with a double extension, such as *.pdf.exe. It spreads in many ways, including in phishing emails that contain malicious attachments or links, or via drive-by download sites. However, I’ll include links to my favorite Cryptolocker resources at the end of the post.Ĭryptolocker is a ransomware trojan that encrypts your personal files. Since many great sources have already described Cryptolocker in complete detail, I’ll just share a quick summary. Watch the video below, and continue reading for more details and references. With that in mind, I created a quick video about Cryptolocker, which also shows how WatchGuard’s XTM appliance can detect it. I have since received many emails and tweets from readers and customers asking about it especially whether or not WatchGuard’s XTM security appliance can do anything to prevent it. However, over time Cryptolocker has proven much more aggressive than previous extortion malware campaigns.
At the time, Cryptolocker seemed very similar to the many other ransomware variants in the wild, except that it seemed to be spreading a bit more quickly than others. If you follow my weekly Infosec news video, you probably remember me mentioning Cryptolocker in an episode late September.
0 kommentar(er)
