What do you need to know about CryptoLocker malware?

What do you need to know about CryptoLocker malware?

What is CryptoLocker? CryptoLocker is by now a well known piece of malware that can be especially damaging for any data-driven organization. Once the code has been executed, it encrypts files on desktops and network shares and “holds them for ransom”, prompting any user that tries to open the file to pay a fee to decrypt them.

What’s the best way to prevent a CryptoLocker infection?

As of now, the best tool to use to prevent a Cryptolocker infection in the first place — since your options for remediating the infection involve time, money, data loss or all three — is a software restriction policy. There are two kinds: Regular software restriction policies, and then enhanced AppLocker policies.

How can I stop CryptoLocker from running on my computer?

Software Restriction Policies (SRPs) allow you to control or prevent the execution of certain programs through the use of Group Policy. You can use SRPs to block executable files from running in the specific user-space areas that Cryptolocker uses to launch itself in the first place.

What are the different types of CryptoLocker policies?

There are two kinds: Regular software restriction policies, and then enhanced AppLocker policies. I’ll cover how to use both to prevent Cryptolocker infections. Software Restriction Policies (SRPs) allow you to control or prevent the execution of certain programs through the use of Group Policy.

What does CryptoLocker do on a network drive?

On execution, CryptoLocker begins to scan mapped network drives that the host is connected to for folders and documents ( see affected file-types ), and renames and encrypts those that it has permission to modify, as determined by the credentials of the user who executes the code.

How does CryptoLocker encrypt random 7 chars files?

For example, a variant known as “CTB-Locker” creates a single file in the directory where it first begins to encrypt files, named, !Decrypt-All-Files- [RANDOM 7 chars].TXT or !Decrypt-All-Files- [RANDOM 7 chars].BMP. The more files a user account has access to, the more damage malware can inflict.

What kind of key do you need for CryptoLocker?

CryptoLocker uses an RSA 2048-bit key to encrypt the files, and renames the files by appending an extension, such as,.encrypted or.cryptolocker or. [7 random characters], depending on the variant.

When did the CryptoLocker ransomware attack take place?

For other similar software, some using the CryptoLocker name, see Ransomware § Encrypting ransomware. The CryptoLocker ransomware attack was a cyberattack using the CryptoLocker ransomware that occurred from 5 September 2013 to late May 2014.

Where does CryptoLocker get its private key from?

CryptoLocker. It propagated via infected email attachments, and via an existing Gameover ZeuS botnet. When activated, the malware encrypted certain types of files stored on local and mounted network drives using RSA public-key cryptography, with the private key stored only on the malware’s control servers.