CryptoLocker - How to Recover Files or Decrypt

CryptoLocker is an application that you would not like to find on your pc. It is classified as a ransomware that is known to encrypt each and every essential file on your computer. This ransomware uses a Bitcoin payment system - ransoms get paid using it, making it rather difficult to prosecute the hackers behind it.

How CryptoLocker is Installed on the Computer

CryptoLocker uses social engineering techniques, to ensure that it is the user who executes it. Specifically, the victim receives an email, pretending to come from a logistics company, which has a ZIP with an access code attached.

When the user opens the zip by entering the access key that comes in the email, he thinks that there is a PDF file inside and when he opens the fake PDF, he executes the Trojan. CryptoLocker takes advantage of the Windows policy of hiding the extensions by default, in such a way that the user is tricked "thanks" to this Windows feature.

• When the user (the victim) executes the Trojan, it installs itself as a resident on the computer:
• Performs an imitation of itself on a path of the user profile (AppData, LocalAppData)
• Create an entry in the autoruns to ensure execution on restart.
• Run 2 processes. One is the primary and the other to protect the original process in front of closures.

Encryption of Files on Disk

The Trojan produces a symmetric key for each file to be encrypted and encrypts the contents of the file with AES using this key. It then encrypts the key with an asymmetric public-private key (RSA) algorithm with keys greater than 1024 bits in length and adds it to the encrypted file. This procedure guarantees that only the owner of the RSA private key will be able to obtain the key with which the file has been encrypted. In addition to this, as an overwrite operation is performed, the restoration of the file through any technique is prevented.

The first thing the Trojan does once it runs on the victim's computer is to get the public key (PK) from a C&C server. In order to connect to its server, the Trojan incorporates an algorithm known as Mersenne twister to produce domain names (DGA). This algorithm uses the date of the day as a seed and can produce up to a thousand different domains day after day, of a fixed length.

When the Trojan has successfully downloaded the PK, it saves it in the HKCUSoftwareCryptoLockerPublic Key registry and begins encrypting the files on each and every hard drive on the computer and on network paths where the user has permissions.

How Can I Avoid CryptoLocker?

The infection procedure it uses is transmission by e-mail through the use of social engineering. With what our tips are:

• Exercise extreme caution against e-mails from unexpected senders, especially those that include attachments.
• Disabling the Windows policy that hides known extensions will also help to recognize an attack of this kind.
• Having a backup system for our critical files, which ensures that not only in the case of infection we can mitigate the damage caused by malware, but we also cover hardware problems beforehand.
• If we do not have a backup and we have become infected, we do not advise paying the ransom. This should NEVER be the solution to recover our files since it transforms this malware into a profitable business model, which will drive the development and expansion of this kind of attack.
• UPDATE A Power Shell script has been created
• Install and update antivirus; do a regular scan

If you have been unlucky enough to be infected by the CryptoLocker Trojan, we can provide you with a solution to recover the encrypted files.

Cryptolocker is Ransomware

Ransomware is a threat that goes beyond simple damage to a computer, it attacks us where it hurts us most, encrypting files that are vital to us and requesting a "ransom" usually in bitcoins.

Bad News Cerber 3, the new version of ransomware that is impossible to decrypt, although at present we have begun to develop tools to be able to decrypt this terrible algorithm, it is still one of the most difficult to recover.

The 10 Most Dangerous Ransomware

Conficker: Worm that allows remote operations and malware download.

Sality: Virus that allows remote operations and downloads of malicious programs.

Locky: It mainly spreads via spam emails with a covert downloader.

Cutwail: Botnet used to send spam messages and take part in DDOS attacks

Zeus: Trojan used to steal banking information.

Chanitor: Install malicious payloads on infected machines.

Tinba: Banking Trojan.

Cryptowall: Ransomware that uses AES encryption and carries out C&C communication through TOR.

Blackhole: Exploit Kit that uses browser security flaws and plugins.

Nivdort: Bot used to steal passwords and modify settings.

What is CryptoLocker? Beware of CryptoLocker?

CryptoLocker is a type of malware that encrypts all files, archives, documents, or computer equipment until they are unlocked by the "cybercriminal".

CryptoLocker is at the moment a well-known piece of malware that can be especially damaging to any data-driven organization. The moment the code has run, it encrypts files on desktops and network shares and "hijacks them for ransom." If any user tries to open the file, they will be asked to pay a fee, a ransom, to decrypt them. For this reason, CryptoLocker and its variations have come to be known as “ransomware.

Malware such as CryptoLocker can enter a protected network by means of many vectors, including e-mail, file-sharing, and download sites, websites, etc.

A CryptoLocker can severely affect a company, its image, its website, leaving it useless, and even affecting search engine visibility.

Aside from limiting the scope of what an infected host can corrupt by retaining access controls, detection and protection controls are advised as the first line of defense.

What Does CryptoLocker Do?

At a run, CryptoLocker begins to examine the mapped network drives that the host is connected to folders and documents, renames, and encrypts the ones it has permission to alter, determined by the credentials of the user running the code.

CryptoLocker, in many cases, uses a 2048-bit RSA key to encrypt the files and changes the name of the files by adding an extension such as “.encrypted”, “.CryptoLocker” or a combination of 7 random characters, depending on the variation.

Finally, the malware creates a file in each damaged directory that links to a page with decryption instructions, which requires a duck from the victim (on numerous occasions through bitcoin).

The names of the instruction file are usually DECRYPT_INSTRUCTION.txt or DECRYPT_INSTRUCTIONS.html.

How to Prevent CryptoLocker?

The more files a user account has access to, the more damage malware can do, therefore limiting access is a prudent action, as it will limit the scope of what can be encrypted. Since reaching a least-privilege model is not a quick fix, it is possible to reduce exposure quickly by removing superfluous global access sets from access control lists.

Sets such as "Everyone," "Authenticated Users," and "Domain Users," when used in data containers (such as SharePoint sites and folders) can expose entire hierarchies to each and every user in a company.

Apart from being targets of attack, this exposed data set is very prone to be damaged in the malware attack.

On file servers, these folders are known as "open shares", both the file system and the share permissions are reachable through a global access set.

How to Detect a CryptoLocker?

If file access activity is being inspected on impaired file servers, these behaviors produce a high number of open, modify, and create events at a very rapid rate and are quite simple to perceive with automation, giving a valuable inspection control. To serve as an example, if a single user account alters 100 files in a minute, something automated is sure to happen.

Setting up a monitoring solution to cause an alarm when this behavior is observed can be a valuable tip: IDS, IPS, or Next-Generation Firewall.

Depending on the severity of the CryptoLocker, the encryption can be reversible with a real-time disassembler, few cases, or irreversible.

Security Tips Like Prevention of CryptoLocker or Ransomware

• Update antivirus software and protection software. These solutions can help detect some types of ransomware and prevent it from encrypting files.
• Be very vigilant about phishing scams, phishing emails, which are the most common delivery mechanism for ransomware.
• Keep backup copies of all important documents (it is faster and easier to recover documents from a backup than to decrypt them if they have been compromised in a ransomware attack).
• Commit to a zero-trust / least privilege model. The least privilege model limits access only to what is completely accurate.
• Monitor file activity and user behavior to warn, alert and respond to potential ransomware activity.
• And most importantly, implement cybersecurity tools that allow you to be somewhat more secure.