– The malware starts looking for files extension mentioned in the following list.įrom the list, as we can see, the malware targets all users who possibly would have some important information stored on their machine and would want to restore it back. The public key is sent to the malware running on the user’s machine using secure communication, which is stored under HKCU registry key as shown in the following image: The private key is kept on the server for the next 72 hours. The server generates a pair of public and private key for the machine of the targeted user. It communicates with random servers whose names are generated using Domain Name Generation (DGA) algorithm. – The ransomware uses RSA algorithm with 2048 bit key.

– When CryptoLocker gets executed, it copies itself at the root of %APPDATA% folder with names as. This ransomware is spread using social engineering tricks via social media and email attachments. Once it gets executed, it encrypts files in the victim’s computer, and demands a certain ransom for decryption. Last week some of our customers had reported the occurrence of this malware.

Today, we will discuss a new entry in the list of file encrypting ransomware it is known as “CryptoLocker”. The virus locks the computer screen and stops the user from using the infected machine until they agree to pay a certain amount of money to the cybercriminal. Previously we had reported about the “FBI virus”.

Crypto locker in the news