Skip to main content

Update: CryptoDefense rebranded to CryptoWall

After the fortune they reaped with CryptoDefense, not only did the crooks buy more computers from a botnet. They also rebranded it to 'CryptoWall' and made considerable changes to its website:

+ Multilanguage Support
+ Slight color changes in their website. Now it looks nicer, I confess.
+ Support (You can message them in case you need help) 

- Their English sucks, so I haven't noticed any improvement in this area.

* Ransomware notes are now named as:
  • DECRYPT_INSTRUCTION.txt
  • DECRYPT_INSTRUCTION.html
  • DECRYPT_INSTRUCTION.url
What does it mean to 'buy computers'?

Most computers that were hit by this nasty ransomware had been previosuly infected by a botnet. A botnet is a network of infected computers that can be spied and controlled by their masters (those who own the botnet network). 

These computer programs are usually used to gather users' credentials to home-banking and to perform DDoS attacks on websites, etc. (Yes, you can pay these crooks to bring down your competition's website).

One of their businesses consists of selling a certain number of infected computers so that the buyers can install whatever they want in them. In this case: CryptoDefense/CryptoWall. It's not a big issue for them to sell these computers because most of them are not used for homebanking anyway. So, they remain rather useless. Now, thanks to ransomware, they no longer have to wait until they get a bank account. They just encrypt their files and get paid via Bitcoins.

Is there a chance to get my files without payment?

Maybe, I can't tell. The reason why the first 'lucky' victims that were hit by the earliest version of CryptoDefense could recover their files was because its earliest version had a faulty implementation of CryptoAPI (needed to encrypt your files). 

If someone gets access to their hidden servers that provide the decryption tool and verifies the payments, all keys might be released.

Will they go to jail?

I very much hope so. CryptoLocker author has been identified and charges were pushed against him. CryptoLocker is way smarter than this Kiddo ransomware and the author still got caught. So, let's just be patient.

Is this information useful to you? Write me an email or consider a small donation. Any amount will be greatly appreciated!

If you have the virus samples, you can send them. (Place them inside a .zip / .rar file) and use 'infected' as password.



Comments

  1. i have a question:
    cryptowall :Keys pair stored on disk!???

    ReplyDelete
  2. These guys will fix your problem if you donate, what a coincidence! After I donated, they quickly gave me all I needed to get all my files back

    ReplyDelete

Post a Comment

Popular posts from this blog

Wana Decryptor / WanaCrypt0r

Alright, guys. This is a tough one: However, there's no reason to claim it's impossible to decrypt victims data. These idiots always let something slip through their fingers. Their servers might be found and keys restored to their respective victims. Errors might be found in their code, their key encryption scheme may have some weakness, etc. Let's just let the experts find a way out.

By the way, if you want to temporarily protect your PC from this malware, you may do this.


CryptoDefense: Keys pair stored on disk!

This little detail slipped through their fingers... TOO LATE!

(I actually hid this post when I understood that it might alert the crooks. But SYMANTEC did!)

This is the exact path where your keys are:


Windows XP
C:\Documents and Settings\<USERNAME>\Application Data\Microsoft\Crypto\RSA\S-1-5-2... Windows 7
X:\Users\<USERNAME>\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21... (X stands for your hard-disk letter, which is commonly C in most computers)

The private key is encrypted via DPAPI (Data Protection API). There are many RSA keys in that folder though, but you can still find them by sorting these files by date. If you don't remember the date you got infected, see your screenshot at the crook's webpage or search for the oldest HOW_DECRYPT.TXT file in your system.
I'll update this blog soon!


Working backwards to the seeds! (OUTDATED)

Note: 
This article is technically accurate and it can be applied to rudimentary RSA implementations that only use time retrieval functions as seed as demonstrated by CS Students from Virginia University
However, CryptoDefense uses CrytoAPI which uses a robust PRNG based on process ID, thread ID,  system clock, system time, system counter, memory status, free disk clusters, etc. I dramatically changed the keys recovery approach as soon as I found out the keys were stored on disk. Why keep this article then? Oh, we wanted the crooks to think we were down the wrong path ;)

Do NOT use somebody else's decryption program!
The reason why each key is unique and why you can't use somebody else's decryption program is because this ransomware randomly generates the keys for each victim. If there was a unique private key for everyone, there would be no need to panic!

But the is a problem...

Software alone is technically incapable of generating random numbers in its truest sense. This exp…