1 min read

Russian Hackers are Behind Cryptowall 4.0; Bitdefender Creates Vaccine

Alexandra GHEORGHE

November 09, 2015

Russian Hackers are Behind Cryptowall 4.0; Bitdefender Creates Vaccine

[UPDATE] The Cryptowall operators have modified the way they check whether a system has been infected or not, which renders the Cryptowall Vaccine ineffective in some cases. Because we cannot guarantee the proper functioning of the vaccine anymore, we decided to retire the project. Stay tuned for further updates.

Cryptowall 4.0 spam servers are located in Russia, according to ongoing analysis by Bitdefender’s anti-malware team. The Javascript-written malware downloads the CriptoWall component from a Russian server.

The investigation also reveals the encryption algorithm used is AES 256. The key is encrypted using RSA 2048, most likely because this second algorithm is resource-intensive.

Targeted countries we have identified so far include: France, Italy, Germany, India, Romania, Spain, US, China, Kenya, South Africa, Kuwait and the Philippines. Russian users seem to be safe. The malware doesn’t proceed with the encryption process if it detects Russian as a keyboard language.

How to prevent getting infected

Following the footsteps of its predecessors, CryptoWall has become a financial success for its creators. Recent numbers show that Cryptowall 3.0 inflicted an estimated $325 million in damages in the US alone. Its high turnaround prompted other cybercriminal groups to write new code that uses more sophisticated encryption algorithms. Therefore, it’s becoming harder for AV vendors to crack the code and come up with a solution.

To stop the spread of this threat, Bitdefender anti-malware experts have developed an antidote, a piece of software that allows users to immunize their computers and block file encryption attempts.

Download CryptoWall 4.0 vaccine here. [link removed]

Please remember that this tool acts as an extra layer of protection, together with your anti-malware solution. If your computer is already infected with CryptoWall 4.0, the vaccine will not help disinfect it. The tool should be installed and used as a proactive measure against this specific strain of ransomware.

tags


Author



Right now

Top posts

LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

LuminousMoth – PlugX, File Exfiltration and Persistence Revisited

July 21, 2021

9 min read
How We Tracked a Threat Group Running an Active Cryptojacking Campaign

How We Tracked a Threat Group Running an Active Cryptojacking Campaign

July 14, 2021

10 min read
A Note from the Bitdefender Labs Team on Ransomware and Decryptors

A Note from the Bitdefender Labs Team on Ransomware and Decryptors

May 26, 2021

2 min read
New Nebulae Backdoor Linked with the NAIKON Group

New Nebulae Backdoor Linked with the NAIKON Group

April 28, 2021

1 min read
Good riddance, GandCrab! We’re still fixing the mess you left behind.

Good riddance, GandCrab! We’re still fixing the mess you left behind.

June 17, 2019

5 min read

FOLLOW US ON

SOCIAL MEDIA


You might also like

LuminousMoth – PlugX, File Exfiltration and Persistence Revisited LuminousMoth – PlugX, File Exfiltration and Persistence Revisited
Bogdan BOTEZATUVictor VRABIE
9 min read
Debugging MosaicLoader, One Step at a Time Debugging MosaicLoader, One Step at a Time
Janos Gergo SZELESBogdan BOTEZATU
1 min read
How We Tracked a Threat Group Running an Active Cryptojacking Campaign How We Tracked a Threat Group Running an Active Cryptojacking Campaign
Bitdefender

July 14, 2021

10 min read