Home Malware Programs Ransomware CryptXXX Ransomware

CryptXXX Ransomware

Posted: April 21, 2016

Threat Metric

Threat Level: 10/10
Infected PCs: 597
First Seen: April 21, 2016
Last Seen: April 8, 2022
OS(es) Affected: Windows

The CryptXXX Ransomware is a file encryptor that holds data on your PC hostage in exchange for Bitcoin payments. Besides blocking this content with its encryption routine, the CryptXXX Ransomware also has strong connections to both spyware attacks and fraudulent Web traffic generation. All of the usual data backup strategies can protect your PC from the CryptXXX Ransomware's attacks, but malware experts also draw attention to the importance of scanning your entire system with anti-malware tools capable of spotting and removing the CryptXXX Ransomware, along with all other threats.

The CryptXXX Ransomware: A Swiss Army Knife of Threats

Most threat authors may create programs that specialize themselves in particular niches, such as collecting information or bypassing network security, while passing off any other attacks to separate programs. Although some of the most professionally-designed and sophisticated threats may use modules to increase their capabilities, at the baseline level, threats tend to focus on particular themes. This truth makes the CryptXXX Ransomware an unusual subversion: a Trojan that can encrypt your files and collect your information, all while related threats perform additional attacks.

The CryptXXX Ransomware installs itself with the help of a variant of Bedep, a Trojan downloader that may drop spyware onto its victims' PCs. The CryptXXX Ransomware keeps itself in line with this previous trend, and can capture (and transfer it into the wrong hands possession, via a C&C network connection) login information from e-mail accounts, FTP accounts and messenger applications. The CryptXXX Ransomware also monitors similar information from most Web-browsing activities, and may compromise your Bitcoin wallet.

The CryptXXX Ransomware's other, primary function is to scan for media and work files, such as Word documents or BMP images, and then run them through an RSA-4096 encryption process. The CryptXXX Ransomware, then, offers to sell a Web browser. Current ransom sums come in at slightly over 500 USD in value, significantly higher than the average for this segment of the threat industry.

The symptoms of these last attacks are signaled clearly through the use of '.crypt' format extensions, desktop imagery and multiple text instruction files. However, malware experts found no symptoms associated with the CryptXXX Ransomware's information-collecting functions that also can occur simultaneously.

Doing Your Part to 'X out' the CryptXXX Ransomware Campaign

Although the CryptXXX Ransomware's attacks seem to have begun in March of this year, internal evidence suggests that it has its roots in threats older than itself. Code divers may note similarities between the CryptXXX Ransomware and Reveton, a fake Police Trojan and spyware program. Besides their remarkably similar payloads, both threats share the same coding language, and other, structural similarities, such as using TCP 443 for network communications. They also share similar delivery methods that base themselves on the Angler Exploit Kit, a threat that may attack vulnerable PCs through their browsers.

Malware experts always recommend that you deal with a file encryptor's infection by removing the threat before taking any other actions. Using deep scan options from your anti-malware products for removing the CryptXXX Ransomware also gives you the greatest chance of identifying other threats that can install themselves along with it. Afterward, restoring your files from non-local backups and changing all impacted passwords should prevent any serious damage from the infection.

The popularity of ransomware-based Trojans like the CryptXXX Ransomware sometimes makes it easy to assume that they're simple, kit-grown products that can be all but ignored. Treating the CryptXXX Ransomware in a similarly lackadaisical fashion could open your Web accounts up to fraud and hijackings, along with the ever-present danger to the files saved on your computer.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\#_HOW_TO_FIX_!.hta File name: #_HOW_TO_FIX_!.hta
Size: 2.13 KB (2138 bytes)
MD5: c1f3e911e6956e0162f876713b105e2f
Detection count: 281
Mime Type: unknown/hta
Path: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: April 15, 2017
%SystemDrive%\Users\<username>\AppData\Local\#_HOW_TO_FIX_!.hta File name: #_HOW_TO_FIX_!.hta
Size: 2.15 KB (2153 bytes)
MD5: 918f18716ec0e1aa45663729e466af26
Detection count: 115
Mime Type: unknown/hta
Path: %SystemDrive%\Users\<username>\AppData\Local
Group: Malware file
Last Updated: April 15, 2017
%SystemDrive%\Users\<username>\AppData\Local\#_HOW_TO_FIX_!.hta File name: #_HOW_TO_FIX_!.hta
Size: 2.14 KB (2144 bytes)
MD5: 392584ba2249f34ae158a516c9cebe0b
Detection count: 110
Mime Type: unknown/hta
Path: %SystemDrive%\Users\<username>\AppData\Local
Group: Malware file
Last Updated: April 15, 2017
%TEMP%\{68815C74-7E0F-48E1-9358-B127C595A632}\api-ms-win-system-Sens-l1-1-0.dll File name: api-ms-win-system-Sens-l1-1-0.dll
Size: 249.85 KB (249856 bytes)
MD5: 22288a76cfa7348ced6db347b2085f18
Detection count: 34
File type: Dynamic link library
Mime Type: unknown/dll
Path: %TEMP%\{68815C74-7E0F-48E1-9358-B127C595A632}
Group: Malware file
Last Updated: May 11, 2016
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\#_HOW_TO_FIX_!.hta File name: #_HOW_TO_FIX_!.hta
Size: 2.13 KB (2138 bytes)
MD5: 44625edeb1d88d449a254b8cae49dc4a
Detection count: 16
Mime Type: unknown/hta
Path: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: April 15, 2017
%SystemDrive%\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\#_HOW_TO_FIX_!.hta File name: #_HOW_TO_FIX_!.hta
Size: 2.13 KB (2138 bytes)
MD5: 7463581a2018a2a5d15c7640e4125ead
Detection count: 7
Mime Type: unknown/hta
Path: %SystemDrive%\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: April 15, 2017
file.dll File name: file.dll
Size: 406.52 KB (406528 bytes)
MD5: cf892c22f1b8cbdd33c11cc9050d483b
Detection count: 5
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: August 17, 2022
file.dll File name: file.dll
Size: 619.52 KB (619520 bytes)
MD5: e46c7530f475e07bef1a87df3c14f9d6
Detection count: 2
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: May 11, 2016

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%APPDATA%\Microsoft\Windows\Network Shortcuts\@README.BMP%APPDATA%\Microsoft\Windows\Network Shortcuts\@README.HTML

Related Posts

Loading...