CryCryptor Ransomware

The CryCryptor Ransomware is a file-locking Trojan for Android devices. The CryCryptor Ransomware holds various media formats of files hostage by encrypting them and creates text messages with e-mail-based ransom negotiating recommendations. Users can recover with backups or free decryption options while allowing their anti-malware tools to identify and uninstall the CryCryptor Ransomware.

When Bugs Come to the Rescue of Trojan Victims

File-locking Trojans are becoming all the rage with Android systems, just as they already dominate the Trojan industry targeting desktop and laptop environments. The CryCryptor Ransomware, a derivative of a GitHub project, is an exceptional instance of bugs becoming benefits to those whom it assaults. Although it has most of the features that malware experts expect of file-locking Trojans, an internal security oversight provides an unlocker for all comers – at least, in the current builds.

Most of the CryCryptor Ransomware's code is from CryDroid, a supposed research project available to threat actors and casual programming enthusiasts alike. This Android-specific version of the Trojan is propagating through a crafted website that pretends to provide downloads of a Canadian COVID 19 Tracer App. This tactic coincides with the Canadian government's announcement of a legitimate application of this nature's development, showing that the threat actor isn't above using recent security news for lures.

The CryCryptor Ransomware encrypts fewer formats than most Trojans of the type but includes databases, documents, text files, pictures, spreadsheets and movies. Its attack keeps the victim from opening the affected file until they buy into the ransom-based decryption service, which the CryCryptor Ransomware comes with as an internal feature.

Thankfully, an Android-specific export vulnerability, CWE-926, leads to the CryCryptor Ransomware's encryption being non-secure. There already is a free decryption service on the Web, which should force the Trojan into unlocking the victim's files at no cost. 

Eradicating a Virtual Disease before Your Files are in Its Tally

The CryCryptor Ransomware is just one of a long-increasing count of hacking campaigns that use the Coronavirus epidemic for infecting mobile devices, home computers, and workstations. The 'COVID-19 CONTACT' Email Virus, the Netwalker Ransomware and the BlackNET RAT are a handful of recent cases. The shared ground between all of them is that the user endangers their device by downloading the threat from an untrustworthy, but disguised link.

Users can check for reviews on application stores and avoid non-official download resources to curate their downloading behavior against threats. Most anti-malware tools compatible with the Android environment also should flag the CryCryptor Ransomware heuristically as a generic threat. Although an unlocker is attainable easily, future attacks may update the CryCryptor Ransomware, and users should have backups kept safe, instead of depending on decryptors.

Anti-malware protection is always beneficial for preventing infections, emphasizing low-level threats like the CryCryptor Ransomware. Most cyber-security products designed for combating Trojans should delete the CryCryptor Ransomware immediately and without regard for its 'disease application' disguise.

It's not every Trojan's story that can have the happy ending that the CryCryptor Ransomware accidentally provides. Even a free decryptor is redundant for those who mind their phone's health as much as their biological well-being.