Cryptobyte Ransomware

The Cryptobyte Ransomware is an update of the Crptxxx Ransomware and, like its ancestor may lock your media by encrypting it. The Cryptobyte Ransomware supplements these attacks with messages that extort cryptocurrency in return for the decryption key to unlocking your files. Content recovery always should use alternatives, such as restoring from a backup, when possible, and any high-quality anti-malware solutions should block or remove the Cryptobyte Ransomware immediately.

A Snapshot of New Wares from Trojan Peddlers

With most Trojan campaigns, the most delicate stage of an operation often is the installation process, which usually requires tricking the PC's user into giving consent, one way or another. Although drive-by-downloads from the RIG Exploit Kit and macros embedded in e-mail spam attachments are two, classic proliferation strategies, malware experts came across a third one recently. The Cryptobyte Ransomware, a derivative of the older Crptxxx Ransomware and the Btcware, compromises the system and sabotages your files after pretending to be a digital camera application.

The Cryptobyte Ransomware's executable circulates as a fake, Agfa-brand FotoLook program, which con artists may be hosting on corrupted websites or distributing on peer-to-peer torrent networks. A complete installation causes attacks and symptoms that malware analysts rate as being only minor differences from the Crptxxx Ransomware. These include:

• The Trojan uses Registry exploits to force Windows to launch it whenever the system restarts.
• The Trojan drops DLL files and other components that it hides with misleading filenames and paths implying that they're parts of a Microsoft Office installation.
• Like the Crptxxx Ransomware, the Cryptobyte Ransomware scans for files on your PC to block by encoding them with an encryption-based cipher, such as the AES or XOR. This threat-defining attack can leave your documents, pictures and other content unusable.
• These files also experience filename changes that append new extensions, including an e-mail address in brackets and the '.cryptobyte' string.
• To profit from this scenario, the Cryptobyte Ransomware creates an INF-based text file for demanding Bitcoins to give you the decryptor.

Shuttering the Cryptobyte Ransomware Campaign

The threat actors updating the Cryptobyte Ransomware are choosing to leave their specific ransoming demands flexible, based on the timing of the victim's response. This social engineering strategy can keep victims from gathering information on what an average payment is and encourages paying quickly, to your detriment potentially. Con artists can hold any money without needing to provide any services for data recovery, and, even if they do so, aren't guaranteed to be able to decrypt all affected files completely.

Some file-encrypting Trojans are vulnerable to being decrypted by free software developed by different researchers and companies in the PC security community. However, malware experts have yet to verify working decryption applications for the Cryptobyte Ransomware; having a backup still is the most direct recovery strategy possible. Industry-wide detection rates against this Trojan are at fifty percent, and concerned users should update their anti-malware programs as necessary for removing the Cryptobyte Ransomware before it gains access to their files.

With most threat actors preferring more sophisticated distribution models, it can be easy to overlook ancient ones, such as tactics that install Trojans while pretending to give you legitimate software. Taking a look back at the history of a website before you trust the files it hands you could save your files from being attacked by threats like the Cryptobyte Ransomware.

Technical Details