Crystal Ransomware

Posted: August 3, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	65

First Seen:	August 3, 2017
Last Seen:	April 18, 2018
OS(es) Affected:	Windows

The Crystal Ransomware is a multi-purpose Trojan that can encrypt your local files, flood other targets with simulated traffic, disable various security features, and download other threats. The symptoms of its attacks can include poor performance and instability from its hardware and network usage, along with being unable to open different programs or files. Malware researchers are classifying this Trojan as a high-level threat, thanks to its flexible payload, and recommend removing the Crystal Ransomware with a dedicated anti-malware product before recovering any encrypted files with a backup.

A Crystal Sharpened on Many Angles

Most Trojans specialize in particular types of attacks and, if their authors need other features, they often will deploy them via self-contained modules or separate programs. However, this is a guideline, not an unbreakable rule, and it's a design philosophy that some Trojan authors choose to disregard. The latest Trojan campaign to do so is the Crystal Ransomware, which uses attacks for harming both the user and unrelated, remote targets.

The Crystal Ransomware is a .NET Framework-based program that consists of three primary facets: a network 'flooder' feature, a downloading one and a file-ransoming attack:

The Crystal Ransomware's network-flooding function generates fake network traffic using the infected PC's hardware. Con artists can configure the Crystal Ransomware to target and flood various network infrastructure (for example, to crash a banking institution's servers while they make fraudulent cash transfers).
The Crystal Ransomware also may download and install other threats onto your PC, similarly to Downloader.Blugger, Upatre or Zlob.
The Trojan also shows prominent symptoms through its file-ransoming functions, which add '.crystal' extensions to the names of your local media, along with encrypting them to block them from opening. The Trojan uses a variant of AES to do so, and malware experts have yet to determine the feasibility of decrypting it.

The Crystal Ransomware also disables some security features of Windows, such as the Task Manager, to prevent the user from monitoring most of its features or removing it.

Cracking a Crystalline Trojan's Advanced Plan of Attack

For the user, the immediate consequences of a Crystal Ransomware infection can include the loss of data in targeted locations, such as the Downloads folder, the OneDrive storage, and the Windows desktop. However, other functions of the Crystal Ransomware's installation, such as its network behavior, may have non-obvious symptoms or impact other victims in ways that aren't determinable immediately. While malware experts always recommend backing up your files to save them from threats that exhibit harmful encryption behavior, the Crystal Ransomware also is a broader security issue than most threats of its category.

Installers for this threat could travel through forged e-mail attachments, disguised downloads, or other methods that require minimal permission from the PC's user. To remove most of these vulnerabilities, you should allow your anti-malware protection to auto-detect compromised Web content and scan all incoming downloads. You also may need to take other actions, such as disconnecting from the Internet or restart in Safe Mode, to help disable the Crystal Ransomware before uninstalling it with an appropriate anti-malware product.

No one would be thrilled about paying ransoms to get their digital possessions returned to them. However, for the Crystal Ransomware's campaign, the inconvenience to the 'host' is a small piece of a larger puzzle that, in turn, is just a cog in the threat industry's machine.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

crystal.exe

File name: crystal.exe
Size: 61.95 KB (61952 bytes)
MD5: 0f27d1180d28e1bcaf4d66f6b51c087c
Detection count: 47
File type: Executable File
Mime Type: unknown/exe
Group: Malware file