VCrypt Ransomware

The V Crypt Ransomware is a file-locking Trojan that captures your media files by moving them into password-protected archives. The V Crypt Ransomware attacks also include the large-scale deletion of non-locked data and a French ransom note. Users should have backups for recovery or contact a trustworthy anti-malware researcher for their assistance while quarantining or removing the VCrypt Ransomware through a good anti-malware program.

Criminals Ruining Good Programs for Everyone

Encryption of files on a one-by-one basis is the standard among criminals who extort money by locking their victims' digital media. Even though it's widely-applicable and easily-coded securely, not every threat actor favors it for their 'lock' of choice. Some campaigns, such as those of the QP Ransomware, the Xavier Ransomware, the WinRarer Ransomware, or the AlldataLocker Ransomware, will instead use a third-party program for the purpose. The VCrypt Ransomware is the latest continuation of this strategy that malware experts can confirm.

Like some of the previously-named Trojans, the VCrypt Ransomware uses 7-Zip, an open-source archiver that functions not very differently from WinZip or WinRAR. The Trojan drops the zipper's executable (in case the user doesn't have a copy, already) and searches media-specific locations like the user's documents, desktop or music directories. Then, it moves the data in those areas into an archive, which it protects with a password.

Most other parts of the VCrypt Ransomware's payload aren't very different from those of, for example, Hidden Tear or the Scarab Ransomware. It generates a pop-up in French with a link to its (currently down) website for processing ransoms and replaces the background with its BMP file. A threatening exception is the VCrypt Ransomware's deleting non-hostage files, which can erase all data on the non-C drives.

Swerving from a Threatening Driver

The VCrypt Ransomware campaign is not an update or variant of the years-old vCrypt1 Ransomware one's attacks and shows few symptoms for tracking it back to any propagation techniques. Currently, malware experts confirm that the VCrypt Ransomware's executable is using a fake graphics driver-based name. Despite this clue, victims are asserting that infections are occurring without any downloads or remote desktop exploits. An Exploit Kit may be delivering the VCrypt Ransomware through drive-by-download vulnerabilities while the victim browses a compromised website.

Updating software, turning off high-risk features (including Flash, Java, JavaScript and macros), and monitoring your download behavior will keep most file-locker Trojans at bay. With only French versions of the VCrypt Ransomware in the wild, users should remain careful around French-language driver resources, especially. The VCrypt Ransomware is a Windows program, like most, if not all, of its kind.

Since the VCrypt Ransomware uses a hard-coded password, victims might recover their data through inputting the correct value (currently: 'Oezfdse6f5esf413s5fd4e6fSQ45R424EDDEZS'). Backups are, otherwise, necessary for recovery, while anti-malware products of proven brands should delete the VCrypt Ransomware correctly.

Data storage today would be in a worse place without archival and compression tools, but criminals can turn any useful utility into a threatening opportunity. The VCrypt Ransomware might base its attacks off of 'freeware,' but it's free to anyone who it attacks hardly.