XCrypto Ransomware

The XCrypto Ransomware is a file-locking Trojan of an unknown family. Similar to preexisting Ransomware-as-a-Services, it blocks the victim's media content with encryption. The XCrypto Ransomware also delivers a ransom note that asks for money in return for unlocking the files with a decryptor. Users with backups have protection from most ill effects, and professional anti-malware services will detect and remove the XCrypto Ransomware.

Raising Questions about New Trojans and Their Attacks

With the side-by-side campaigns of separate, but symptomatically similar families of Ransomware-as-a-Services, victims have a harder time than ever telling the stakes of Trojan attacks. The XCrypto Ransomware is another case in point that uses well-known templates for delivering its demands, along with generic, data-compromising attacks that might belong to an enormous range of RaaSes. The surest things one can say about its campaign is that secured backups are the best means of bringing it to an end.

The XCrypto Ransomware samples are unsigned Windows executables that use the .NET Framework, a typical component of many file-locker Trojans. Although malware analysts can't identify its current encryption method or the security thereof, they confirm the program's using encryption for locking files, with the usual emphasis on media of value to the owner (like documents). The XCrypto Ransomware also appends an ID, bracketed e-mail, and extra extension onto files' names, which further brings it in-line with most of the current Ransomware-as-a-Service operations.

The XCrypto Ransomware uses the same ransom note template as the Globe Ransomware, the Globe Imposter Ransomware, and old versions of the Crysis Ransomware. This HTA file delivers instructions on paying Bitcoin for unlocking the data but doesn't give a price, only an e-mail address, for further details. Because malware experts have yet to confirm whether or not the XCrypto Ransomware's encryption is breakable, victims should consider submitting samples of the related files to experienced cyber-security researchers for further analysis on any freeware decryption potential.

Taking Down Trojans of Mysterious Origins

The XCrypto Ransomware has a similar nametag to Russia's XCrypt Ransomware, but malware analysts find no evidence leading to a relationship between the two in a programming sense. Due to samples not giving any further information on the infection methods at play, users on Windows systems will have to use all-inclusive defensive steps to avoid any risk of falling for an attack. For network environments, administrators should attend to monitoring their passwords' security and using the latest, patched versions of all software.

Users also should maintain care around possibly-threatening file interactions, including e-mail attachments and freely-downloadable media and software. Most anti-malware products will identify dangers to your PC during scans, and disabling features like macros, Flash, and JavaScript will tighten one's defenses against drive-by-download exploits. Disguises for attacks related to the XCrypto Ransomware's campaign could use current news events, such as tracking applications for COVID-19 or business-oriented ones like fake invoices.

The XCrypto Ransomware is new, but with nothing surprising in what it delivers. Since its ingenuity might be 'frontloaded' into its delivery and installation exploits, users shouldn't relax too much, and risk their files experiencing the consequences.