Crypt0L0cker Ransomware

The Crypt0L0cker Ransomware is a Trojan that can block your files by using encryption to make them unreadable. The Crypt0L0cker Ransomware's payload includes pop-ups recommending that you visit the threat actor's website for recovering your information, a solution that the extortionists sell for a fee. The potential of this method of data recovery backfiring is high, and malware experts suggest that you protect your files with backups while safeguarding the rest of your PC's security with anti-malware products that could delete the Crypt0L0cker Ransomware.

Excel Excelling at Delivering Ransoms to Your Doorstep

Opening the wrong file to infect your PC is a well-known horror story, but most of 2017's Trojan campaigns utilize the easily-detected infection vector of executable files bearing inappropriate extensions. The Crypt0L0cker Ransomware uses a more limited but more subtle disguise to hide its installation onto your PC: an exploit that its threat actors embed into an actual 'XLS' Excel spreadsheet. Opening the spreadsheet and enabling all displayable content downloads the rest of the installer and infects the computer, placing its contents at the mercy of the Crypt0L0cker Ransomware.

The Crypt0L0cker Ransomware's authors appear to be targeting only German speakers in current attacks, although file-encrypting attacks can damage files from the system's language settings indiscriminately. After locking your files, the Crypt0L0cker Ransomware loads a pop-up to promote ransoming your data back with the help of the threat actor's website, which he protects with Tor browser-based anonymity.

Some of the other features malware researchers took note of in the Crypt0L0cker Ransomware's payload include, but aren't limited to:

• The Crypt0L0cker Ransomware maintains system persistence by injecting itself into the explorer.exe process of Windows through a new Registry entry. It also can generate additional, separate processes.
• Network activity allows threat actors to use the Crypt0L0cker Ransomware to manage aspects of the attack, such as monitoring the infection duration, the vulnerability of the system to other attacks or determining the probability of ransom payments.
• Other Registry changes the Crypt0L0cker Ransomware makes tamper with the Windows proxy settings, which con artists can use to redirect you to a corrupted website or intercept your information.

Locking Trojans Outside before They can Lock What's Inside

The relatively traditional infection vector that the Crypt0L0cker Ransomware's threat actor favors mean that established defenses should continue being potent wards against its distribution. Disabling Excel macros by default is a general security recommendation that malware experts still emphasize, in light of Trojan campaigns using them for non-consensual downloads occasionally. These compromised files may use legitimate spreadsheet formats and most often will appear as attachments in specially-crafted e-mail spam, particularly for attacks targeting businesses.

The Crypt0L0cker Ransomware uses the brand name of CryptoLocker, but malware experts have yet to confirm any relationship in code between the two threats. With potential decryption research ongoing, victims can seek assistance from appropriate anti-malware researchers or use their backups to recover their encrypted content. However, having anti-malware protection to delete the Crypt0L0cker Ransomware without letting it encode anything is the only surefire protection against its payload.

Germany is a popular target for threat campaigns perennially, but file-ransoming for profit is a strategy that con artists are deploying worldwide. Whether you speak the language of the Crypt0L0cker Ransomware's ransom message or not, it's never safe to do without any backups.