CryptXXX Ransomware

The CryptXXX Ransomware is a file encryptor that holds data on your PC hostage in exchange for Bitcoin payments. Besides blocking this content with its encryption routine, the CryptXXX Ransomware also has strong connections to both spyware attacks and fraudulent Web traffic generation. All of the usual data backup strategies can protect your PC from the CryptXXX Ransomware's attacks, but malware experts also draw attention to the importance of scanning your entire system with anti-malware tools capable of spotting and removing the CryptXXX Ransomware, along with all other threats.

The CryptXXX Ransomware: A Swiss Army Knife of Threats

Most threat authors may create programs that specialize themselves in particular niches, such as collecting information or bypassing network security, while passing off any other attacks to separate programs. Although some of the most professionally-designed and sophisticated threats may use modules to increase their capabilities, at the baseline level, threats tend to focus on particular themes. This truth makes the CryptXXX Ransomware an unusual subversion: a Trojan that can encrypt your files and collect your information, all while related threats perform additional attacks.

The CryptXXX Ransomware installs itself with the help of a variant of Bedep, a Trojan downloader that may drop spyware onto its victims' PCs. The CryptXXX Ransomware keeps itself in line with this previous trend, and can capture (and transfer it into the wrong hands possession, via a C&C network connection) login information from e-mail accounts, FTP accounts and messenger applications. The CryptXXX Ransomware also monitors similar information from most Web-browsing activities, and may compromise your Bitcoin wallet.

The CryptXXX Ransomware's other, primary function is to scan for media and work files, such as Word documents or BMP images, and then run them through an RSA-4096 encryption process. The CryptXXX Ransomware, then, offers to sell a Web browser. Current ransom sums come in at slightly over 500 USD in value, significantly higher than the average for this segment of the threat industry.

The symptoms of these last attacks are signaled clearly through the use of '.crypt' format extensions, desktop imagery and multiple text instruction files. However, malware experts found no symptoms associated with the CryptXXX Ransomware's information-collecting functions that also can occur simultaneously.

Doing Your Part to 'X out' the CryptXXX Ransomware Campaign

Although the CryptXXX Ransomware's attacks seem to have begun in March of this year, internal evidence suggests that it has its roots in threats older than itself. Code divers may note similarities between the CryptXXX Ransomware and Reveton, a fake Police Trojan and spyware program. Besides their remarkably similar payloads, both threats share the same coding language, and other, structural similarities, such as using TCP 443 for network communications. They also share similar delivery methods that base themselves on the Angler Exploit Kit, a threat that may attack vulnerable PCs through their browsers.

Malware experts always recommend that you deal with a file encryptor's infection by removing the threat before taking any other actions. Using deep scan options from your anti-malware products for removing the CryptXXX Ransomware also gives you the greatest chance of identifying other threats that can install themselves along with it. Afterward, restoring your files from non-local backups and changing all impacted passwords should prevent any serious damage from the infection.

The popularity of ransomware-based Trojans like the CryptXXX Ransomware sometimes makes it easy to assume that they're simple, kit-grown products that can be all but ignored. Treating the CryptXXX Ransomware in a similarly lackadaisical fashion could open your Web accounts up to fraud and hijackings, along with the ever-present danger to the files saved on your computer.

Technical Details