Hot on the tail of devilish Cryptolocker comes a copycat software nasty that holds victim's files to ransom – but the newcomer's encryption is potentially breakable, we're told.
Security startup IntelCrawler claims a "large-scale distribution" of the new so-called Locker malware began earlier this month.
Locker, once it has infected a PC, copies and encrypts a victim's documents, adding a ".perfect" extension, and then deletes the original data. The trojan also places a contact.txt file in each directory containing contact details of the malware author – usually a throwaway mobile phone number or an email address.
Victims are warned that if they harass or threaten the extortionist, the decryption key to unlock the files will be deleted, revealing the mindset of the scumbags behind the scam.
IntelCrawler contacted a crook listed in the contact file, and was told someone would have to pay up $150 to a Perfect Money or QIWI VISA Virtual Card number to receive the decryption key needed to restore the information on a Locker-infected machines.
In order to decrypt, you need to provide an identifying code written in the “contact.txt” file, as well as the hostname of the compromised computer.
Full Topic
Reply
Rich Text Editor, editor1
Editor toolbars
Press ALT 0 for help
Login to the community
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.