- Oct 15, 2013
- 501
Read more: http://labs.bitdefender.com/2013/10/cryptolocker-ransomware-makes-a-bitcoin-wallet-per-victim/Bitdefender antimalware researcher Octavian Minea explains the detailed inner workings of the Cryptolocker ransomware:
The Cryptolocker ransomware gets installed by a Zbot variant and upon being run it immediately adds itself to Startup under a random name and tries to talk to a command and control server – sending a 192 byte encrypted packet of the form
"version=1&id=1&name={COMPUTER_NAME}&group={GROUP_NAME}&lid={LOCATION_ID}"
where {GROUP_NAME} seems to be related to the time of compilation of the malware and an example for {LOCATION_ID} is “en-US”
Bitdefender provides a CryptoLocker blocking tool on the website.
Last edited: