Malware News CryptXXX Ransomware moves from the Crypz extension to a Random One

[Jack]

A new version of the CryptXXX/UltraCrypter ransomware was released today that switched from using the .crypz extension to a random one consisting of 5 hexadecimal characters. For example, one computer's encrypted files may use the extension .AC0D4, while another victim's files would use the .DA3D1 extension.

The ransom note names are currently set to @[victim_id].txt, .html, and .bmp. So a user with a victim ID of 14AC2EF20B23, would have ransom notes named 14AC2EF20B23.html, 14AC2EF20B23.bmp, and 14AC2EF20B23.txt.


Read more: CryptXXX Ransomware moves from the Crypz extension to a Random One

 

[_CyberGhosT_]

That's pretty cool, in a dastardly way.
Does this make it more secure, meaning "harder to crack" ?
Or is this more of a cosmetic change ?
Great share Jack.

 

[Rishi]

It could be coded that way to generate machine specific unique extension or totally random,certain polymorphic malware are known to adapt with the host, we can only know by reversing the well-hidden algorithms.

 

[jamescv7]

Usually majority of ransomware claimed to use the highest encryption capabilities already, actually others are likely cosmetic or make confusion to make the process of decryption longer to retrieve.

 

[DardiM]

It could be coded that way to generate machine specific unique extension or totally random,certain polymorphic malware are known to adapt with the host, we can only know by reversing the well-hidden algorithms.

Yes, and I think that we will soon have news about the reason / impact of this change .

 

[AlphaBeta]

Maybe the extensions themselves are part of encrypted outputs.

 

[cruelsister]

The extensions are getting cute lately. I was playing around with one this weekend that encrypted the files with the extension ".31392E30362E32303136_12_LSBJ1". On subsequent runs of the same malware the _xx_ numbers changed, everything else stayed the same. Another variant had the ending final 5 characters differing as well as the first few numbers.

Looks like they are pushing this one through a trojan factory prior to sale so that the purchaser gets to have a ransomware file all her own.

Isn't that special!