CryptXXX adds password dumping and data exfiltration features
StillerX works just like classic password dumpers, also known as infostealers. These types of malware are specifically designed to attack the internal databases of several software packages, extract encrypted or cleartext passwords, and then send them to an online server.
CryptXXX's StillerX module is capable of targeting all sorts of software, such as browsers, download managers, email clients, FTP software, IM applications, poker apps, proxy clients, VPNs, dialer credentials, and passwords stored in WNetEnum's cache and Microsoft's Credential Manager.
Users can detect a CryptXXX ransomware infection that comes with StillerX by the presence of the "stiller.dll," "stillerx.dll" and "stillerzzz.dll" files on their systems.
Proofpoint says that there are clues in StillerX's code making them believe the module could be used as a standalone, without CryptXXX.
Other new changes in CryptXXX 3.100
Besides the ability to steal your passwords for future cyber-attacks, CryptXXX also changed its decryption website. The portal received a facelift and now features new graphics.
Until now, the ransomware used the same user interface as the CryptoWall ransomware.
Last but not least, CryptXXX is now also capable of searching for network-connected drives and infect the files it finds on those partitions as well. The ability to search and infect network drives has been seen in several ransomware families in recent weeks and seems to be a natural course of evolution for most of these threats in an attempt to maximize their impact and force victims to pay the ransom.
After CryptXXX had appeared this April, Kaspersky managed to crack CryptXXX 1.x and then CryptXXX 2.x. CryptXXX 3.100 is once again undecryptable, breaking the Russian company's free decryption tool.
