Malware News Crysis Ransomware Appears Out of Thin Air to Take TeslaCrypt's Place

[Jack]

Content source

http://news.softpedia.com/news/crysis-ransomware-appears-from-thin-air-to-take-teslacrypt-s-place-505082.shtml

While everybody was expecting Locky, CryptXXX, or Cerber, Crysis swoops in to steal the show from the headliners

Named Crysis, first versions of this ransomware were spotted online in mid-February. ESET claims that these were not some of the best they've seen, and the company's experts believe they might be able to crack their encryption system.

Unfortunately, they're not so confident when it comes to its latest versions, though, revealing that Crysis features a strong encryption mechanism that goes after local files, network shares, and even removable drives once it infects a target.

Crysis encrypts almost every file on your PC
Crysis doesn't bother targeting certain file extensions but encrypts every file it can get it hands on, except its own binaries and core Windows files. Even files without an extension won't escape.

Once the encryption process finishes, Crysis communicates to its C&C server, sends local computer details in order to identify the infected target, and tells it the number of files it encrypted.

At this point, the ransomware's operations are almost done, and all that's left to do is to drop a text file on the user's desktop named "How to decrypt your files.txt" and then change the user's desktop.

Read more:
Crysis Ransomware Appears Out of Thin Air to Take TeslaCrypt's Place

 

[cruelsister]

This one is quite destructive; a bit over the top even for me. But I disagree with ESET's comment that this is the Tesla replacement- CryptXXX has a big lead for that honor.

 

[cruelsister]

And it seems to get right past Group Policy protection of the C:\Users\Documents folder.

Those Indian hackers are really upping their game.

 

[_CyberGhosT_]

Great read Jack,
Will be keeping an eye open for updates on the
progress of this one.
PeAcE

 

[DardiM]

...
Crysis encrypts almost every file on your PC
Crysis doesn't bother targeting certain file extensions but encrypts every file it can get it hands on, except its own binaries and core Windows files. Even files without an extension won't escape.
...

But where will they stop with their ransomware ?

It seems it already tried to attack MalwareTips :
Crysis says Hi

Thanks for the article

 

[jamescv7]

Considering that it will make your computer unbootable due to encrypting Windows core files then the risk of destruction is obvious.

Its a matter of taste on medicine where side effects really varies.

 

[Noxx]

Very scary stuff. Good luck to all you courageous ones out there trying to find a solution for all the victims of their cyberterrorism.