[BC] CryptXXX Ransomware Help, Information Guide, and FAQ

[chantal11]

Bonjour,

Une fiche BleepingComputer sur le ransomware CryptXXX

CryptXXX Ransomware Help, Information Guide, and FAQ

CryptXXX is a Windows ransomware infection that was discovered by Kafeine (Proofpoint) in the middle of April 2016. This ransomware infection will affect all versions of Windows, including Windows XP, Windows Vista, Windows 7, Windows 8, and Windows 10. When a victim is infected they will have their files encrypted and then a ransom of about 2.4 bitcoins, or approximately $1,000 USD, will be demanded in order to receive the decryption key.

When CryptXXX infects your computer it will scan all the drive letters for targeted file types, encrypt them, and then append the .crypt extension to them. Once these files are encrypted, they will no longer able to be opened by your normal programs. When CryptXXX has finished encrypting the victim's files, it will change the desktop wallpaper to an image that acts like a ransom note. It will also display a HTML ransom note in your default browser. These ransom notes include instructions on how to connect to the CryptXXX Decrypt Service where you can learn more about what happened to your files and how you can make a CryptXXX ransom payment.

Is it possible to decrypt .CRYPT Files encrypted by CryptXXX for Free?

CryptXXX has had three versions released as of 5/24/16. Of these released versions, Version 1 and Version 2 have been able to be decrypted for free using Kaspersky's RannohDecryptor. If you are infected with Version 3.0, then RannohDecryptor does not currently work on it.

RANNOHDECRYPTOR.EXE

[chantal11]

Une nouvelle fiche BleepingComputer sur le ransomware CryptXXX

CryptXXX rebranding as UltraCrypter?

A new update to the CryptXXX Ransomware has made significant design changes to both the ransom notes and the TOR payment site. Previously, CryptXXX, like many other ransomware infections, copied the layout and design of CryptoWall. With this recent update, they have now created their own template and changed the name of their decryptor to UltraDeCrypter. Could this indicate a formal name for the ransomware as UltraCrypter?

[chantal11]

CryptXXX Ransomware moves from the Crypz extension to a Random One

A new version of the CryptXXX/UltraCrypter ransomware was released today that switched from using the .crypz extension to a random one consisting of 5 hexadecimal characters. For example, one computer's encrypted files may use the extension .AC0D4, while another victim's files would use the .DA3D1 extension.