CRYPTNET Ransomware Will Lock Your System
While examining new malware samples, our research team came across the CRYPTNET ransomware. We ran a test of the ransomware on our machine and observed that it encrypted files, and added a random five-character extension to their filenames.
For instance, a file named "1.jpg" appeared as "1.jpg.3cWkR", and "2.png" became "2.png.1PLui". The ransomware also altered the desktop wallpaper and produced a ransom note called "RESTORE-FILES-[random_string].txt". The note demanded payment in exchange for the decryption of the encrypted files, claiming that the victim's sensitive data had been stolen and would be leaked if their demands were not met. The message also offered a free decryption test as proof that data recovery was feasible.
CRYPTNET does not seem to belong to any specific bigger family of ransomware clones and variants.
CRYPTNET Ransom Note Uses Tor Page for Contact
The full text of the CRYPTNET ransom note reads as follows:
*** CRYPTNET RANSOMWARE ***
--- What happened? ---
All of your files are encrypted and stolen. Stolen data will be published soon
on our tor website. There is no way to recover your data and prevent data leakage without us
Decryption is not possible without private key. Don't waste your and our time to recover your files.
It is impossible without our help--- How to recover files & prevent leakage? ---
To make sure that we REALLY CAN recover your data - we offer FREE DECRYPTION for warranty.
We promise that you can recover all your files safely and prevent data leakage. We can do it!--- Contact Us---
Download Tor Browser - hxxps://www.torproject.org/download/ and install it
Open website: hxxp://cryptr3fmuv4di5uiczofjuypopr63x2gltlsvhur2ump4ebru2xd3yd.onion
Enter DECRYPTION ID: -
How Can Ransomware Like CRYPTNET Get on Your Computer?
Ransomware like CRYPTNET can get on your computer through various means, including:
- Phishing emails: Attackers often send phishing emails that contain malicious attachments or links. Once the victim clicks on the attachment or link, the ransomware gets downloaded and installed on the computer.
- Malicious websites: Visiting malicious websites that contain exploit kits can also lead to ransomware infections. Exploit kits are designed to exploit vulnerabilities in a user's web browser, operating system, or software to download and install malware like ransomware.
- Malvertising: Malvertising refers to online advertisements that contain malicious code. When a user clicks on such an advertisement, the ransomware gets downloaded and installed on their computer.
- Software vulnerabilities: Ransomware can exploit vulnerabilities in software to gain access to a user's computer. Outdated software, especially operating systems and applications that are no longer supported, can be particularly vulnerable to ransomware attacks.
To protect your computer from ransomware, it's essential to keep your software and operating system up-to-date, avoid clicking on suspicious links or downloading attachments from unknown sources, and use antivirus software to detect and prevent ransomware infections. Additionally, it's important to regularly back up your data to an external hard drive or cloud storage service to prevent data loss in the event of a ransomware attack.
