CryptoWall v4.0 Released: Now Encrypts Files Names

Featured article by Stu Sjouwerman, KnowBe4

Lawrence Abrams from the famous bleepingcomputer site wrote at Spiceworks:

“CryptoWall 4.0 has been released that displays a redesigned ransom note, new filenames, and now encrypts a file’s name along with its data. We were alerted to this new variant by various members who have posted about being infected by what was being called the help_your_files ransomware.  Once we were able to analyze a sample, though, it was quickly determined that this was in fact a new version of CryptoWall.”

This is a screenshot from their site that shows what it looks like:

In summary, the new v4.0 release now encrypts file names to make it more difficult to determine important files, and has a new HTML ransom note that is even more arrogant than the last one.

Bleeping computer continued: “From analysis done by Nathan Scott, CryptoWall 4.0 has the same installation characteristics and communication methods as previous versions. When communicating with the Command & Control Servers, CryptoWall 4.0 continues to use RC4 encryption  It also continues to create a victim’s unique identifier from the MD5 hash of the computer’s computer name, volume serial number, processor information, and OS version. Like its predecessors, when installed CryptoWall 4.0 will inject itself into Explorer.exe and disable System Restore, delete all Shadow Volume Copies, and use bcdedit to turn off Windows Startup Repair. It will then inject itself into svchost.exe and encrypt the data on all local drives, removable drives, and mapped network drives. Once it has completed encrypting your files it will launch the ransom notes that explain what happened and how to purchase the decrypter.” Here is the full post at BleepingComputer.

System administrators agree that one of the critical pieces of the puzzle to prevent ransomware infections is security awareness training combined with frequent simulated phishing attacks. Find out how affordable this is for your organization and be pleasantly surprised.