CryptoDefense is another encryption software in the wake of
Cryptolocker. It employs almost the same way to encrypt the document and data on a target machine:
CryptoDefense acquires
RSA public key from its remote control server when its vicious codes is injected by a supportive worm. A new AES key will be consequently generated to encrypt almost all types of files including .jpg. In other word, the encrypted documents are locked down with two keys. One of them can be deciphered by a private key which can be accessed on its controller and the other is in the hand of CryptoDefense’ author.
If one hands over money, the hacker would ask the victim to download certain browser and get the private key him/herself. Once the key it typed on the locked down computer, the hacker would remotely control the machine and use another key to finally decipher the documents, if the hacker keeps his/her words. Therefore, the decipher means has not yet been mastered. But it is necessary to remove CryptoDefense’ vicious code from the computer to prevent further damage.
Damages by CryptoDefense
Asking for BitCoin is its main goal. To ensure the income, some damages should be made concretely. By preloading its virulent code into boot sector and overwriting concerning drivers, CryptoDefense manages to run right before Windows displays its desktop, making it futile to dodge CryptoDefense by simply rebooting the affected computer or by enabling Task Manager. Drivers regarding security utilities are also disabled by CryptoDefense; plus complex SHA shell, CryptoDefense is capable of hindering any modifications of its core files and data, so that the evil deeds can be guaranteed. When drivers, tools to communicate between hardware and software for a better operation, are disabled or maliciously modified, mechanical problems, dysfunctions and malfunctions would be incurred:
Dllhost.exe Process Information
