Home / malware

PDF

Trojan.Cryptolocker.I

First posted on 08 September 2014.
Source: Symantec

Aliases :

There are no other names known for Trojan.Cryptolocker.I.

Explanation :

When the Trojan is executed, it creates the following file:
[PATH TO TROJAN]\Locker.exe

Next, the Trojan creates the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"CLock" = "[PATH TO TROJAN]\Locker.exe"

The Trojan then encrypts data files on the infected computer and adds the following extension to each file:
._clf

The Trojan then demands payment to unlock the files.

The Trojan connects to the following remote locations to download the key needed to decrypt the files: clredirect.no-ip.netwww.wnzo.nl/modules/tmp/clredirect.ddns.net
Note: This Trojan is also known as Cryptographic Locker.

Last update 08 September 2014

 

TOP