Cryptolocker

Cryptolocker is a piece of ransomware that encrypts data on the infected host. Cryptolocker uses 2048-bit RSA encryption scheme which has been considered to be secure against brute force attack. In other words, there are no decryption techniques. The purpose of this malware is to hold your sensitive and confidential data as hostage with the intent to extort money for the victim. When infected, the user is asked to pay a ransom of 100-300 dollars/euros. The user is given a specified amount of time to transfer the funds, usually 72 hr. If the user does not pay, the decryption keys are deleted and the data is unrecoverable.

Cryptolocker usually disguises itself as a legitimate company email, asking the user to fill out a travel expense (or some other company form). Of course this is not a pdf but a .exe file. When cryptolocker is up and running on your system it tries to contact one of its command and control servers This server generates the encryption keys and sends it the host. Cryptolocker uses these keys to encrypt your data, it filters by file extension. Formats such as images, video or documents will be encrypted.

Currently, the security industry can only offer advice on how to avoid this infection. However, once infected even security professionals seem to agree that the best option is to pay the ransom. Ironically, people who have paid the ransom report that cryptolocker in fact does decrypt your data and remove itself from your system.