4 ms·
> does the virus need to check in with the backend for every single file for unique keys? As it's based on CryptoLocker, all the files would be encrypted with
by logn 12y ago
> does the virus need to check in with the backend for every single file for unique keys?
As it's based on CryptoLocker, all the files would be encrypted with the same key. After CryptoLocker was busted by law enforcement, "Fox-IT and fellow firm FireEye introduced an online service which allows infected users to retrieve their private key by uploading a sample file, and then receive a decryption tool" (https://en.wikipedia.org/wiki/Cryptolocker#Takedown_and_recovery_of_files https://en.wikipedia.org/wiki/Cryptolocker#Takedown_and_reco...)
edit: technically the files are encrypted with different keys but those keys are stored on the victim's machine and encrypted with a single key -- http://www.welivesecurity.com/2013/12/19/cryptolocker-2-0-new-version-or-copycat/ http://www.welivesecurity.com/2013/12/19/cryptolocker-2-0-ne...
- HackinOut 12y agoI wouldn't be so sure this would help: CryptoLocker was using symmetric encryption (AES) for the files while CryptoWall apparently solely use RSA (which creates problems for the pirate, like slow encryption, thus encrypting only small files (.jpeg, .doc...)?). Only the public key seems to be downloaded when the malware installs. (http://stopmalvertising.com/malware-reports/cryptowall-behind-the-scenes.html http://stopmalvertising.com/malware-reports/cryptowall-behin...) If this is the case, I would surprised if they would download the private key for the one free decrypt feature. If they encrypt only small files they might do the decryption on the remote C&C Server? It's worth investigating anyway.