Four Bitcoin accounts associated with CryptoLocker were discovered and it was discovered that 41,928 Bitcoins had been moved through those four accounts between October 15 and December 18, 2013. After payments are received, the first 1024 bytes of an encrypted file are uploaded to the server and the server would then search for the associated private key.ĬryptoLocker infected over 250,000 machines within the first four months it was released in September 2013. The payments have increased over time to 2 Bitcoins or about $460, if the original ransom isn’t paid before the deadline, Cryptolocker gives its victims a second opportunity to pay 10 Bitcoins ($2300) to use a service that connected to the command and control servers. Initially victims are charged $100, €100, £100, two Bitcoins or other figures for various currencies.

The cost to retrieve files from Cryptolocker vary over time and with the particular version being used. If payment is not received in three days victims are usually given a second opportunity to pay a much higher ransom to get their files back. Once files are locked, Cryptolocker then threatens to delete the private key needed to unlock the files if payment is not received within three days.Ĭryptolocker demands that payments be paid in the form of Bitcoins, CashU, Ukash, Paysafecard, MoneyPak or pre-paid cash vouchers.

CryptoLocker is a ransomware virus that infects PCs via downloads from infected websites and email attachments sent to business professionals via a botnet called GameOver ZeuS.Ĭryptolocker is particularly nasty ransomware that uses a 2048-bit RSA key pair, uploaded to a command-and-control server, which it uses it to encrypt or lock files with certain extensions, and delete the originals.

What is crypto locker