{"id":17502,"date":"2015-05-04T09:37:31","date_gmt":"2015-05-04T15:37:31","guid":{"rendered":"https://www.webroot.com/blog/?p=17502"},"modified":"2018-01-30T11:01:20","modified_gmt":"2018-01-30T18:01:20","slug":"alphacrypt","status":"publish","type":"post","link":"https://www.webroot.com/blog/2015\/05\/04\/alphacrypt\/","title":{"rendered":"AlphaCrypt"},"content":{"rendered":"

We’ve encountered yet another encrypting ransomware variant and\u00a0at this point it’s expected since the scam has exploaded in popularity since it’s inception in late 2013. This one has a GUI that is almost identical to TeslaCrypt<\/a>.<\/p>\n

\"GUI\"<\/a><\/p>\n

While this may look identical to TeslaCrypt it does have some improvements like deleting the VSS to make sure you aren’t saved by your shadow volume. Take a look at the below strings from an unpacked memory dump.<\/p>\n

\"VSS<\/a><\/p>\n

We can very clearly see that it opens up a command prompt and runs the command “vssadmin.exe delete shadows \/all \/Quiet” This will ensure that all shadow copies are deleted and the \/Quiet will make sure that the command does not display messages to the user while its running.<\/p>\n

Payment is similar to recent variants – bitcoin through layered tor browsing. Not using a money mule like ukash or moneypak allows the authors to maximize thier earning power and anonymity. They can just take the full ransom amount and put through a bitcoin mixer that will use sophisticated algorithms to scramble it through millions of addresses and completely “clean” the money.<\/p>\n

\"bitcoin<\/a><\/p>\n

A more convenient feature this variant of encrypting ransomware\u00a0has is that you are not immediately forced to use install the tor browser and will instead try and use URLs that use public gates to the secret server through your current installed browser. However, these don’t always work so the backup option is to install Tor like we’ve seen previously. See the entire ransom notice below.<\/p>\n

\"Ransom<\/a><\/p>\n

The volatitlity of this variant is quite high since it creates new instances of common windows processes to do the encryption routine to try and be as covert as possible and is extremely similar to how Cryptowall 3.0 opertates. Below\u00a0is the final bit of unpacking, where it sets the child process context and resumes the thread.<\/p>\n

\"unpacking<\/a><\/p>\n

MD5 analysed: 1C71D29BEDE55F34C9B17E24BD6A2A31
\nAditional MD5 seen: 6B19E4AE0FA5B90C7F0620219131A12D<\/p>\n

Webroot will catch this specific variant in real time and heuristically before any encryption takes place. We\u2019re always on the look out for more, but just in case of new zero day variants, remember that with encrypting ransomware the best protection is going to be a good backup solution. This can be either through the cloud or offline external storage. Keeping it up to date is key so as not to lose productivity. Webroot has backup features built into our consumer product that allow you to have directories constantly synced to the cloud. If you were to get infected by a zero day variant of encrypting ransomware you can just restore your files back as we save a snapshot history for each of your files up to ten previous copies. Please see our community post <\/a>on best practices for securing your environment against encrypting ransomware.<\/p>\n","protected":false},"excerpt":{"rendered":"

We’ve encountered yet another encrypting ransomware variant and\u00a0at this point it’s expected since the scam has exploaded in popularity since it’s inception in late 2013. This one has a GUI that is almost identical to TeslaCrypt. While this may look identical to TeslaCrypt it does have some improvements like deleting the VSS to make sure […]<\/p>\n","protected":false},"author":21,"featured_media":17503,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[5451,15941,5443,5435,15393,18593,4197,4487,3937,8015,18597,5205,15739,3471,5439,18595,18591,4201,4161,3525],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/17502"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=17502"}],"version-history":[{"count":9,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/17502\/revisions"}],"predecessor-version":[{"id":17591,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/17502\/revisions\/17591"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17503"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=17502"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=17502"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=17502"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=17502"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}