This process has to be initiated by contacting the cyber criminals via the provided website, which is only accessible through the Tor browser. Victims must obtain the decryption key (password) and software - to restore their files. The ransom-demanding message (pop-up and 'READMETOUNLOCK.txt') informs victims that their data has been encrypted using the RSA-2048 cryptographic algorithm. Screenshot of a message encouraging users to pay a ransom to decrypt their compromised data:ĬryptoLocker (Xorist) ransom note overview Once this process is complete, identical ransom notes are created/displayed in a pop-up window and ' READMETOUNLOCK.txt' text file, which is dropped onto the desktop. For example, a file like ' 1.jpg' would appear as ' 1.jpg.CRYPTOLOCKER'. In other words, this malware renders files unusable and asks victims to pay - to restore access to their data.ĭuring the encryption process, affected files are appended with '. What is CryptoLocker (Xorist) ransomware?īelonging to the Xorist ransomware family, CryptoLocker is a malicious program designed to encrypt data and demand payment for the decryption.

Crypto locker ecc file