Signature Detail

WORM: Cryptolocker Ransomware Download Attempt 3

This signature detects Cryptolocker 2.0 Racketeer ransomware being transferred over network. This malware encrypts a user's local files which can only be decrypted after paying a certain ransom amount. A successful infection could leave no local copies of files that users can access without completing the payment.

References

• URL: https://blogs.sophos.com/2015/03/03/anatomy-of-a-ransomware-attack-cryptolocker-cryptowall-and-how-to-stay-safe-infographic/
• URL: https://en.wikipedia.org/wiki/CryptoLocker