CryptoJoker is No Laughing Matter

New Ransomware Demands Ransom in Bitcoins to Get Your Files Back

cryptojokerWith a new year comes new challenges, new hopes, new resolutions, and of course, new ransomware. The newest discovered ransomware called Cryptojoker proves to be anything but amusing to its victims, and although it doesn’t appear to have been widely distributed as of yet, it is an entirely functional ransomware that could see increased distribution in the future.

Beware of unknown emails

IT security experts cannot stress enough how important it is NOT to open emails from unknown sources, but sometimes, the curiosity of these mystery emails is just too much for us to resist. That being said, it is thought that because this ransomware is being disguised as a PDF file, it is more than likely that CryptoJoker is being distributed via email phishing campaign, and you can bet that the subject is not “the PDF file attached to this email is just ransomware in disguise”. Unfortunately, these cybercriminals are a lot smarter than that.

How it works

CryptoJoker uses AES-256 encryption that demands a ransom in bitcoins to get your files back, and once the installer is executed, it will download or generate several executables in the%APPData% folder and  %TEMP% folder. Each of these files will perform several tasks that include:

  • Sending your information to the Command and Control server
  • Polling for active Regedit or Taskmgr processes and terminating them
  • Ensuring that the lock screen remains visibly located on the top of other active Windows

As soon as CryptoJoker encrypts your data, it will scan all of your drives. This includes mapped network drives on your computer for files with certain extensions. When it finds targeted extensions, it will encrypt the file and change the filename so it has a ‘.crjoker’ extension appended to it. For example, Vacatio.jpg would become Vacation.jpg.crjoker.

While CryptoJoker is encrypting your data, it will also send your information to the Command & Control server located at server6.thcservers.com. This information includes the date, your hostname, username, and machine name.

Currently, there is not a known free method to decrypt files that have been encrypted by CryptoJoker. You must simply keep all of your files backed up and ready to recover, in order to avoid losing access and having to pay the ransom fee.

Contact Pulse Business Solutions at (239) 676-6679 or send us an email at info@pulsebizsolutions.com to find out about our managed IT services. We’ll keep all of your files safe against any type of malware.

Yes! I'm looking for the best IT services to support my business
 
Clients Feedback

After switching to Pulse, we were pleased to know that our IT service bills were consistent and fixed fee each month. This part was huge because finally we could plan and budget for our IT service expenses. We also appreciated the fact that Pulse would dispatch experienced technicians based on the issue at hand resulting in faster resolution of problems that arose. One of the most valuable parts of working with Pulse is that I know there will be a quick and appropriate resolution to any issue that we experience. This process gives me peace of mind because like most small businesses, we need quick and efficient responses to any and every system issue we may face. Pulse’s consistency and dependability in service is unparalleled to providers we’ve had in the past.

Consistent and Dependable
-Non-Profit Organization
Fort Myers, FL
read more»