In summary, if there is a drive letter on your computer it will be scanned for data files by CTB Locker. When the infection is scanning your computer it will scan all drive letters on your computer including mapped drives, removable drives, and mapped network shares. Once infected the CTB Locker will scan your computer's drives for data files and encrypt them.

It will then create a hidden random named job in Task Schedule that launches the malware executable every time you login.

When you become infected with the CTB Locker infection, the malware will store itself in the %Temp% folder as a random named executable. This ransom amount is equivalent to approximately $120.00 USD. The infection will then open a ransom screen that states that your data was encrypted and prompts you to follow the instructions on the screen to learn how to purchase and pay the ransom of. The current version now adds a random file extension to encrypted files. In the past any file that was encrypted would have its file extension changed to CTB or CTB2. When you are first infected with CTB Locker it will scan your computer for data files and encrypt them so they are no longer accessible. More information on how this malware is being sold can be found in Kafeine's article 'Crypto Ransomware' CTB-Locker (Critroni.A) on the rise. With that said, expect to see other ransomware released using this kit, but possibly with different interfaces. As discovered by Kafeine, this malware also appears to be part of a kit being sold online for $3,000 USD, which includes support in getting it up and running. Just like other file encrypting malware, the media continues to affiliate this infection with CryptoLocker when in fact this appears to have been developed by a different group using new technologies such as elliptical curve cryptography and the malware communicating with the Command and Control server over TOR. Once at the topic, and if you are a member, you can ask or answer questions and subscribe in order to get notifications when someone adds more information to the topic.ĬTB Locker (Curve-Tor-Bitcoin Locker), otherwise known as Critroni, is a file-encrypting ransomware infection that was released in the middle of July 2014 that targets all versions of Windows including Windows XP, Windows Vista, Windows 7, and Windows 8. If you are interested in this infection or wish to ask questions about it, please visit the CTB Locker support topic. Info: There is a CTB Locker support topic, which contains discussion about CTB Locker and the experiences of those infected.

Crypto locker decryption tool