CryptoLocker Copycats Emerge, Demand $150 Ransom

Copycats are now using their own version of the CryptoLocker ransomware scam to steal hundreds of dollars from victims. The new malware is called 'Locker' and demands targets pay $150 USD to reclaim lost files.

Locker was recently discovered by security firm IntelCrawler, which says the new malware is basically the same as CryptoLocker: after an infection takes hold, files are scrambled and only retrieved after a ransom is paid.

So far, Locker infections have been reported in the United States, Holland, Germany, Turkey, and Russia. In the US, people in Washington DC, Texas, and Missouri have said their systems were infected. (Source: theregister.co.uk)

Copycats Demand Less Money -- For Now

IntelCrawler says that, once an infection occurs, files are scrambled. The only information left visible to the target are the contact details for those behind the malware.

Targets are also told that anyone who threatens or harasses the cheeky malware creators will never be given the chance to reclaim their files -- even if they offer to pay up.

There are several critical differences between Locker and CryptoLocker, however.

First, Locker infections usually occur through malicious files placed on compromised websites. Some of the infected files are executables masquerading as MP3s.

CryptoLocker has been spread in a similar way, but so far it appears most of those infections occur through the opening of malicious email attachments.

Second, those behind Locker are currently asking for less money: $150 rather than the several hundred bucks demanded by the CryptoLocker goons.

Copycat Malware Less Durable?

Third, and perhaps most importantly, IntelCrawler says Locker may be easier to defeat than CryptoLocker.

Not much is known about vulnerabilities at the moment, but IntelCrawler says it was able to essentially hack the malware and retrieve universal keys it could use to reclaim the lost files without paying the Locker cybercrooks any money.

"Our researchers are working on the universal decryption software in order to help the victims," noted IntelCrawler's Andrey Komarov. (Source: bbc.co.uk)