The infamous CryptoWall ransomware family is back, encrypting files under the false pretenses of testing AV solutions for their’ “suitability” to protect data.
“CryptoWall Project is not malicious and is not intended to harm a person and his/her information data. The project is conducted for the sole purpose of instruction in the field of information security, as well as certification of antivirus products for their suitability for data protection. Together we make the Internet a better and safer place.”
This time, users are requested to pay $700 worth of Bitcoins (1.83 BTC). CryptoWall, active since April 2014 under three known versions, has inflicted more than $1 million in losses every month, according to federal reports.
Bitdefender malware researchers analyzed a sample of the fresh strain of malware and saw clear differences between CryptoWall 4.0 and its predecessors.
In terms of propagation, CryptoWall seems to employ the same e-mail distribution methods as before, via infected emails.
Fig 1. CryptoWall-infected spam email