2

Does CryptoWall 3.0 use some resource on the internet to encrypt my files?

I watched this video on YouTube - in this video a tool is used to sniff network traffic and find information about CryptoWall sending data to ransom server.

The ransom wrote that the private key is with them, so to crypt my files they need to send a hash or the file to them?

If I disconnect from the internet, will it stop the crypto process?

Improve this question
2
  • It's probably too late, but if you want a chance at saving any of your files you need to shut the infected computer down immediately. Then, slave your HDD to another computer and use that to pull off whatever's not encrypted yet.
    – Iszi
    Aug 14, 2015 at 14:20
  • I'm not asking how to decrypt the files. I'm asking if it needs internet connection to keep the process.
    – Guilherme de Jesus Santos
    Aug 14, 2015 at 14:37

1 Answer 1

Reset to default
4

Short answer:

It will need internet connectivity briefly, then it will encrypt everything even if you disconnect.

Long answer

As soon as CryptoWall runs, it will generate a random RSA public and private keys, connect to one or more control servers, and upload the private key along with some information on the system it is, like OS version, public IP and location. Then it can run disconnected.

After generating the keys, the malware will proceed to encrypt every single file it supports. Some variants will keep the original intact during the encryption phase, and delete all original files after encrypting all of them. Some variants will encrypt and delete the original in one pass.

The server will keep the private key for some time, and you have to upload a sample of an encrypted file to them. They will send back the private key you will need to decrypt the files.

You probably have no chance of stopping the encryption process once it started. CryptoWall employs a number of defenses, and if you get caught by it, it's over. The encryption is well made too, so the chances of bruteforcing it is almost zero. Backups will not save you if your backup drive is connected to the PC all the time, as CryptoWall will encrypt your backups too.

Improve this answer
2
  • Do you have a pointer to a good description about the internals of CryptoWall?
    – Neil Smithline
    Aug 14, 2015 at 16:45
  • A quick search for "How CryptoWall works" will give you plenty of pointers. I would do that to answer you.
    – ThoriumBR
    Aug 14, 2015 at 18:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .