BitCryptor ransomware in the wild from the same creators as CoinVault

Introducing BitCryptor, another new encrypting ransomware from the creators of CoinVault. BitCryptor is essentially the same exact infection as CoinVault other than a user interface change. This ransomware encrypts your files using AES 256 encryption and demands 1 bitcoin in order to decrypt your files. At this time there is no way to decrypt your files for free. Unfortunately, the Kaspersky site for CoinVault keys will not work with this infection.

 

When BitCryptor is first started it will delete all shadow volume copies on the computer so that you are unable to restore your files from them. It will then set the Windows wallpaper to %Temp%\wallpaper.jpg and begin encrypting your files. When BitCryptor encrypts your files it will do so using certain rules. These are:

• BitCryptor will not encrypt any files found in the program files,appdata,programdata,boot,windows,winnt,recycle.bin,downloads,all users, or temp folders.
• It will encrypt all files regardless of the extension if the folder contains the pictures or backup strings.
• Otherwise it will encrypt any files that match the following extensions: .odt,.ods,.odp,.odm,.odc,.odb,.doc,.docx,.docm,.wps,.xls,.xlsx,.xlsm,.xlsb,.xlk,.ppt,.pptx,.pptm,.mdb,.accdb,.pst,.dwg,.dxf,.dxg,.wpd,.rtf,.wb2,.mdf,.dbf,.psd,.pdd,.pdf,.eps,.ai,.indd,.cdr,.dng,.3fr,.arw,.srf,.sr2,.mp3,.bay,.crw,.cr2,.dcr,.kdc,.erf,.mef,.mrw,.nef,.nrw,.orf,.raf,.raw,.rwl,.rw2,.r3d,.ptx,.pef,.srw,.x3f,.der,.cer,.crt,.pem,.pfx,.p12,.p7b,.p7c,.jpg,.png,.jfif,.jpeg,.gif,.bmp,.exif,.txt,.tc,.mov,.mp4,.rar,.zip,.iso,.vsdx,.3ds, and .c4d

Furthermore, while Bitcryptor is running it will terminate any process that contains the following keywords:
 

shadow,cmd,processhacker,mbam,sh4,spyhunter,msconfig,taskmgr,roguekiller,rstrui,regedit,procexp

As always we suggest you practice good computer safety to protect your computer from being infected with this ransomware. This means only open attachments that you are expecting and make sure you keep all your programs and Windows updated.

We also suggest a behavior detection program such as CryptoMonitor and HitmanPro: Alert. CryptoMonitor was able to prevent this infection without any updates and I am sure HitmanPro: Alert will be able to do soon, if not already.

If any new information is released on this ransomware, we will be sure to post about it here.


Known BitCryptor Files:

%Temp%\BitCryptorFileList.txt
%Temp%\wallpaper.jpg
%UserProfile%\filelist.locklst
%UserProfile%\sfile

Known BitCryptor Ransomware Registry keys:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\BitC	"%UserProfile%\bclock.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\*BitC	"%UserProfile%\bclock.exe"
HKCU\Control Panel\Desktop\Wallpaper	"%Temp%\wallpaper.jpg"

It's the second thread today about a new Cryptoware. This is getting really out of hands.

It's the second thread today about a new Cryptoware. This is getting really out of hands.

 

The worst part is these were the notable ones, for each of these there are a dozen more.

This is starting to get bad. The more money people pay up to these hackers, the more it will encourage them to make more and more forms of ransomware. But some people need these files and the only way to get them back is to pay up and as aura said this is getting really out of hands

Will probably take until AES flaws (if any) are well known before this type of ransomware stops becoming profitable :\

Grinler....

The links in this sentence...We also suggest a behavior detection program such as CryptoMonitor and HitmanPro: Alert. when clicked return to this topic page.

Sorry..fixed

Looks like it also tries to prevent the user from removing it by killing commonly used tools for removal.

I like the fact that it wants to kill that scam:

spyhunter

ok I did pay to get my files back, and I did, it will create 2 file after you pay ..the first is a text file with the decryption key and instructions, the second is a .rar file with a decrition tool just in case some file didnt decripted.

ok I did pay to get my files back, and I did, it will create 2 file after you pay ..the first is a text file with the decryption key and instructions, the second is a .rar file with a decrition tool just in case some file didnt decripted.

The backup decryptor looks like this, correct?

yes

A better option than paid is to launch a kickstarter to hire a private detective to accommodate this bleep and pay a henchman to stick him a bullet in the neck

correct me if I'm wrong, but couldn't you just get the bitcrypt decrypter (the .rar one) from someone who paid and use it on you're computer?

edit: never mind just looked at the phto properly, turns out you need a key...

Edited by awesomecooldude101, 14 May 2015 - 03:20 AM.

edit: never mind just looked at the phto properly, turns out you need a key...

You need a private key for pretty much every Cryptoware. Hence why someone can't just pay the ransom once and give the decrypter to everyone else. Sure, you now have the a decrypting utility for your files, but without the private key used for their encryption, it's useless.