Ransomware
AlphaLocker
A new form of ransomware named AlphaLocker that is built by cybercriminals for cybercriminals.
AlphaLocker is a Windows ransomware.
Background
AlphaLocker is a ransomware family created by criminals for use by other criminals. Following the Ransomware-as-a-Service (RaaS) model, the program can be bought and deployed by virtually anyone wanting to enter the ransomware trade. It stands out from comparable RaaS offerings by being inexpensive, available for as little as $65 in bitcoin.
Also referred to as Alpha Ransomware, AlphaLocker derives from EDA2, an educational project that Turkish researcher Utku Sen open-sourced on GitHub. A Russian coder appears to have cloned the repository before its removal and used it to produce an almost identical copy of EDA2. The author reportedly invests considerable effort in adding new features so the malware stays ahead of antivirus engines and avoids detection.
Encryption begins once the ransomware reaches out to its C&C server, which uses the RSA-2048 algorithm to create a public/private key pair, delivering the public key to the victim while retaining the private key. On the infected host, the malware generates an AES-256 key for each encrypted file, encrypts that key with the RSA public key, and transmits it to the C&C server.
Recovering files requires obtaining the private RSA key needed to decrypt the AES-encrypted data. Victims must pay roughly 0.35 Bitcoin (about $450) to receive this key, bundled into a decrypter tool.
Source: Malpedia (Fraunhofer FKIE).