CryptoWall’s encrypter is back in CryptoWall 5.1 variant and it is used in a ransomware virus which pretends to be Cryptolocker. The virus uses the .locked file extension which it ads after encrypting the files of the infected computer with an immensely strong AES-256 encryption algorithm and asks from users to pay 250 Euros to get them back. CryptoWall has been through many changes and many consider it to be the virus causing most damage in comparison to all ransomware viruses. If its encryptor is back this is a strong indicator that the CryptoWall gang may be back in business. Everyone who has been infected by CryptoWall 5.1 should immediately take actions for removing the virus and trying to restore the .locked files using alternative solutions to gain back access to their files like the ones in this article.
Threat Summary
| Name | CryptoWall 5.1 |
| Type | Ransomware Trojan |
| Short Description | CryptoWall 5.1 encrypts files with a strong AES-256 cipher asking 250 Euros for decryption. |
| Symptoms | Files are encrypted with the .locked file extension and become inaccessible. A ransom note with instructions for paying the ransom may shows on the screen. |
| Distribution Method | Spam Emails, Email Attachments, File Sharing Networks. |
| Detection Tool |
See If Your System Has Been Affected by malware
Download
Malware Removal Tool
|
| User Experience | Join our forum to Discuss CryptoWall 5.1 Ransomware. |
| Data Recovery Tool | Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive. |
CryptoWall 5.1 Ransomware – How Does It Infect
The cyber-criminal gang behind CryptoWall 5.1 may use different spam techniques with the one and only purpose of tricking users to into opening its malicious URLs or executables containing its payload.
Just like CryptoWall 4.0 Ransomware and CryptoWall 3.0, it may employ several methods that may result in successful cyber-attack on the unsuspecting user:
The most widely employed method is via spam e-mail. And this is not just small spam campaigns. CryptoWall has always been associated with massive spam, like the famous Fake Windows 10 Free Upgrade Spam, which appeared last year. It looks like a message appearing to be sent from Microsoft Corporation. Users have reported tat such e-mails may be associated with fraudulent URLs or malicious files containing JavaScript or Exploit Kits embedded in .ZIP e-mail attachments.
Another form of attacks by CryptoWall 5.1 may be associated with phishing e-mails, however such attacks are more likely to be present when a user or an organization is targeted by a hacking syndicate. Since most enterprise organizations usually have local networks configured securely by their system and network administrators, hackers may get information about the organization and then send a spam message that appears to be coming from the e-mail from someone important In the organization, like the CTO, CFO or CEO, saying something like “Important! I need you to read thoroughly and reply!”
There is also the chance that the user is being redirected via a malicious URL, which is posted in e-mail bodies, on social media and other communication platforms. Ad-supported PUPs(Potentially Unwanted Programs) may also cause direct browser redirects which may infect the user’s computer and cause immense damage not only by CryptoWall 5.1 but other malware as well.
CryptoWall 5.1 Ransomware In Detail
After CryptoWall 5.1’s payload has been dropped on your computer, the virus might immediately begin changing its settings. First, it may create one or more files in the following Windows folders:
- %Roaming%
- %AppData%
- %Temp%
- %User’s Profile%
- %Windows%
- %Local%
- %LocalRow%
After creating its malicious files, CryptoWall 5.1 may also modify different registry keys, like the Run and RunOnce keys which enable it to start when Windows boots up:
→ HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
Before It starts the encryption process, CryptoWall’s 5.1 version may carefully scan for specific file extensions of widely used files, like videos, music, photos, databases and others:
→.3dm, .3ds, .3fr, .mcmeta, .vfs0, .mpqge, .kdb, .db0, .dba, .rofl, .hkx, .bar, .upk, .das, .iwi, .litemod, .asset, .forge, .ltx, .bsa, .apk, .re4, .sav, .lbf, .slm, .bik, .epk, .rgss3a, .pak, .big, wallet, .wotreplay, .xxx, .desc, .py, .m3u, .flv, .js, .css, .rb, .png, .jpeg, .txt, .p7c, .p7b, .p12, .pfx, .pem, .crt, .cer, .der, .x3f, .srw, .pef, .ptx, .r3d, .rw2, .rwl, .raw, .raf, .orf, .nrw, .mrwref, .mef, .erf, .kdc, .dcr, .cr2, .crw, .bay, .sr2, .srf, .arw, .3fr, .dng, .3g2, .3gp, .3pr, .7z, .ab4, .accdb, .sql, .mp4, .7z, .rar, .m4a, .wma, .avi, .wmv, .csv, .d3dbsp, .zip, .sie, .sum, .ibank, .t13, .t12, .qdf, .gdb, .tax, .pkpass, .bc6, .bc7, .bkp, .qic, .bkf, .sidn, .sidd, .mddata, .itl, .itdb, .icxs, .hvpl, .hplg, .hkdb, .mdbackup, .syncdb, .gho, .cas, .svg, .map, .wmo, .itm, .sb, .fos, .mov, .vdf, .ztmp, .sis, .sid, .ncf, .menu, .layout, .dmp, .blob, .esm, .vcf, .vtf, .dazip, .fpk, .mlx, .kf, .iwd, .vpk, .tor, .psk, .rim, .w3x, .fsh, .ntl, .arch00, .lvl, .snx, .cfr, .ff, .vpp_pc, .lrf, .m2, .jpe, .jpg, .cdr, .indd, .ai, .eps, .pdf, .pdd, .psd, .dbf, .mdf, .wb2, .rtf, .wpd, .dxg, .xf, .dwg, .pst, .accdb, .mdb, .pptm, .pptx, .ppt, .xlk, .xlsb, .xlsm, .xlsx, .xls, .wps, .docm, .docx, .doc, .odb, .odc, .odm, .odp, .ods, .odt, .accde, .accdr, .accdt, .ach, .acr, .act, .adb
For the encryption process, CryptoWall 5.1 uses a very strong AES cipher has been employed with a strength of 256 bits. In addition to this, CryptoWall 5.1 additionally adds unique identification to the infected user. The encoded files are appended the .locked file extension, for example:
After encryption, the files cannot be opened with any program. The only 100 percent working direct solution appears to be either paying the cyber-criminals for a unique decryption technique like purchasing a key and a decryptor made by them.
To communicate with Infected users, CryptoWall 5.1 may lock the screen of the infected computer and use a custom made ransom message which it displays on the Desktop in different languages. One of those languages is Italian, which means the virus targets Italian users. The message is written in Italian and is the following:
Cryptolocker è un malware appartenente alla famiglia dei ransomware.
Questo virus è in grado di criptare con algoritmi asimmetrici i file della vittima.
Wikipedia: https://it.wikipedia.org/wiki/CryptoLocker
Come faccio a ripristinare i miei documenti?
I tuoi documenti, foto, dati e altri file importanti (compresi usb, hard disk, percorsi di rete etc. ) sono stati criptati con un algoritmo asimmetrico a due chiavi, pubblica e privata.
Tutti i file sopra citati che hanno l’estensione .locked sono stati bloccati, per sbloccarli hai bisogno della chiave privata.
Come ottengo la chiave privata?
Mentre la chiave pubblica и stata salvata in una directory di sistema del tuo computer, quella privata и stata inviata sul nostro server, per ottenerla devi pagare la cifra di 250 €.
Appena l’importo sarà accreditato tramite uno dei metodi di pagamento riceverai tramite mail la chiave privata e potrai cosм riavere accesso ai tuoi dati
In caso contrario al termine delle 48h previste per il pagamento del riscatto la chiave privata verrà eliminata e non sarà più possibile recuperare i file.
ATTENZIONE: La rimozione di Cryptolocker non ripristina l’accesso ai file cittografati.
Contaсt: cryptowall51@sigaint.org” Source: Infected User
Your computer is infected with cryptolocker
Cryptolocker is a malware belonging to the family of Ransomware.
This virus can encrypt the victim’s files with asymmetric algorithms
Wikipedia: https://it.wikipedia.org/wiki/CryptoLocker
How do I restore my files?
Your documents, photos, data and other important files (including USB, hard drives, network locations, etc.) have been encrypted with an asymmetric algorithm to two keys, public and private.
All files mentioned above having the .locked extension have been blocked; you need to unlock the private key.
How do I get the private key?
While the public key и been saved in a directory of your computer system, the private и been sent to our server, to get it you have to pay the amount of 250 €.
As soon as the amount is credited with one of the payment methods, you will receive by mail the private key, and regain access to your data.
Otherwise, at the end of 48h provided for the payment of the ransom, the private key will be deleted and it will no longer be possible to recover files.
CAUTION: Removing cryptolocker will not restore access to encrypted files.
Contaсt: cryptowall51@sigaint.org
The virus saves a public key on the user’s computer, most likely in a .KEY file and the private key it may send to the malicious server of the cyber-criminals behind CryptoWall 5.1. To gain access, it gives a deadline of 48 hours after which the cyber-criminals threaten to delete the private key.
CryptoWall 5.1 – Conclusion, Removal, and File Restoration
Malware analysts recommend not to pay any ransom to cyber-crooks because you support their cyber-criminal organization and malicious activities. In addition to that, it is no guarantee that these cyber-terrorists will give access to your files. However, you may want to contact the e-mail address cryptowall51@ sigaint.org to ask for the free decryption of one file which you may later use to attempt and factorize other keys which may decrypt the rest of the data. We have provided in step “3. Restore files encrypted by CryptoWall 5.1” alternative methods and decryptors which may assist you in the decryption process of the file encoded by CryptoWall 5.1.
But before attempting any decryption, backups or file restoration methods, we strongly advise you to remove it using an advanced anti-malware program. You can follow the tutorial below, since it is designed for maximum effectiveness and remove the virus automatically and swiftly. This will help detect all of its files, instead of costing you time to find them manually and increasing the risk of you losing your files. Furthermore, it is recommended to have an advanced anti-malware software since it also features a real-time shield protecting you from devastating threats like CryptoWall 5.1 in the future as well.
Researchers also believe that this ransomware has been created based on the HiddenTear open source project which has been the root cause for other ransomware viruses, like Strictor and Sanction ransomwares. Decryptor is expected to be released eventually and we urge you to keep an eye on this article and we will update it as soon as this is done. In the meantime you may try the methods in this article to attempt file restoration.
Ventsislav Krastev
Ventsislav is a cybersecurity expert at SensorsTechForum since 2015. He has been researching, covering, helping victims with the latest malware infections plus testing and reviewing software and the newest tech developments. Having graduated Marketing as well, Ventsislav also has passion for learning new shifts and innovations in cybersecurity that become game changers. After studying Value Chain Management, Network Administration and Computer Administration of System Applications, he found his true calling within the cybersecrurity industry and is a strong believer in the education of every user towards online safety and security.
Follow Me:
- Step 1
- Step 2
- Step 3
- Step 4
- Step 5
Step 1: Scan for CryptoWall 5.1 with SpyHunter Anti-Malware Tool
Ransomware Automatic Removal - Video Guide
Step 2: Uninstall CryptoWall 5.1 and related malware from Windows
Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it. To do that:
Follow the instructions above and you will successfully delete most unwanted and malicious programs.
Step 3: Clean any registries, created by CryptoWall 5.1 on your computer.
The usually targeted registries of Windows machines are the following:
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
You can access them by opening the Windows registry editor and deleting any values, created by CryptoWall 5.1 there. This can happen by following the steps underneath:
Tip: To find a virus-created value, you can right-click on it and click "Modify" to see which file it is set to run. If this is the virus file location, remove the value.
Before starting "Step 4", please boot back into Normal mode, in case you are currently in Safe Mode.
This will enable you to install and use SpyHunter 5 successfully.
Step 4: Boot Your PC In Safe Mode to isolate and remove CryptoWall 5.1
Step 5: Try to Restore Files Encrypted by CryptoWall 5.1.
Method 1: Use STOP Decrypter by Emsisoft.
Not all variants of this ransomware can be decrypted for free, but we have added the decryptor used by researchers that is often updated with the variants which become eventually decrypted. You can try and decrypt your files using the instructions below, but if they do not work, then unfortunately your variant of the ransomware virus is not decryptable.
Follow the instructions below to use the Emsisoft decrypter and decrypt your files for free. You can download the Emsisoft decryption tool linked here and then follow the steps provided below:
1 Right-click on the decrypter and click on Run as Administrator as shown below:
2. Agree with the license terms:
3. Click on "Add Folder" and then add the folders where you want files decrypted as shown underneath:
4. Click on "Decrypt" and wait for your files to be decoded.
Note: Credit for the decryptor goes to Emsisoft researchers who have made the breakthrough with this virus.
Method 2: Use data recovery software
Ransomware infections and CryptoWall 5.1 aim to encrypt your files using an encryption algorithm which may be very difficult to decrypt. This is why we have suggested a data recovery method that may help you go around direct decryption and try to restore your files. Bear in mind that this method may not be 100% effective but may also help you a little or a lot in different situations.
Simply click on the link and on the website menus on the top, choose Data Recovery - Data Recovery Wizard for Windows or Mac (depending on your OS), and then download and run the tool.
CryptoWall 5.1-FAQ
What is CryptoWall 5.1 Ransomware?
CryptoWall 5.1 is a ransomware infection - the malicious software that enters your computer silently and blocks either access to the computer itself or encrypt your files.
Many ransomware viruses use sophisticated encryption algorithms to make your files inaccessible. The goal of ransomware infections is to demand that you pay a ransom payment to get access to your files back.
What Does CryptoWall 5.1 Ransomware Do?
Ransomware in general is a malicious software that is designed to block access to your computer or files until a ransom is paid.
Ransomware viruses can also damage your system, corrupt data and delete files, resulting in the permanent loss of important files.
How Does CryptoWall 5.1 Infect?
Via several ways.CryptoWall 5.1 Ransomware infects computers by being sent via phishing emails, containing virus attachment. This attachment is usually masked as an important document, like an invoice, bank document or even a plane ticket and it looks very convincing to users.
Another way you may become a victim of CryptoWall 5.1 is if you download a fake installer, crack or patch from a low reputation website or if you click on a virus link. Many users report getting a ransomware infection by downloading torrents.
How to Open .CryptoWall 5.1 files?
You can't without a decryptor. At this point, the .CryptoWall 5.1 files are encrypted. You can only open them once they are decrypted using a specific decryption key for the particular algorithm.
What to Do If a Decryptor Does Not Work?
Do not panic, and backup the files. If a decryptor did not decrypt your .CryptoWall 5.1 files successfully, then do not despair, because this virus is still new.
Can I Restore ".CryptoWall 5.1" Files?
Yes, sometimes files can be restored. We have suggested several file recovery methods that could work if you want to restore .CryptoWall 5.1 files.
These methods are in no way 100% guaranteed that you will be able to get your files back. But if you have a backup, your chances of success are much greater.
How To Get Rid of CryptoWall 5.1 Virus?
The safest way and the most efficient one for the removal of this ransomware infection is the use a professional anti-malware program.
It will scan for and locate CryptoWall 5.1 ransomware and then remove it without causing any additional harm to your important .CryptoWall 5.1 files.
Can I Report Ransomware to Authorities?
In case your computer got infected with a ransomware infection, you can report it to the local Police departments. It can help authorities worldwide track and determine the perpetrators behind the virus that has infected your computer.
Below, we have prepared a list with government websites, where you can file a report in case you are a victim of a cybercrime:
Cyber-security authorities, responsible for handling ransomware attack reports in different regions all over the world:
Germany - Offizielles Portal der deutschen Polizei
United States - IC3 Internet Crime Complaint Centre
United Kingdom - Action Fraud Police
France - Ministère de l'Intérieur
Italy - Polizia Di Stato
Spain - Policía Nacional
Netherlands - Politie
Poland - Policja
Portugal - Polícia Judiciária
Greece - Cyber Crime Unit (Hellenic Police)
India - Mumbai Police - CyberCrime Investigation Cell
Australia - Australian High Tech Crime Center
Reports may be responded to in different timeframes, depending on your local authorities.
Can You Stop Ransomware from Encrypting Your Files?
Yes, you can prevent ransomware. The best way to do this is to ensure your computer system is updated with the latest security patches, use a reputable anti-malware program and firewall, backup your important files frequently, and avoid clicking on malicious links or downloading unknown files.
Can CryptoWall 5.1 Ransomware Steal Your Data?
Yes, in most cases ransomware will steal your information. It is a form of malware that steals data from a user's computer, encrypts it, and then demands a ransom in order to decrypt it.
In many cases, the malware authors or attackers will threaten to delete the data or publish it online unless the ransom is paid.
Can Ransomware Infect WiFi?
Yes, ransomware can infect WiFi networks, as malicious actors can use it to gain control of the network, steal confidential data, and lock out users. If a ransomware attack is successful, it could lead to a loss of service and/or data, and in some cases, financial losses.
Should I Pay Ransomware?
No, you should not pay ransomware extortionists. Paying them only encourages criminals and does not guarantee that the files or data will be restored. The better approach is to have a secure backup of important data and be vigilant about security in the first place.
What Happens If I Don't Pay Ransom?
If you don't pay the ransom, the hackers may still have access to your computer, data, or files and may continue to threaten to expose or delete them, or even use them to commit cybercrimes. In some cases, they may even continue to demand additional ransom payments.
Can a Ransomware Attack Be Detected?
Yes, ransomware can be detected. Anti-malware software and other advanced security tools can detect ransomware and alert the user when it is present on a machine.
It is important to stay up-to-date on the latest security measures and to keep security software updated to ensure ransomware can be detected and prevented.
Do Ransomware Criminals Get Caught?
Yes, ransomware criminals do get caught. Law enforcement agencies, such as the FBI, Interpol and others have been successful in tracking down and prosecuting ransomware criminals in the US and other countries. As ransomware threats continue to increase, so does the enforcement activity.
About the CryptoWall 5.1 Research
The content we publish on SensorsTechForum.com, this CryptoWall 5.1 how-to removal guide included, is the outcome of extensive research, hard work and our team’s devotion to help you remove the specific malware and restore your encrypted files.
How did we conduct the research on this ransomware?
Our research is based on an independent investigation. We are in contact with independent security researchers, and as such, we receive daily updates on the latest malware and ransomware definitions.
Furthermore, the research behind the CryptoWall 5.1 ransomware threat is backed with VirusTotal and the NoMoreRansom project.
To better understand the ransomware threat, please refer to the following articles which provide knowledgeable details.
As a site that has been dedicated to providing free removal instructions for ransomware and malware since 2014, SensorsTechForum’s recommendation is to only pay attention to trustworthy sources.
How to recognize trustworthy sources:
- Always check "About Us" web page.
- Profile of the content creator.
- Make sure that real people are behind the site and not fake names and profiles.
- Verify Facebook, LinkedIn and Twitter personal profiles.