vxCrypter Is the First Ransomware to Delete Duplicate Files

Our friend Larry Abrams at bleepingcomputer wrote: "The vxCrypter Ransomware could be the first ransomware infection that not only encrypts a victim's data, but also tidies up their computer by deleting duplicate files.

Last week I discovered a new ransomware called vxCrypter that was currently in development. It is a .NET ransomware and is based on an older ransomware that was never finished called vxLock.

When I first tested the ransomware, I noticed that it had deleted every file in a folder except for one, which is illustrated in the images below. As I knew this ransomware was still being developed, I assumed it was just a bug in the encryption routine.

During the weekend, Michael Gillespie told me that this deletion of files was intentional as the ransomware was deleting duplicate files. Furthermore, this was the first ransomware that Gillespie or I have seen that performed this behavior.

When analyzing the ransomware, Gillespie noticed that the ransomware was keeping tracking of the SHA256 hashes of each file it encrypted. As the ransomware encrypted other files, if it encountered the same SHA256 hash, it would delete the file instead of decrypting it.

It is not known why the ransomware is doing this other than as a possible way to increase the speed of encrypting a computer. It also illustrates how we have to stay alert as attackers continue to evolve malware to increase performance, cause havoc, or just do things for no obvious reason. Full story and more tech detail at:

https://www.bleepingcomputer.com/news/security/vxcrypter-is-the-first-ransomware-to-delete-duplicate-files/

Get Your Ransomware Hostage Rescue Manual

This 20-page manual is packed with actionable info that you need to prevent infections, and what to do when you are hit with malware like this. You also get a Ransomware Attack Response Checklist and Prevention Checklist. You will learn more about: