C22-M1p61
False Positive:
f
Variants:
1
Year:
2022
Description
This strike simulates the download and initial infection of the 'CryptoLocker Ransomware Dec 2022 Campaign - Malware File Transfer' malware via a file transfer. The CryptoLocker Ransomware has been around since 2013, and has recently been seen in the wild. Once the host has been infected, the malware ensures it will persist upon a reboot, and then attempts to send encrypted phone-home HTTP GET requests to the attacker controlled Command and Control Servers. This communication will retrieve the RSA public key which will then be used throughout the encryption process to encrypt all of the files on the victim's machine.
References
https://www.secureworks.com/research/cryptolocker-ransomware