SystemCrypter | a latest threat to Digital World

What is SystemCrypter?

SystemCrypter is an encryption ransomware that will lock important files on your PC advises the victim to pay a ransom in BTC. It was first seen troubling the gadgets somewhere around mid-June this year.

It is coded in Python which makes it difficult to decrypt the malware. Though it share its algorithms and structures with the EncryptedServer2018 ransomware still it can’t be said evidently that developers of both the codes are related somehow.

By the moment this malware reaches your system it encrypts your personal files with an extension, ‘.crypted’ and makes it impossible for you to access those files. After your files have been locked by SystemCrypter a message will be displayed on the current screen stating that you have been locked out of your files. In order to remove the encryption it will advise you to pay a ransom of about 0.066 BTC (around $ 600).

Threat Summary

Threat Behavior

After the infiltration of your system by this malware, it continues to find the files that are present in your local hard drive and all other connected storage devices. After its search is complete the malware encrypts the files with help of AES-256 encryption algorithm and encrypts the files with an extension, ‘.crypted’. This extension had been used by many other crypto virus developers in the past.

After this encryption the users will not be able to access their personal data that includes photos, documents, videos, databases and other important files. It then seeds a pop-up window, SystenCrypter v2.40 that displays the reason behind this encryption via a note.

The note finally discloses the motive stating to meet the developers’ demands by paying via BTC. The amount is fixed at 0.066 BTC and has to be paid to the Bitcoin address, 18ixe82TGy3hUwmmvZVU75tCVoRyeNoYvY.

Distribution methods

There are ample of ways in which your system can get infected by the SystemCrypter ransomware:

• Spam mails
• Third-party pirated softwares and their crack versions
• Injected via Web
• Exploit kits
• Untimely and fake updates

Careless users are the targets of the developers of these malwares. Users who do not use antivirus are the ones at risk. There are different malicious attachments that are received with the spam mails or third-party downloads. These attachments start running in the background without the acknowledgment of the user.

Removal Steps:

(A) Reboot using Safe Mode with Networking

To restart the system to Safe Mode with Networking,  if already switched ON then follow the below steps:

(B) Restore your system files and settings

Prevent your PC from the attacks in future

In most of the cases, the users are able to retrieve the files as the encryption module is not that effectively delivered to the PC. Still it is advised to keep a backup stored on hard drives or on cloud servers. Flash drives can also be used for storing backup.

There are some ordinary precautions that one can take in order to protect your system from malicious interventions.

• Windows OS must be updated regularly as it’s easier for the developers to hack older versions of OS.
• Avoid downloading cracked version of software as they may be a prominent source of this devastating act.
• Installing powerful anti-virus software such as Hitman pro and Vipre to keep your system secure.
• No matter how genuine the spam mail seems to appear, the attachments with that mail may infect your system.
• Install a good ad-blocker that will help you to block malicious ads that contain unexpected malwares.

Hits: 96