VCrypt Ransomware Sample Download

VCrypt Ransomware encrypt user data using 7Zip, a legitimate file encryption program, and then delete the original folder. Apparently it is target toward French speaking victims. When the malicious program unpack itself and execute it extract command line version of 7zip, 7za.exe and a script that instruct 7zip executable to find folders and 7zip them with a hard coded password and then delete the original folder. This then repeated for every drive. .vxcrypt extension is added to the archived file. The hard coded password is "Oezfdse6f5esf413s5fd4e6fSQ45R424EDDEZS". A user can get its file back by simply providing this password on extraction. Once the execution is ends it open Internet Explorer and display a ransom note with all the information to the victim.

VCrypt Ransom Note

VCrypt Ransomware Signatures

Family: Ransom:Win32/VCrypt!MTB
MD5: d32ff14c37b0b7e6c554ce3de5a85454
SHA256: e9056b5596854e3473033e3b28577c83a70f1b5be20e4b1cf529688ad7591b70

VCrypt Ransomware Download

		Royal Ransomware Royal is the new ransomware threat actor that do it dirty work silent...
		BianLian Ransomware BianLian Ransomware is written in Go language. It uses double extracti...
		Moisha Ransomware Moisha Ransomware is a .Net-based ransomware by a threat actor PT_Mois...
		PLAY Ransomware Play Ransomware is active for a while, but it come under lime light w...
		BlueSky Ransomware BlueSky ransomware is an emerging malware it encrypts user data using ...
		Lilith Ransomware Lilith Ransomware is yet another ransomware that does double-extortion...
		AstraLocker 2.0 Ransomware AstraLocker 2.0 is closely related to Babuk Ransomware. It encrypts u...
		DarkAngels Ransomware DarkAngels Ransomware is yet another derivative of Babuk Ransomware. I...

VCrypt Ransomware Sample Download

VCrypt Ransomware Signatures

VCrypt Ransomware Download

Related Posts