AlphaCrypt ransomware is a new type of ransomware that has been detected by security experts. The malware is delivered via the Angler Exploit kit.
Ransomware is among the most popular malware families in the criminal underworld, and recently security firms have discovered numerous variations targeting desktop and mobile platforms.
Recently a new strain of ransomware has been detected by malware experts, although the GUI of the malware is identical to TeslaCrypt which operates similarly to the recently discovered Cryptowall 3.0.
“While this may look similar to TeslaCrypt, it has some improvements such as deleting VSS to ensure it cannot be saved,” according to a blog post published by Webroot.
Like many other ransomware variants, AlphaCrypt demands payment in Bitcoin in order to unlock the data.
Experts at Webroot emphasized that AlphaCrypt ransomware victims are not immediately forced to use the Tor browser installation to complete the payment, instead the malware authors enable them to use URLs that lead to public gates and servers controlled by the crooks.
Security experts have also observed that ransomware creators are "laundering" their Bitcoins quickly as the currency's value declines.
"The instability of this variant is quite high since it creates new instances of common windows processes to make the encryption routine as covert as possible and is extremely similar to how Cryptowall 3.0 works," the researchers state.
Malware researcher Brad Duncan has published an interesting analysis of the Alpha Crypt ransomware, explaining that it is currently being delivered via the popular Angler exploit kit
Experts warn that the low VirusTotal detection rate is linked to the Alpha Crypt ransomware payload and the Flash exploit (5/57 and 2/57, respectively) on VirusTotal) used to distribute it.
