AlphaLocker Ransomware

The AlphaLocker Ransomware is an encryption ransomware Trojan that is used by con artists to collect money from computer users. The AlphaLocker Ransomware can be purchased from its author and then used to carry out attacks. The buyer will distribute the AlphaLocker Ransomware using different methods. One feature of the AlphaLocker Ransomware that stands out is that the AlphaLocker Ransomware includes features such as an administration panel and customizable features, which make it easy for con artists to purchase it and start carrying out their own attacks.

The Affordable Price Asked by the Developers of the AlphaLocker Ransomware

The AlphaLocker Ransomware belongs to the Ransomware as a Service industry, or RaaS, which has been on the rise in the last couple of years since it allows con artists to carry out threat attacks that can be monetized quickly. PC security analysts first spotted the AlphaLocker Ransomware in March of 2016. It seems that the AlphaLocker Ransomware follows a trend that has been observed in recent ransomware threats, where the cost of purchasing this threat has decreased substantially from hundreds or thousands of dollars to approximately $65 USD. The payment of the AlphaLocker Ransomware is carried out through BitCoins. When the fraudsters pay this amount, they receive the AlphaLocker Ransomware executable file, its master decryptor binary, which is based on Hidden Tear, and an administrative panel. The purchaser can then buy hosting, distribution and other services. The danger of this low-price point is that it allows anyone to distribute and profit from threats virtually.

How the AlphaLocker Ransomware Works

The entire configuration and support files associated with the AlphaLocker Ransomware are in English, even though it seems that its origin is Russian. The AlphaLocker Ransomware attack is straightforward and typical of these threats. The AlphaLocker Ransomware encrypts files with their own unique encryption key, AES. These keys are RSA-encrypted. Essentially, the AlphaLocker Ransomware receives information from its Command and Control server containing a unique identifier for the victim. The Command and Control server creates the public key and a private key, storing the private key and sending the public key to the AlphaLocker Ransomware. This key is then used to encrypt the victim's files. The encryption key will be inaccessible since it is not stored on the victim's computer. The following files will be encrypted on all drives of the infected computer:

.asf, .pdf, .xls, .docx, .xlsx, .mp3, .waw, .jpg, .jpeg, .txt, .rtf, .doc, .rar, .zip, .psd, .tif, .wma, .gif, .bmp, .ppt, .pptx, .docm, .xlsm, .pps, .ppsx, .ppd, .eps, .png, .ace, .djvu, .tar, .cdr, .max, .wmv, .avi, .wav, .mp4, .pdd, .php, .aac, .ac3, .amf, .amr, .dwg, .dxf, .accdb, .mod, .tax2013, .tax2014, .oga, .ogg, .pbf, .ra, .raw, .saf, .val, .wave, .wow, .wpk, .3g2, .3gp, .3gp2, .3mm, .amx, .avs, .bik, .dir, .divx, .dvx, .evo, .flv, .qtq, .tch, .rts, .rum, .rv, .scn, .srt, .stx, .svi, .swf, .trp, .vdo, .wm, .wmd, .wmmp, .wmx, .wvx, .xvid, .3d, .3d4, .3df8, .pbs, .adi, .ais, .amu, .arr, .bmc, .bmf, .cag, .cam, .dng, .ink, .jif, .jiff, .jpc, .jpf, .jpw, .mag, .mic, .mip, .msp, .nav, .ncd, .odc, .odi, .opf, .qif, .xwd, .abw, .act, .adt, .aim, .ans, .asc, .ase, .bdp, .bdr, .bib, .boc, .crd, .diz, .dot, .dotm, .dotx, .dvi, .dxe, .mlx, .err, .euc, .faq, .fdr, .fds, .gthr, .idx, .kwd, .lp2, .ltr, .man, .mbox, .msg, .nfo, .now, .odm, .oft, .pwi, .rng, .rtx, .run, .ssa, .text, .unx, .wbk, .wsh, .7z, .arc, .ari, .arj, .car, .cbr, .cbz, .gz, .gzig, .jgz, .pak, .pcv, .puz, .rev, .sdn, .sen, .sfs, .sfx, .sh, .shar, .shr, .sqx, .tbz2, .tg, .tlz, .vsi, .wad, .war, .xpi, .z02, .z04, .zap, .zipx, .zoo, .ipa, .isu, .jar, .js, .udf, .adr, .ap, .aro, .asa, .ascx, .ashx, .asmx, .asp, .indd, .asr, .qbb, .bml, .cer, .cms, .crt, .dap, .htm, .moz, .svr, .url, .wdgt, .abk, .bic, .big, .blp, .bsp, .cgf, .chk, .col, .cty, .dem, .elf, .ff, .gam, .grf, .h3m, .h4r, .iwd, .ldb, .lgp, .lvl, .map, .md3, .mdl, .nds, .pbp, .ppf, .pwf, .pxp, .sad, .sav, .scm, .scx, .sdt, .spr, .sud, .uax, .umx, .unr, .uop, .usa, .usx, .ut2, .ut3, .utc, .utx, .uvx, .uxx, .vmf, .vtf, .w3g, .w3x, .wtd, .wtf, .ccd, .cd, .cso, .disk, .dmg, .dvd, .fcd, .flp, .img, .isz, .mdf, .mds, .nrg, .nri, .vcd, .vhd, .snp, .bkf, .ade, .adpb, .dic, .cch, .ctt, .dal, .ddc, .ddcx, .dex, .dif, .dii, .itdb, .itl, .kmz, .lcd, .lcf, .mbx, .mdn, .odf, .odp, .ods, .pab, .pkb, .pkh, .pot, .potx, .pptm, .psa, .qdf, .qel, .rgn, .rrt, .rsw, .rte, .sdb, .sdc, .sds, .sql, .stt, .tcx, .thmx, .txd, .txf, .upoi, .vmt, .wks, .wmdb, .xl, .xlc, .xlr, .xlsb, .xltx, .ltm, .xlwx, .mcd, .cap, .cc, .cod, .cp, .cpp, .cs, .csi, .dcp, .dcu, .dev, .dob, .dox, .dpk, .dpl, .dpr, .dsk, .dsp, .eql, .ex, .f90, .fla, .for, .fpp, .jav, .java, .lbi, .owl, .pl, .plc, .pli, .pm, .res, .rsrc, .so, .swd, .tpu, .tpx, .tu, .tur, .vc, .yab, .aip, .amxx, .ape, .api, .mxp, .oxt, .qpx, .qtr, .xla, .xlam, .xll, .xlv, .xpt, .cfg, .cwf, .dbb, .slt, .bp2, .bp3, .bpl, .clr, .dbx, .jc, .potm, .ppsm, .prc, .prt, .shw, .std, .ver, .wpl, .xlm, .yps, .1cd, .bck, .html, .bak, .odt, .pst, .log, .mpg, .mpeg, .odb, .wps, .xlk, .mdb, .dxg, .wpd, .wb2, .dbf, .ai, .3fr, .arw, .srf, .sr2, .bay, .crw, .cr2, .dcr, .kdc, .erf, .mef, .mrw, .nef, .nrw, .orf, .raf, .rwl, .rw2, .r3d, .ptx, .pef, .srw, .x3f, .der, .pem, .pfx, .p12, .p7b, .p7c, .jfif, .exif.

The availability of advanced threats like the AlphaLocker Ransomware to the public makes it very important that computer users take preventive measures to avoid becoming victims of these attacks. Computer users should protect their machines with reliable anti-malware software that is fully up-to-date and to keep a backup of all files on an external memory device.