CryptoManiac Ransomware
The CryptoManiac Ransomware is an encryption ransomware Trojan. These threats are used to take the victims' files hostage, demanding a ransom payment so that they can get a decryption key necessary to restore the affected files. The CryptoManiac Ransomware carries out a typical version of this attack, with the addition of threats to delete 25 files every 60 minutes until the ransom is paid.
Some Particularities of the CryptoManiac Ransomware Infection
The CryptoManiac Ransomware uses the AES encryption to make the victim's files inaccessible. The CryptoManiac Ransomware will then demand 500 USD to be paid in Bitcoin in exchange for the decryption key necessary to access the infected files. The CryptoManiac Ransomware targets the user-generated files, which may include the following:
.3dm, .3g2, .3gp, .7zip, .aaf, .accdb, .aep, .aepx, .aet, .ai, .aif, .as, .as3, .asf, .asp, .asx, .avi, .bmp, .c, .class, .cpp, .cs, .csv, .dat, .db, .dbf, .doc, .docb, .docm, .docx, .dot, .dotm, .dotx, .dwg, .dxf, .efx, .eps, .fla, .flv, .gif, .h, .idml, .iff, .indb, .indd, .indl, .indt, .inx, .jar, .java, .jpeg, .jpg, .js, .m3u, .m3u8, .m4u, .max, .mdb, .mid, .mkv, .mov, .mp3, .mp4, .mpa, .mpeg, .mpg, .msg, .pdb, .pdf, .php, .plb, .pmd, .png, .pot, .potm, .potx, .ppam, .ppj, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prel, .prproj, .ps, .psd, .py, .ra, .rar, .raw, .rb, .rtf, .sdf, .sdf, .ses, .sldm, .sldx, .sql, .svg, .swf, .tif, .txt, .vcf, .vob, .wav, .wma, .wmv, .wpd, .wps, .xla, .xlam, .xll, .xlm, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xqx, .xqx, .zip.
The CryptoManiac Ransomware's Ransom Demand and Additional Threats
The CryptoManiac Ransomware delivers a ransom note that continues to threaten the victim by claiming that the CryptoManiac Ransomware will delete 250 files immediately and then 25 files each hour until the ransom is paid. The following is the text of the CryptoManiac Ransomware ransom note:
'CRYPTOMANIAC
All your files have been encrypted by CRYPTOMANIAC!
All your files have been encrypted due to a security problem with your PC.
If you want to restore them, run the REQUEST RECOVERY application that will be automatically downloaded by CRYPTOMANIAC, if it is not automatically downloaded visit this link
***
You have to pay for decryption in Bitcoins.
The price is usually $500 worth of Bitcoin.
After payment you will be mailed the decryption tool that will decrypt all your files.
Free decryption as guarantee before paying you can get it from the REQUEST RECOVERY tool.
The free decryption tool only decrypts 10 files of the following extensions
***
How to obtain Bitcoins.
The easiest way to buy bitcoins is LocalBitcoins site.
You have to register, click 'Buy bitcoins", and select the seller by payment method and price, https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not attempt to use a file recovery software like recuva or windows recovery, as this attempt is useless and futile as CRYPTOMANIAC destroys windows shadow volume making it unrecoverable.
Do not rename encrypted files.
Do not try to decrypt your data using thud party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to ours) or you can become a victim of a scam.
Please note that 250 of your personal files will be permanently deleted when the program resets either by terminating it or by a system reboot and 25 files will be permanently deleted every 60 minutes, so pay fast to reduce amount of files that will be permanently lost
Extra links to download REQUEST RECOVERY tool incase the one above is not available.
***'
However, the CryptoManiac Ransomware is not capable of detecting whether the victim is taking actions against it, and it seems that these deletion threats are empty threats meant to scare the computer users. Unfortunately, though, the encryption used to make the victim's files inaccessible is real, and it is not possible to recuperate the affected files without the decryption key currently. Because of this, the best measure against the CryptoManiac Ransomware, as with most encryption ransomware Trojans, is to use backup copies of the affected files to restore the compromised data.
