CryptoShield 2.0 Ransomware

By GoldSparrow in Ransomware

Threat Scorecard

Threat Level:	100 % (High)
Infected Computers:	167

First Seen:	February 1, 2017
Last Seen:	February 1, 2023
OS(es) Affected:	Windows

The CryptoShield 2.0 Ransomware is a ransomware Trojan that is used to take advantage of inexperienced computer users. The CryptoShield 2.0 Ransomware is used to force computer users to pay large ransoms to recover their files, which are taken hostage by the CryptoShield 2.0 Ransomware infection. The CryptoShield 2.0 Ransomware presents a substantial threat, and computer users should take steps to protect their machines from threats like the CryptoShield 2.0 Ransomware and steps to limit the damage in case of a the CryptoShield 2.0 Ransomware infection.

Table of Contents

The CryptoShield 2.0 Ransomware can Cause Irreversible Harm to Your Files

The CryptoShield 2.0 Ransomware belongs to a large family of ransomware known as CryptoShield or Protected. Like other threats in this family, the CryptoShield 2.0 Ransomware encrypts the victim's data using a strong encryption algorithm. The CryptoShield 2.0 Ransomware then demands that the victim pays a large amount of money to recover the affected files. The CryptoShield 2.0 Ransomware will target numerous different file types, including media files and documents. The files that are encrypted using the CryptoShield 2.0 Ransomware will have the string '.[RES_SUP@INDIA.COM].ID[2D64A0776C78A9C3].CRYPTOSHIELD' added to the end of the file name.

The Operations Executed by the CryptoShield 2.0 Ransomwar

Apart from encrypting the victim's files, the CryptoShield 2.0 Ransomware will carry out the following operations on the victim's computer:

The CryptoShield 2.0 Ransomware disables the Windows Recovery.
The CryptoShield 2.0 Ransomware deletes all the Shadow Volume Copies to prevent this method of recovery.
The CryptoShield 2.0 Ransomware makes changes to the infected computer to allow itself to persist on the victim's computer when it starts up.
The CryptoShield 2.0 Ransomware is capable of deleting and manipulating other file processes.

The CryptoShield 2.0 Ransomware uses the AES encryption to make the victim's files inaccessible. After its attack, the CryptoShield 2.0 Ransomware will display the following ransom note on the victim's computer:

'NOT YOUR LANGUAGE? USE http://translate.google.com
What happens to you files?
All of your files were encrypted by a strong encryption with RSA-2048 using CryptoShield 2.0. DANGEROUS.
More information about the encryption keys using RSA-2048 can be found here: https://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
Specially for your PC was generated personal RSA – 2048 KEY, both public and private. ALL your FILES were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our secret server.
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start send email now for more specific instructions, and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make payment.
To receive your private software:
Contact us by email , send us an email your (personal identification) ID number and wait for further instructions. Our specialist will contact you within 24 hours.
ALL YOUR FILES ARE ENCRYPTED AND LOCKED, YOU CAN NOT DELETE THEM, MOVE OR DO SOMETHING WITH THEM. HURRY TO GET BACK ACCESS FILES. Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!
So right now You have a chance to buy your individual private SoftWare with a low price!
CONTACTS E-MAILS:
res_sup@india.com – SUPPORT;
res_sup@computer4u.com – SUPPORT RESERVE FIRST;
res_reserve@india.com – SUPPORT RESERVE SECOND;
ID (PERSONAL IDENTIFICATION): 9694E***'

How the CryptoShield 2.0 Ransomware may Enter a Computer

In most cases, the CryptoShield 2.0 Ransomware is distributed in corrupted email attachments that use software exploits to download and execute corrupted code on the victim's computer. Apart from this method, the CryptoShield 2.0 Ransomware also may be distributed by hacking into a computer or by inserting corrupted scripts into compromised websites. Caution when handling email attachments and the use of a reliable security program that is fully up-to-date can help prevent these infections.

SpyHunter Detects & Remove CryptoShield 2.0 Ransomware

File System Details

CryptoShield 2.0 Ransomware may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	conhost.exe	dab3bc4a3cde46c6f2069786524a4f3e	20
Name: conhost.exe MD5: dab3bc4a3cde46c6f2069786524a4f3e Size: 123.39 KB (123392 bytes) Detections: 20 Type: Executable File Path: %ALLUSERSPROFILE%\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
2.	adobe_1233452.exe	00ff5b36cc6b09fabfd371f1f2091522	18
Name: adobe_1233452.exe MD5: 00ff5b36cc6b09fabfd371f1f2091522 Size: 154.11 KB (154112 bytes) Detections: 18 Type: Executable File Path: %ALLUSERSPROFILE%\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
3.	winlogon.exe	c91bb73753c2ed68c1ee7a8c0ac006ac	14
Name: winlogon.exe MD5: c91bb73753c2ed68c1ee7a8c0ac006ac Size: 100.86 KB (100864 bytes) Detections: 14 Type: Executable File Path: %ALLUSERSPROFILE%\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
4.	conhost.exe	97e9a421384905492f6675e10fd4d80f	6
Name: conhost.exe MD5: 97e9a421384905492f6675e10fd4d80f Size: 95.74 KB (95744 bytes) Detections: 6 Type: Executable File Path: %ALLUSERSPROFILE%\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
5.	conhost.exe	b4430540f3f8ba43db591332d8b41b50	5
Name: conhost.exe MD5: b4430540f3f8ba43db591332d8b41b50 Size: 115.2 KB (115200 bytes) Detections: 5 Type: Executable File Path: %ALLUSERSPROFILE%\Application Data\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
6.	conhost.exe	2d9c89f874fd2f341595046ad75efd01	4
Name: conhost.exe MD5: 2d9c89f874fd2f341595046ad75efd01 Size: 124.41 KB (124416 bytes) Detections: 4 Type: Executable File Path: %ALLUSERSPROFILE%\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
7.	conhost.exe	4527a86f7e1ad9328f091684618fc17d	4
Name: conhost.exe MD5: 4527a86f7e1ad9328f091684618fc17d Size: 118.27 KB (118272 bytes) Detections: 4 Type: Executable File Path: %ALLUSERSPROFILE%\Dati applicazioni\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
8.	conhost.exe	fdde3778c52f5a2d4de67ef8c049f856	4
Name: conhost.exe MD5: fdde3778c52f5a2d4de67ef8c049f856 Size: 96.25 KB (96256 bytes) Detections: 4 Type: Executable File Path: %ALLUSERSPROFILE%\Dati applicazioni\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
9.	winlogon.exe	2c613d71ba14be086195c9fd58a79fa9	3
Name: winlogon.exe MD5: 2c613d71ba14be086195c9fd58a79fa9 Size: 100.86 KB (100864 bytes) Detections: 3 Type: Executable File Path: %ALLUSERSPROFILE%\Application Data\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
10.	winlogon.exe	297fa6182b74c19a7a894f0aa7437a01	3
Name: winlogon.exe MD5: 297fa6182b74c19a7a894f0aa7437a01 Size: 99.84 KB (99840 bytes) Detections: 3 Type: Executable File Path: %ALLUSERSPROFILE%\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
11.	conhost.exe	e4d7596676b884563d9af2eef3642b1f	3
Name: conhost.exe MD5: e4d7596676b884563d9af2eef3642b1f Size: 119.29 KB (119296 bytes) Detections: 3 Type: Executable File Path: %ALLUSERSPROFILE%\Application Data\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
12.	conhost.exe	87ff17a6a8776dc211f8fe25e34a8120	3
Name: conhost.exe MD5: 87ff17a6a8776dc211f8fe25e34a8120 Size: 114.68 KB (114688 bytes) Detections: 3 Type: Executable File Path: %ALLUSERSPROFILE%\Dane aplikacji\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
13.	winlogon.exe	9be2fea8003eef818fe399f537242fce	3
Name: winlogon.exe MD5: 9be2fea8003eef818fe399f537242fce Size: 96.76 KB (96768 bytes) Detections: 3 Type: Executable File Path: %ALLUSERSPROFILE%\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
14.	winlogon.exe	5390a705d12f0befe460163341991e42	2
Name: winlogon.exe MD5: 5390a705d12f0befe460163341991e42 Size: 101.37 KB (101376 bytes) Detections: 2 Type: Executable File Path: %ALLUSERSPROFILE%\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
15.	winlogon.exe	5ccd8fcc98b2e0fdac08ed01a381a66f	2
Name: winlogon.exe MD5: 5ccd8fcc98b2e0fdac08ed01a381a66f Size: 99.32 KB (99328 bytes) Detections: 2 Type: Executable File Path: %ALLUSERSPROFILE%\Dane aplikacji\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
16.	winlogon.exe	83fd59daa3aae7f1fbfcdcb3a25104d8	2
Name: winlogon.exe MD5: 83fd59daa3aae7f1fbfcdcb3a25104d8 Size: 89.6 KB (89600 bytes) Detections: 2 Type: Executable File Path: %ALLUSERSPROFILE%\Dane aplikacji\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
17.	adobe_1233452.exe	4e773fbd20d0bdd3fc6505e8ef19f621	2
Name: adobe_1233452.exe MD5: 4e773fbd20d0bdd3fc6505e8ef19f621 Size: 145.92 KB (145920 bytes) Detections: 2 Type: Executable File Path: %ALLUSERSPROFILE%\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
18.	winlogon.exe	ab4fb0e72cd3d56967215acfa9712754	1
Name: winlogon.exe MD5: ab4fb0e72cd3d56967215acfa9712754 Size: 99.32 KB (99328 bytes) Detections: 1 Type: Executable File Path: %ALLUSERSPROFILE%\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
19.	conhost.exe	71c906dad53d2cacc2640b2b4a11f609	1
Name: conhost.exe MD5: 71c906dad53d2cacc2640b2b4a11f609 Size: 119.8 KB (119808 bytes) Detections: 1 Type: Executable File Path: %ALLUSERSPROFILE%\Application Data\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
20.	conhost.exe	5f0179ce907ddb4492b7561ec2846c9c	1
Name: conhost.exe MD5: 5f0179ce907ddb4492b7561ec2846c9c Size: 114.68 KB (114688 bytes) Detections: 1 Type: Executable File Path: %ALLUSERSPROFILE%\Dati applicazioni\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
21.	adobe_1233452.exe	b4b6750d1bc64deb1aee0fa23ad56885	1
Name: adobe_1233452.exe MD5: b4b6750d1bc64deb1aee0fa23ad56885 Size: 152.57 KB (152576 bytes) Detections: 1 Type: Executable File Path: %ALLUSERSPROFILE%\MicroSoftTMP\system32 Group: Malware file Last Updated: April 12, 2017
22.	file.exe	2b110975ece5a5478f68aa1e98bed678	1
Name: file.exe MD5: 2b110975ece5a5478f68aa1e98bed678 Size: 121.34 KB (121344 bytes) Detections: 1 Type: Executable File Group: Malware file Last Updated: May 3, 2017
23.	file.exe	aa33bdac973488e3cee9e64c3c5b7158	1
Name: file.exe MD5: aa33bdac973488e3cee9e64c3c5b7158 Size: 121.34 KB (121346 bytes) Detections: 1 Type: Executable File Group: Malware file Last Updated: May 3, 2017
24.	file.exe	e0d52cc8793592184a854fde5afaf152	1
Name: file.exe MD5: e0d52cc8793592184a854fde5afaf152 Size: 121.34 KB (121344 bytes) Detections: 1 Type: Executable File Group: Malware file Last Updated: May 3, 2017

Registry Details

CryptoShield 2.0 Ransomware may create the following registry entry or registry entries:

File name without path

#_RESTORING_FILES_#.HTML

#_RESTORING_FILES_#.TXT

Directories

CryptoShield 2.0 Ransomware may create the following directory or directories:

%ALLUSERSPROFILE%\MicroSoftTMP

%ALLUSERSPROFILE%\MicroSoftWare

Enigma Software Group Prevails Over Malwarebytes at the Ninth Circuit

Search

Change Region

CryptoShield 2.0 Ransomware

Threat Scorecard

EnigmaSoft Threat Scorecard

The CryptoShield 2.0 Ransomware can Cause Irreversible Harm to Your Files

The Operations Executed by the CryptoShield 2.0 Ransomwar

How the CryptoShield 2.0 Ransomware may Enter a Computer

SpyHunter Detects & Remove CryptoShield 2.0 Ransomware

File System Details

Registry Details

Directories

Submit Comment

Trending

'YouPorn' Email Scam

Safe Search Eng

Findtheirreport.com

Most Viewed

Is Lookmovie.io Safe?

How To Fix 'Printer Driver is Unavailable' Error

Discord Shows Black Screen when Sharing Screen