CTB-Locker is a currently active ransomware that encrypts files to lock users out.
Here are a few links about this malware:
- A new generation of ransomware: Elliptic curve cryptography + Tor + Bitcoin, by Fedor Sinitsyn, July 24, 2014.
- CTB-Locker: Multilingual Malware Demands Ransom, by Pablo Ramos, January 21, 2015.
- CTB-Locker Ransomware Includes Freemium Feature, Extends Deadline, by Trend Micro, January 21, 2015.
- CTB Locker and Critroni Ransomware Information Guide and FAQ, by Lawrence Abrams, January 29, 2015.
- CTB-Locker: files decryption demonstration feature, by Zairon, February 9, 2015.
- CTB-Locker dropper, by Christophe Rieunier.
- decryptcryptolocker.com, by FireEye and Fox IT (doesn't seems to work for CTB-Locker).
- CryptoLocker, Wikipedia (a similar Ransomware).
Is there a complete analysis about the encryption used by CTB-Locker, and some hints about possible cryptanalysis based on some weaknesses of this cryptographic scheme that can be used to recover the encrypted files.
The idea would be to produce a (free) tool similar to decryptcryptolocker.com, that can perform the decryption for users.