Summary:
The threat actor behind the lesser-known AstraLocker ransomware told BleepingComputer they're shutting down the operation and plan to switch to cryptojacking. The ransomware's developer submitted a ZIP archive with AstraLocker decryptors to the VirusTotal malware analysis platform. Researchers downloaded the archive and confirmed that the decryptors are legitimate and working after testing one of them against files encrypted in a recent AstraLocker campaign. While we only tested one decryptor that successfully decrypted files locked in one campaign, other decryptors in the archive are likely designed to decrypt files encrypted in previous campaigns. While the developer did not reveal the reason behind the AstraLocker shutdown, it’s likely due to the sudden publicity brought by recent reports that would land the operation in law enforcement’s crosshairs.[/subscribe_to_unlock_form]
Summary:
The threat actor behind the lesser-known AstraLocker ransomware told BleepingComputer they're shutting down the operation and plan to switch to cryptojacking. The ransomware's developer submitted a ZIP archive with AstraLocker decryptors to the VirusTotal malware analysis platform. Researchers downloaded the archive and confirmed that the decryptors are legitimate and working after testing one of them against files encrypted in a recent AstraLocker campaign. While we only tested one decryptor that successfully decrypted files locked in one campaign, other decryptors in the archive are likely designed to decrypt files encrypted in previous campaigns. While the developer did not reveal the reason behind the AstraLocker shutdown, it’s likely due to the sudden publicity brought by recent reports that would land the operation in law enforcement’s crosshairs.[emaillocker id="1283"]
References:
The following reports contain further technical details:
[/emaillocker]