Trojan-Ransom.Win32.Cryakl

Malware of this family is distributed in various ways, such as spam, exploit kits, vulnerable server software, and weak RDP credentials. Once launched, it will iterate through all drives, excluding some system directories and the directory that holds user’s temporary files. After that, it encrypts almost all user files by using a custom symmetric crypto algorithm. During the encryption process, special markers such as {ENCRYPTSTART} and {ENCRYPTENDED} are added to the encrypted files. The malware also creates the file how_to_decrypt.hta in each directory with encrypted files.

Top 10 countries with most attacked users (% of total attacks)

* Percentage of all unique Kaspersky users worldwide who have been attacked by this malware