The CryptoLocker ransomware was first discovered in late 2013. Millions of computers were infected, billions of files were encrypted, and millions of dollars worth of ransom was collected within several months. It caught a lot of researchers' attention at the time, and it was finally isolated in late May 2014. After a few months' silence, a new variant - CryptoWall - appeared in late 2014. Millions of computers were infected within five months, and CryptoWall is still active now. Both CryptoLocker and CryptoWall propagated as attachments or malicious links through email messages. Once the computer was infected, the targeted files were encrypted and a payload popped up to ask for a ransom. Sometimes files can be recovered after paying the ransom, but sometimes not. Compared to CryptoLocker, CryptoWall is stealthier as it uses the Tor network to host payment websites in order to avoid being tracked and discovered. It deletes the volume's shadow copies and disables the Windows Error screen at start up to increase the difficulty of recovering files. It also disables Windows Updates and error reporting in order to avoid detection.
In this presentation, we will compare these two variants in terms of their communication methods, the way they select target files, their encryption methods and how decryption instruction websites are managed over the Tor network. Last but not least, we will demonstrate how to recover encrypted files.