New crypto ransomware in town : CryptoFortress
Archived: 2026-04-05 23:16:59 UTC
2015-03-04 - Landscape
Blitz post.
[This post has been heavily edited to  fix my mistake.
]
I was hunting for Gootkit (pushed in a Nuclear Pack instance in France those days) but instead I got a
Teerac.A  new crypto ransomware.
http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html
Page 1 of 6

Nuclear Pack pushing CryptoFortress via CVE-2013-2551 - FR - 2015-03-04
(have no sure explanation for the 444 error on the "undefined" and CVE-2015-0311 call in that pass).
I thought i was facing Teerac.A (aka TorrentLocker) which was showing that design :
http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html
Page 2 of 6

Clicking on the "Buy Decryption software" :
http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html
Page 3 of 6

The sample I got today is showing a close identity :  CryptoFortress
http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html
Page 4 of 6

Clicking on the "Buy decryption software"
http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html
Page 5 of 6

Samples :  Torrent Locker and a fresh CryptoFortress
26f13c4ad8c1ccf81e80a556cf6db0af - 2014-10-25
e6dda3e06fd32fc3670d13098f3e22c9 - 2015-03-04
Read more :
(PDF) TorrentLocker - Ransomware in a country near you - 2014-12 - Marc-Etienne M.Léveillé - Eset
Post Publication Reading :
CryptoFortress - 2015-03-06 - Renaud Tabary - CertLexsi
Source: http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html
http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html
Page 6 of 6

  http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html  
The sample I got today is showing a close identity : CryptoFortress 
   Page 4 of 6