It will then display a ransom notice and instructions for making the payment, as well as a countdown timer showing how long the user has to pay the ransom demanded. Once run, CTB-Locker will encrypt files on the machine and append the original filenames with a randomly generated 7-character long extension. It will then decrypt and run the ransomware. If the user opens the attachment and runs the executable program, Dalexis will contact a predetermined list of compromised websites and download an encrypted copy of CTB-Locker on the user's machine. This executable is identified as Trojan-Downloader:W32/Dalexis. SCR extension, which makes it appear to be a screensaver program. The attachment contains an executable program that uses the. The attachment may be double-zipped - i.e., a ZIP file contains a second ZIP file. The CTB-Locker is spread in spam email messages containing a file attachment (typically, of type ZIP or CAB). Labs Weblog (9 February 2015): CTB-Locker Infections on the Rise

Once installed on the system, it encrypts files on the system and displays a demand for payment in return for a decryption key to restore access to the affected files. CTB-Locker is downloaded and installed on a system by a separate trojan-downloader program.

Crypto locker on machine