Lawrence Abrams talks about a new discovery, which is called SyncCrypt, the security researcher Emsisoft xXToffeeXx, which is distributed using spam attachments containing WSF files. Lawrence analyzed the script, and noted that the method used to download and install Ransomware is quite interesting. This is because the WSF script will download images with embedded ZIP files that contain the necessary files to infect the computer with SyncCrypt. This method has also made the images undetectable by almost all antivirus vendors on VirusTotal.
Unfortunately, it is currently impossible to decrypt encrypted SyncCrypt files for free, but you can use the special SyncCrypt support theme.
