Worth a read:
My only question is why would the dropper care whether it's running in a virtual environment? A bit more digging reveals that the malware author is assuming that if his code ends up running in a VM, it's probably a sandbox and being studied, so the malicious code refuses to co-operate. Clever.
Here's the analysis of Cryptowall 2.0, from the same blog:
Nintendo New 2DS XL mini-review: The best version of the 3DS hardware yet - New 2DS XL is smaller, lighter, and cheaper. What more could you ask for?
1 hour ago