According to the analysis of Cryptolocker done by Emisoft back in September (http://blog.emsisoft.com/2013/09/10/cryptolocker-a-new-ransomware-variant/), Cryptolocker uses AES 256 to encrypt the files (generating one AES key per file extension locally), and one RSA 2048 public key from the Command and Control Server to encrypt the AES keys. That makes sense.

I have seen no similar reporting on Cryptowall. Everything that I have been able to find seems to indicate that Cryptowall is using RSA 2048 to encrypt the files, with no mention of AES or other private key algorithm.

Can you confirm that, unlike Cryptolocker, Cryptowall is using one Command and Control Server provided RSA 2048 public key exclusively to encrypt the victim's files?

Thank you.

Ted