Ransom.MSIL.FDECRYPT.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• %User Startup%\Ransomware.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

It adds the following processes:

• "cmd.exe" /c vssadmin.exe delete shadows /all /quiet
• "cmd" /C vssadmin Delete Shadows /All /Quiet
• "netsh.exe" Advfirewall set allprofiles state off

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• kir
• kos
• mysql

Other Details

This Ransomware does the following:

• It requires to be executed as an administrator:
  
• It avoids encrypting files with the following file names:
  • BlackRoot-Ransomware.exe
  • boot.sdi
  • bootmgr
  • BOOTNXT
  • BOOTSECT.BAK
  • BOOTSTAT.DAT
  • info.hta
  • ReadMe.txt
  • ReAgent.xml
  • Winre.wim
• It avoids encrypting files in the following drives:
  • A:
  • B:

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• %System Root%\$RECYCLE.BIN
• %System Root%\$Recycle.Bin
• %System Root%\System Volume Information
• %System%\Documents and Settings
• %System%\Windows

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It appends the following extension to the file name of the encrypted files:

• .[{Volume Serial Number or Processor ID}[].Crypt

It drops the following file(s) as ransom note:

• %User Startup%\info.hta
• {Encrypted File Path}\info.hta
  

It leaves text files that serve as ransom notes containing the following text:

• {Encrypted File Path}\ReadMe.txt
  

It avoids encrypting files with the following file extensions:

• .BCD.LOG1
• .BCD.LOG2
• .Crypt
• bootx64.efi