TROJ_CRYPWALL.AX

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It gathers certain information on the affected computer.

It connects to certain websites to send and receive information. However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• TROJ_UPATRE.CRYP

Installation

This Trojan adds the following folders:

• %System Root%\{7 characters from UID}

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following files:

• %User Startup%\DECRYPT_INSTRUCTION.TXT
• %User Startup%\DECRYPT_INSTRUCTION.HTML
• %User Startup%\DECRYPT_INSTRUCTION.URL

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

It drops and executes the following files:

• %Desktop%\DECRYPT_INSTRUCTION.TXT
• %Desktop%\DECRYPT_INSTRUCTION.HTML
• %Desktop%\DECRYPT_INSTRUCTION.URL

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %System Root%\{7 characters from UID}\{7 characters from UID}.exe
• %Application Data%\{7 characters from UID}.exe
• %User Startup%\{7 characters from UID}.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{7characters from UID} = "%Application Data%\{7 characters from UID}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{6 characters from UID} = "%System Root%\{7 characters from UID}\{7 characters from UID}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\{UID}

HKEY_CURRENT_USER\Software\{UID}\
{random key}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\{UID}\
{random key}
{Path and File name of encrypted file} = "{hex values}"

Information Theft

This Trojan gathers the following information on the affected computer:

• Unique Identifier (UID)
• Machine Screenshot

Other Details

This Trojan connects to the following website to send and receive information:

• http://{BLOCKED}aultppc.com/{random generated value}

However, as of this writing, the said sites are inaccessible.

NOTES:

It drops DECRYPT_INSTRUCTION.TXT, DECRYPT_INSTRUCTION.HTML, and DECRYPT_INSTRUCTION.URL, to all folders after encryption.

It encrypts Database, Web, Office, Video, Images, Scripts, Text and other non-binary files.

It displays the following page for instructions on how to decrypt files:

It displays the following page for instructions on how to decrypt files:

It demands payment for using decryption service: