Ransom.MSIL.HIDDENBEER.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files found in specific folders. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %System Root%\{User Name}\@Chromium.exe

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Other System Modifications

This Ransomware sets the system's desktop wallpaper to the following image:

• %System Root%\{User Name}\Chrome.jpg
  

Download Routine

This Ransomware accesses the following websites to download files:

• https://i.{BLOCKED}r.com/G8NFB3n.jpg

It saves the files it downloads using the following names:

• %System Root%\{User Name}\Chrome.jpg

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Information Theft

This Ransomware gathers the following data:

• Machine Name
• User Name

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}.{BLOCKED}.72.239/Ransom/write.php?info=%0Acomputer_name--{Machine Name}--userName--{Username}--password--{24-41 Random Characters}

Other Details

This Ransomware connects to the following URL(s) to check for an Internet connection:

• www.google.com

It encrypts files with the following extensions:

• .config
• .pdb
• .properties
• .bin
• .txt
• .jar
• .exe
• .dat
• .contact
• .settings
• .doc
• .docx
• .docm
• .xls
• .xlsx
• .ppt
• .pptx
• .odt
• .jpg
• .png
• .csv
• .py
• .sql
• .mdb
• .sln
• .php
• .asp
• .aspx
• .html
• .htm
• .xml
• .psd
• .pdf
• .dll
• .c
• .cs
• .mp3
• .mp4
• .f3d
• .dwg
• .cpp
• .zip
• .rar
• .mov
• .rtf
• .bmp
• .mkv
• .avi
• .apk
• .lnk
• .iso
• .7-zip
• .ace
• .arj
• .bz2
• .cab
• .gzip
• .lzh
• .tar
• .uue
• .xz
• .z
• .001
• .mpeg
• .mp3
• .mpg
• .core
• .crproj
• .pdb
• .ico
• .pas
• .db
• .torrent
• .7z
• .s

Ransomware Routine

This Ransomware encrypts files found in the following folders:

• %Desktop%
• %Favorites%
• %User Profile%\Links
• %User Profile%\Contacts
• %User Profile%\Desktop
• %User Profile%\Documents
• %User Profile%\Downloads
• %User Profile%\Pictures
• %User Profile%\Music
• %User Profile%\OneDrive
• %User Profile%\Saved Games
• %User Profile%\Searches
• %User Profile%\Videos

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista, 7, and 8.. %Favorites% is the current user's Favorites folder, which is usually C:\Documents and Settings\{user name}\Favorites on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Favorites on Windows Vista, 7, and 8.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista, 7, and 8.)

It appends the following extension to the file name of the encrypted files:

• .beer

It drops the following file(s) as ransom note:

• %Desktop%\@FILE-DECRYPTER.exe
  
• %Desktop%\@FILES-HELP-{Machine Name}.txt