Ransom.MSIL.ROBTOR.THLADBC

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files found in specific folders. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• cmd.exe /c taskkill /IM {Malware Name} /F && del \ {Malware File Path}
• Notepad.exe "%Desktop%\RobCryptor.txt"

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Ransomware drops the following files:

• {Removable Drive}:\autorun.inf

Propagation

This Ransomware drops the following copy(ies) of itself in all removable drives:

• {Removable Drive}:\RobCryptor.exe → Copy of itself

Information Theft

This Ransomware gathers the following data:

• IP Address
• Username
• If Machine is 64-bit
• Total RAM
• Available Memory
• OS Version
• Lists of Disks
• OS Build
• Registered Owner

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• https://{BLOCKED}d.com/api/webhooks/874832445508300811/_sh8CNQu_kjOYMptw-3i8n1wXSvRHgeULe04wHSodhpCd5o_LFoTugCEkUYE-uC0PuIX

Other Details

This Ransomware does the following:

• It terminates itself if any of the following are satisfied
  • If the MD5 Hashed username matches the following hash:
  • d199ae63b2b2e6c7bd8229faf10821e4 → ezzal
  • If the following strings are found on the system information:
  • VIRTUAL
  • vmware
  • VirtualBox
• It displays its ransom note after encryption

It checks if the following virtual machine or sandbox related module(s) is loaded in the affected system:

• sbieDll.dll

Ransomware Routine

This Ransomware encrypts files found in the following folders:

• %Desktop%
• %User Profile%\My Documents
• %User Profile%\My Pictures

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It appends the following extension to the file name of the encrypted files:

• .RobCryptor

It drops the following file(s) as ransom note:

• %Desktop%\RobCryptor.txt