Ransom.Win32.ENMITY.THJOFBC

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {Drive Letter}:\KeyForFiles\Key.secret → contains encrypted victim's information and master key for decryption
• {Drive Letter}:\KeyForFiles\DecryptionKey.txt
• C:\KeyForFiles\PublicKey.txt
• E:\Rns for being rich\Enmity\Release\Enmity.pdb → project file

Other System Modifications

This Ransomware adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Enmity
ID = {Victim's ID}

Information Theft

This Ransomware accepts the following parameters:

• {Drive Letter}:\

Other Details

This Ransomware does the following:

• Upon execution, it shows a command line interface whereas it accepts parameters:
  • 1 → Full Encryption
  • 2 → Specific Directory Encryption (note that the sample file should be in the directory to be encrypted)
• The information inside the Key.secret file for decryption are the following:
  • Victim ID
  • Amount of data Encrypted
  • Criminal email address
  • IP address
  • Date of Infection

Ransomware Routine

This Ransomware renames encrypted files using the following names:

• {Random}-Mail[{BLOCKED}o@gmail.com ]ID-[{User's ID}].{Random 6-byte characters}

It drops the following file(s) as ransom note:

• Enmity-Unlock-Guide.txt