Ransom.Win32.PHOBOS.JSHSNZ

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• If 'GBQ' exists in {Malware Path}:
  • %AppDataLocal%\GBQ
  • %User Startup%\GBQ
  • %Common Startup%\GBQ

(Note: %Common Startup% is the startup folder for all users, which is usually C:\Documents and Settings\All Users\Start Menu\Programs\Startup on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

It drops the following copies of itself into the affected system:

• %AppDataLocal%\{Malware Filename}.exe

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• vssadmin delete shadows /all /quiet
• netsh advfirewall set currentprofile state off
• wmic shadowcopy delete
• netsh firewall set opmode mode=disable
• bcdedit /set {default} bootstatuspolicy ignoreallfailures
• bcdedit /set {default} recoveryenabled no
• wbadmin delete catalog -quiet
• "%System%\mshta.exe" "%Desktop%\Buy Black Mass Volume II.hta"
• "%System%\mshta.exe" "%Public%\desktop\Buy Black Mass Volume II.hta"
• "%System%\mshta.exe" "{Drive Letter}\Buy Black Mass Volume II.hta"
• {Malware Path}\{Malware File}

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\<>{Volume Serial Number}00000001
• Global\<>{Volume Serial Number}00000000

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{Malware Filename} = %AppDataLocal%\{Malware Filename}.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Malware Filename} = %AppDataLocal%\{Malware Filename}.exe

It drops the following file(s) in the Windows Startup folder to enable its automatic execution at every system startup:

• %User Startup%\{Malware Filename}.exe
• %Common Startup%\{Malware Filename}.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).. %Common Startup% is the startup folder for all users, which is usually C:\Documents and Settings\All Users\Start Menu\Programs\Startup on Windows 2000, XP, and Server 2003, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• msftesql.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlservr.exe
• sqlwriter.exe
• oracle.exe
• ocssd.exe
• dbsnmp.exe
• synctime.exe
• agntsvc.exe
• mydesktopqos.exe
• isqlplussvc.exe
• xfssvccon.exe
• mydesktopservice.exe
• ocautoupds.exe
• agntsvc.exe
• agntsvc.exe
• agntsvc.exe
• encsvc.exe
• firefoxconfig.exe
• tbirdconfig.exe
• ocomm.exe
• mysqld.exe
• mysqld-nt.exe
• mysqld-opt.exe
• dbeng50.exe
• sqbcoreservice.exe
• excel.exe
• infopath.exe
• msaccess.exe
• mspub.exe
• onenote.exe
• outlook.exe
• powerpnt.exe
• steam.exe
• thebat.exe
• thebat64.exe
• thunderbird.exe
• visio.exe
• winword.exe
• wordpad.exe

Other Details

This Ransomware does the following:

• It scans specific database related file extensions:
  • fdb
  • sql
  • 4dd
  • 4dl
  • abs
  • abx
  • accdb
  • accdc
  • accde
  • adb
  • adf
  • ckp
  • db
  • db-journal
  • db-shm
  • db-wal
  • db2
  • db3
  • dbc
  • dbf
  • dbs
  • dbt
  • dbv
  • dcb
  • dp1
  • eco
  • edb
  • epim
  • fcd
  • gdb
  • mdb
  • mdf
  • ldf
  • myd
  • ndf
  • nwdb
  • nyf
  • sqlitedb
  • sqlite3
  • sqlite
• It creates an anonymous pipe.

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• Buy Black Mass Volume II.hta
• Buy Black Mass Volume I.txt
• boot.ini
• bootfont.bin
• ntldr
• ntdetect.com
• io.sys
• gbq
• {Malware Filename}.exe

It avoids encrypting files found in the following folders:

• %Windows%
• %ProgramData%\Microsoft\Windows\Caches

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It appends the following extension to the file name of the encrypted files:

• .id[{Volume Serial Number}-6666].[{BLOCKED}f@vx-underground.org ].VXUG

It drops the following file(s) as ransom note:

• %Desktop%\Buy Black Mass Volume II.hta
• %Public%\Desktop\Buy Black Mass Volume II.hta
• {Drive Letter}\Buy Black Mass Volume II.hta
  

It leaves text files that serve as ransom notes containing the following text:

• %Desktop%\Buy Black Mass Volume I.txt
• %Public%\Desktop\Buy Black Mass Volume I.txt
• {Drive Letter}\Buy Black Mass Volume I.txt
  

It avoids encrypting files with the following file extensions:

• VXUG
• actin
• DIKE
• Acton
• actor
• Acuff
• FILE
• Acuna
• fullz
• MMXXII
• MNX
• BACKJOHN
• G-STARS
• faust
• STEEL
• worry
• WIN
• duck
• fopra
• unique
• acute
• adage
• make
• Adair
• MLF
• magic
• Adame
• banhu
• banjo
• Banks
• Banta
• Barak
• Caleb
• Cales
• Caley
• calix
• Calle
• Calum
• Calvo
• deuce
• Dever
• devil
• Devoe
• Devon
• Devos
• dewar
• eight
• eject
• eking
• Elbie
• elbow
• elder
• phobos
• help
• blend
• bqux
• com
• mamba
• KARLOS
• DDoS
• phoenix
• PLUT
• karma
• bbc
• CAPITAL
• WALLET
• LKS
• tech
• s1g2n3a4l
• MURK
• makop
• ebaka
• jook
• LOGAN
• FIASKO
• GUCCI
• decrypt
• OOH
• Non
• grt
• LIZARD
• FLSCRYPT