Ransom.Win64.LDRADO.THCBOBD

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• vssadmin Delete Shadows /all /quiet
• cmd "/c chcp 65001 & systeminfo"

Information Theft

This Ransomware accepts the following parameters:

• -skip-local → Skip processing local files.
• -skip-net → Skip processing shares
• -keep → Disable self-deletion after execution (Self-deletion is enabled by default).
• -n → Specify network in CIDR format. If not specified, values from active network interfaces will be used. A file with a list of networks can also be specified.
• -d → Specifies a domain.
• -u → Specifies username for SMB.
• -p → Specifies password for SMB.

Other Details

This Ransomware does the following:

• It gathers the following data via systeminfo:
  • Operating System Information:
  • Name
  • Version
  • Manufacturer
  • Configuration
  • Build Type
  • Registered Owner
  • Registered Organization
  • Product ID
  • Installation date
  • Host name
  • System Boot Time
  • System Manufacturer
  • System Architecture
  • Processor information
  • System Language
  • Time Zone Information
  • BIOS Version
  • Total and Available Physical Memory
  • Virtual Memory Information (Max, Available, In Use)
  • Page file locations
  • Domain
  • Logon server
  • Hotfix(es)
  • Network card(s)
• It displays its logs on a console:
  
• It sends some of its logs to the following IP Address:
  • {BLOCKED}.{BLOCKED}.{BLOCKED}.152:443

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• ntldr
• ntdetect.com
• autoexec.bat
• ntuser.dat
• ntuser.dat.log
• iconcache.db
• bootsect.bak
• bootfont.bin
• bootmgr
• thumbs.db

It avoids encrypting files found in the following folders:

• Windows
• programdata
• program files
• program files (x86)
• $recycle.bin
• all users
• winnt
• appdata
• application data
• local settings
• boot

It appends the following extension to the file name of the encrypted files:

• .00000001

It drops the following file(s) as ransom note:

• {Encrypted Directory}\HOW_RETURN_YOUR_DATA.txt
  

It avoids encrypting files with the following file extensions:

• .00000001
• .exe
• .dll
• .sys
• .msi
• .ini
• .inf
• .lnk