RANSOM_CRYPICH.F117EV

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Ransomware does the following:

• Displays the following window upon running:
  

Ransomware Routine

This Ransomware renames encrypted files using the following names:

• email-{contact e-mail}.{malware version}.{encryption id}.randomname-{30 random letters}.{3 random letters}.{3 random letters}

It drops the following file(s) as ransom note:

• {folder of encryted files}\README.txt
  

NOTES:

The following are the fields and actions available:

• Contact email - email to be included on the renamed encrypted filename
• Encrypt folders with subfolders - enable or disable recursive encryption
• Encrypt All - encrypt all available drives and ignore folder list
• Autodelete after encrypt - ability to delete itself after encryption
• NOD mode - when enabled, ot adds the following process instead of encrypting files from main process:
  •-cmd.exe {filepath to encrypt} {argument 1} {argument 2} {argument 3}
• Not encrypted file extension list - list of avoided extension, with the following default values:
  • sys
  • dll
  • ini
  • log
  • dat
  • bmp
  • png
  • bat
  • exe
  • com
  • bin
• Folder List - contains a list of folders to encrypt if Encrypt all checkbox is disabled
• Start - starts encryption with current settings
• Press to hide - hides the window