RANSOM_XORBAT.A

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This Trojan drops the following files:

• %Desktop%\DECRYPT.txt - ransom note
• %User Temp%\809133.txt - ransom note
• %User Temp%\809133.cmd - uses 809133.exe to encrypt files. This is deleted after file encryption

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.crypted
(Default) = "Crypted"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Crypted\shell\open\
command
(Default) = "notepad.exe %User Temp%\809133.txt"

Other Details

This Trojan encrypts files with the following extensions:

• *.zip
• *.rar
• *.7z
• *.tar
• *.gz
• *.xls
• *.xlsx
• *.doc
• *.docx
• *.pdf
• *.rtf
• *.ppt
• *.pptx
• *.sxi
• *.odm
• *.odt
• *.mpp
• *.ssh
• *.pub
• *.gpg
• *.pgp
• *.kdb
• *.kdbx
• *.als
• *.aup
• *.cpr
• *.npr
• *.cpp
• *.bas
• *.asm
• *.cs
• *.php
• *.pas
• *.vb
• *.vcproj
• *.vbproj
• *.mdb
• *.accdb
• *.mdf
• *.odb
• *.wdb
• *.csv
• *.tsv
• *.psd
• *.eps
• *.cdr
• *.cpt
• *.indd
• *.dwg
• *.max
• *.skp
• *.scad
• *.cad
• *.3ds
• *.blend
• *.lwo
• *.lws
• *.mb
• *.slddrw
• *.sldasm
• *.sldprt
• *.u3d
• *.jpg
• *.tiff
• *.tif
• *.raw
• *.avi
• *.mpg
• *.mp4
• *.m4v
• *.mpeg
• *.mpe
• *.wmf
• *.wmv
• *.veg
• *.vdi
• *.vmdk
• *.vhd
• *.dsk

It does the following:

• It accesses the following URLs to report infection status and to download component for encryption routine:
  • http://{domain}/counter/?ad=1DJSvvJhEaJvHfFxBiqoUdM4LPQQFs4iDJ&dc={value}
  • http://{domain}/counter/?id=rXf99xSu-CaXHM9gcc0cQ9m_ZAqPxVR6ffAJEPT3ntMUCmaFwrCfyZQGeh2b8fy-ZX23_9Am&rnd={random generated number}

    where {domain} can be any of the following:

    • {BLOCKED}ilen.com
    • {BLOCKED}r.ru
    • {BLOCKED}esearch.com
    • {BLOCKED}s.com.tr
    • www.{BLOCKED}n.ro

    • The downloaded file is saved as follows:
      • %User Temp%\809133.exe - component for file encryption. This is deleted after file encryption routine
    • It appends the extension .crypted to the encrypted files

    NOTES:
    

    This malware opens the dropped ransom note 809133.txt containing the following message: