TROJ_CRIBIT.H

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %Application Data%\OneClickRemSoftware\BitCrypt.bmp
• %Application Data%\OneClickRemSoftware\del.bat
• %Application Data%\OneClickRemSoftware\passworddata.ddb

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %Application Data%\OneClickRemSoftware\{random}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\OneClickRemSoftware

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It leaves the following text files:

• %Application Data%\OneClickRemSoftware\What_happened_with_your_files.txt
• {Drive Letter}:\{folder path}\What_happened_with_your_files.txt

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Bitcomint = "%ApplicationData%\OneClickSoftware\{random}.exe"

Other Details

This Trojan encrypts files with the following extensions:

• *.abw
• *.arj
• *.asm
• *.bpg
• *.cdr
• *.cdt
• *.cdx
• *.cer
• *.css
• *.dbf
• *.dbt
• *.dbx
• *.dfm
• *.djv
• *.djvu
• *.doc
• *.docm
• *.docx
• *.dpk
• *.dpr
• *.frm
• *.jpeg
• *.jpg
• *.key
• *.lzh
• *.lzo
• *.mdb
• *.mde
• *.odc
• *.pab
• *.pas
• *.pdf
• *.pgp
• *.php
• *.pps
• *.ppt
• *.pst
• *.rtf
• *.sql
• *.text
• *.txt
• *.vbp
• *.vsd
• *.wri
• *.xfm
• *.xlc
• *.xlk
• *.xls
• *.xlsm
• *.xlsx
• *.xlw
• *.xsf
• *.xsn

It renames encrypted files using the following names:

• {filename}.bitcrypt2