Ransom.Win32.LCRY.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• %Windows%\system32lrk.dat
• %Windows%\system32lri.dat
• {Malware File Path}\Code.key ← decoy decryption key
• %Desktop%\@Decryptor@.exe ← Copy of application that loaded the malware file
• %Windows%\system32lrw.bmp
• {Malware File Path}\PasswordEnter.txt

(Hinweis: %Windows% ist der Windows Ordner, normalerweise C:\Windows oder C:\WINNT.. %Desktop% ist der Ordner 'Desktop' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Desktop unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Desktop unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Desktop unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\Desktop unter Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)

Andere Systemänderungen

Stellt auf dem System das folgende Bild als Desktop-Hintergrundbild ein:

• %Windows%\system32lrw.bmp
  

Andere Details

Es macht Folgendes:

• It encrypts all available logical drives from A -Z.
  • If the drive being encrypted is C drive it only encrypts the %Desktop% and %User Profile%\Documents folders.
• It checks if system32lrk.dat and system32lri.dat exists in the affected machine's %Windows% folder.
  • If it exists, it opens {Malware File Path}\PasswordEnter.txt and asks the user to enter a key on the file for 60 seconds.
  • If the correct key is entered within 60 seconds, it decrypts its encrypted files then restart the affected machine.
  • If not, it shows the following message box then restart the affected machine.
    
    
  • If it does not exist, it encrypts the files in the affected machine.
• It attempts to load the file 'vcruntime140Org.dll'
  • If the file is not loaded, it displays the following message box:
    
• It displays its ransom note after encryption through a message box: