Ransom.Win32.SHELLRUN.YPCHDT

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• %System%\NTSD.exe → If the following processes are running:
  • sqlwriter.exe
  • sqlservr.exe
  • sqlceip.exe
  • MsDtsSrvr.exe
  • msmdsrv.exe
• %System%\user.txt
• %System%\pass.txt
• %Public%\user.txt
• %Public%\pass.txt

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Fügt die folgenden Prozesse hinzu:

• NET stop MSSQL$SQLEXPRESS /Y
• NET STOP acrsch2svc /Y
• NET STOP acronisagent /Y
• NET STOP arsm /Y
• NET STOP FirebirdServerDefaultInstance /Y
• NET STOP FirebirdGuardianDefaultInstance /Y
• NET STOP MuzzleServer /Y
• sc stop \"Acronis VSS Provider\" /y
• sc stop \"Enterprise Client Service\" /y
• sc stop \"Sophos Agent\" /y
• sc stop \"Sophos AutoUpdate Service\" /y
• sc stop \"Sophos Clean Service\" /y
• sc stop \"Sophos Device Control Service\"
• sc stop \"Sophos File Scanner Service\" /y
• sc stop \"Sophos Health Service\" /y
• sc stop \"Sophos MCS Agent\" /y
• sc stop \"Sophos MCS Client\" /y
• sc stop \"Sophos Message Router\" /y
• sc stop \"Sophos Safestore Service\" /y
• sc stop \"Sophos System Protection Service\" /y
• sc stop \"Sophos Web Control Service\" /y
• sc stop \"SQLsafe Backup Service\" /y
• sc stop \"SQLsafe Filter Service\" /y
• sc stop \"Symantec System Recovery\" /y
• sc stop \"Veeam Backup Catalog Data Service\"
• sc stop AcronisAgent
• sc stop AcrSch2Svc /y
• sc stop Antivirus /y
• sc stop ARSM /y
• sc stop BackupExecAgentAccelerator /y
• sc stop BackupExecAgentBrowser
• sc stop BackupExecDeviceMediaService /y
• sc stop BackupExecJobEngine /y
• sc stop BackupExecManagementService
• sc stop BackupExecRPCService /y
• sc stop BackupExecVSSProvider /y
• sc stop bedbg /y
• sc stop DCAgent
• sc stop EPSecurityService /y
• sc stop EPUpdateService /y
• sc stop EraserSvc11710 /y
• sc stop EsgShKernel /y
• sc stop FA_Scheduler
• sc stop IISAdmin /y
• sc stop IMAP4Svc /y
• sc stop macmnsvc /y
• sc stop masvc /y
• sc stop MBAMService /y
• sc stop MBEndpointAgent /y
• sc stop McAfeeEngineService /y
• sc stop McAfeeFramework /y
• sc stop McAfeeFrameworkMcAfeeFramework /y
• sc stop McShield /y
• sc stop McTaskManager /y
• sc stop mfemms /y
• sc stop mfevtp /y
• sc stop MMS
• sc stop mozyprobackup /y
• sc stop MsDtsServer /y
• sc stop MsDtsServer100 /y
• sc stop MsDtsServer110 /y
• sc stop MSExchangeFS
• sc stop MSExchangeIS
• sc stop MSExchangeMGMT /y
• sc stop MSExchangeMTA /y
• sc stop MSExchangeSA
• sc stop MSExchangeSRS /y
• sc stop MSSQL$BKUPEXEC /y
• sc stop MSSQL$ECWDB2
• sc stop MSSQL$PRACTICEMGT /y
• sc stop MSSQL$PRACTICEBGC /y
• sc stop MSSQL$PROFXENGAGEMENT /y
• sc stop MSSQL$SBSMONITORING /y
• sc stop MSSQL$SHAREPOINT /y
• sc stop MSSQL$SQL_2008 /y
• sc stop MSSQL$SYSTEM_BGC /y
• sc stop MSSQL$TPS /y
• sc stop MSSQL$TPSAMA
• sc stop MSSQL$VEEAMSQL2008R2 /y
• sc stop MSSQL$VEEAMSQL2012
• sc stop MSSQLFDLauncher$PROFXENGAGEMENT /y
• sc stop MSSQLFDLauncher$SBSMONITORING /y
• sc stop MSSQLFDLauncher$SHAREPOINT /y
• sc stop MSSQLFDLauncher$SQL_2008 /y
• sc stop MSSQLFDLauncher$SYSTEM_BGC /y
• sc stop MSSQLFDLauncher$TPS /y
• sc stop MSSQLFDLauncher$TPSAMA
• sc stop MSSQLSERVER /y
• sc stop MSSQLServerADHelper100
• sc stop MSSQLServerOLAPService
• sc stop MySQL80
• sc stop ntrtscan /y
• sc stop OracleClientCache80 /y
• sc stop PDVFSService
• sc stop POP3Svc
• sc stop ReportServer
• sc stop ReportServer$SQL_2008 /y
• sc stop ReportServer$SYSTEM_BGC /y
• sc stop ReportServer$TPS /y
• sc stop ReportServer$TPSAMA /y
• sc stop RESvc /y
• sc stop sacsvr /y
• sc stop SamSs /y
• sc stop SAVAdminService /y
• sc stop SAVService /y
• sc stop SDRSVC /y
• sc stop SepMasterService /y
• sc stop ShMonitor /y
• sc stop Smcinst
• sc stop SmcService /y
• sc stop SMTPSvc
• sc stop SNAC /y
• sc stop SntpService /y
• sc stop SQLAGENT$ /y
• sc stop SQLAGENT$BKUPEXEC /y
• sc stop SQLAGENT$ECWDB2 /y
• sc stop SQLAGENT$PRACTICEBGC /y
• sc stop SQLAGENT$PRACTICEMGT /y
• sc stop SQLAGENT$PROFXENGAGEMENT /y
• sc stop SQLAGENT$SBSMONITORING
• sc stop SQLAGENT$SHAREPOINT /y
• sc stop SQLAGENT$SQL_2008 /y
• sc stop SQLAGENT$SYSTEM_BGC /y
• sc stop SQLAGENT$TPS
• sc stop SQLAGENT$TPSAMA /y
• sc stop SQLAGENT$VEEAMSQL2008R2 /y
• sc stop SQLAGENT$VEEAMSQL2012 /y
• sc stop SQLBrowser /y
• sc stop SQLSafeORLService /y
• sc stop SQLSERVERAGENT /y
• sc stop SQLTELEMETRY
• sc stop SQLTELEMETRY$ECWDB2 /y
• sc stop SQLWriter /y
• sc stop SstpSvc
• sc stop svcGenericHost /y
• sc stop swi_filter /y
• sc stop swi_service /y
• sc stop swi_update_64 /y
• sc stop TmCCSF /y
• sc stop tmlisten /y
• sc stop TrueKey
• sc stop TrueKeySheduler /y
• sc stop TrueKeyServiceHelper /y
• sc stop UIODetect /y
• sc stop VeeamBackupSvc /y
• sc stop VeeamBrokerSvc /y
• sc stop VeeamCatalogSvc /y
• sc stop VeeamCloudSvc /y
• sc stop VeeamDeploymentSvc
• sc stop VeeamDeploySvc /y
• sc stop VeeamEnterpriseManagerSvc /y
• sc stop VeeamMountSvc /y
• sc stop VeeamNFSSvc /y
• sc stop VeeamRESTSvc
• sc stop VeeamTransportSvc /y
• sc stop W3Svc /y
• sc stop wbengine /y
• sc stop WRSVC /y
• sc stop SQLAgent$VEEAMSQL2008R2 /y
• sc stop VeeamHvIntegrationSvc /y
• sc stop swi_update /y
• sc stop SQLAgent$CXDB /y
• sc stop SQLAgent$CITRIX_METAFRAME /y
• sc stop \"SQL Backups\" /y
• sc stop MSSQL$PROD /y
• sc stop \"Zoolz 2 Service Backups\"
• sc stop MSSQLServerADHelper /y
• sc stop SQLAgent$PROD /y
• sc stop msftesql$PROD /y
• sc stop NetMsmqActivator /y
• sc stop EhttpSrv /y
• sc stop ekrn /y
• sc stop ESHASRV
• sc stop MSSQL$SOPHOS
• sc stop SQLAgent$SOPHOS /y
• sc stop AVP
• sc stop klnagent /y
• sc stop MSSQL$SQLEXPRESS /y
• sc stop SQLAgent$SQLEXPRESS /y
• sc stop kavfsslp /y
• sc stop KAVFSGT
• sc stop KAVFS /y
• sc stop mfefire
• wmic shadowcopy delete
• cmd.exe /c %Public%\Ladon.exe [IP Address]/24 MssqlScan

Injiziert Code in die folgenden Prozesse:

• cmd.exe
• notepad.exe
• mmc.exe
• rekeywiz.exe
• ctfmon.exe

Prozessbeendigung

Beendet die folgenden Dienste, wenn sie auf dem betroffenen System gefunden werden:

• mepocs
• memtas
• veeam
• svc$
• backup
• sql
• vss
• msexchange
• sql$
• mysql
• mysql$
• sophos
• MSExchange
• MSExchange$
• WSBExchange
• PDVFSService
• BackupExecVSSProvider
• BackupExecAgentAccelerator
• BackupExecAgentBrowser
• BackupExecDiveciMediaService
• BackupExecJobEngine
• BackupExecManagementService
• BackupExecRPCService
• GxBlr
• GxVss
• GxClMgrS
• GxCVD
• GxCIMgr
• GXMMM
• GxVssHWProv
• GxFWD
• SAPService
• SAP
• SAP$
• SAPD$
• SAPHostControl
• SAPHostExec
• QBCFMonitorService
• QBDBMgrN
• QBIDPService
• AcronisAgent
• VeeamNFSSvc
• VeeamDeploymentService
• VeeamTransportSvc
• MVArmor
• MVarmor64
• VSNAPVSS
• AcrSch2Svc

Beendet Prozesse oder Dienste, die einen oder mehrere dieser Zeichenfolgen enthalten, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

• sqlwriter.exe
• sqlservr.exe
• sqlceip.exe
• MsDtsSrvr.exe
• msmdsrv.exe
  It terminates these processes by executing NTSD -c q -p [Process ID]

Download-Routine

Speichert die heruntergeladenen Dateien unter den folgenden Namen:

• %Public%\Ladon.exe

Datendiebstahl

Folgende Daten werden gesammelt:

• Computer Name
• Processor Name
• OS Version
• Manufacturer
• Current Day and Year
• Running Processes

Andere Details

Verschlüsselt Dateien mit den folgenden Erweiterungen:

• 123
• 602
• 3dm
• 3ds
• 3g2
• 3gp
• 7z
• accdb
• aes
• ai
• ARC
• asc
• asf
• asm
• asp
• avi
• backup
• bak
• bat
• bmp
• brd
• bz2
• c
• cgm
• class
• cmd
• cpp
• crt
• cs
• csr
• csv
• dat
• db
• dbf
• dch
• der
• dif
• dip
• djvu
• doc
• docb
• docm
• docx
• dot
• dotm
• dotx
• dwg
• ec
• edb
• eml
• fla
• flv
• frm
• gif
• gpg
• gz
• h
• hwp
• ibd
• iso
• jar
• java
• jpeg
• jpg
• js
• jsp
• key
• lay
• lay6
• ldf
• m3u
• m4u
• max
• mdb
• mdf
• mid
• mkv
• mml
• mov
• mp3
• mp4
• mpeg
• mpg
• msg
• myd
• myi
• nef
• odb
• odg
• odp
• ods
• odt
• onetoc2
• ost
• otg
• otp
• ots
• ott
• p12
• PAQ
• pas
• pdf
• pem
• pfx
• php
• pl
• png
• pot
• potm
• potx
• ppam
• pps
• ppsm
• ppsx
• ppt
• pptm
• pptx
• ps1
• psd
• pst
• rar
• raw
• rb
• rtf
• sch
• sh
• sldm
• sldx
• slk
• sln
• snt
• sql
• sqlite3
• sqlitedb
• stc
• std
• sti
• stw
• suo
• svg
• swf
• sxc
• sxd
• sxi
• sxm
• sxw
• tar
• tbk
• tgz
• tif
• tiff
• txt
• uop
• uot
• vb
• vbs
• vcd
• vdi
• vmdk
• vmx
• vob
• vsd
• vsdx
• wav
• wb2
• wk1
• wks
• wma
• wmv
• xlc
• xlm
• xls
• xlsb
• xlsm
• xlsx
• xlt
• xltm
• xltx
• xlw
• zip

Für ihre ordnungsgemäße Ausführung sind die folgenden zusätzlichen Komponenten erforderlich:

• %All Users Profile%\run.txt → Detected as Trojan.Win32.SHELLINJECT.YPCHDT
• %All Users Profile%\abc.jpg

Es macht Folgendes:

• Checks if these files are existing:
  • %Windows%\hhhpp1999
  • %Windows%\hhhpp011
• It will only proceed with its encryption routine if the current day is Thursday or Friday
• It avoids encrypting the C drive
• It uses the following credentials to brute-force vulnerable systems:
  • P@ssw0rd
  • Admin123
  • sa123@
  • sa@1
  • sa12345!
  • 525464
  • sa123
  • sa@1234
  • Sa123
  • 123
  • sa@123
  • admin@123
  • sss
  • sql@123
  • enter
  • Password@123
  • 12345
  • sa
  • 1234
  • root@123
  • abc@123
  • server
  • P@$$w0rd
  • password@123
  • Password123
  • regent
  • admin
  • Pa$$w0rd
  • 123456
  • test@123
  • matrix
  • sql@1234
  • test
  • Password1
  • admin123
  • sql2008
  • Passw0rd
  • smooth
  • Pa55w0rd
  • 123456789
  • user
  • Test@123
  • root
  • scott
  • Passw0rd11
  • sa@2017
  • manager
  • p@$$w0rd
  • p@ssw0rd
  • system
  • Password@
  • sasa
  • sa1
  • admin1234
  • a
  • sa1234
  • TEST
  • caonima
  • 1122334455
  • password
  • apollo
  • 987654321
  • college
  • star
  • P@ssw0rd!!!
  • sql
  • P@ssword
  • Password@1234
  • abcd1234
  • 54321
  • test123
  • sa123456!
  • pass
  • sasasasa
  • 321321
  • Changeme_123
  • 1QAZ2wsx
  • 1qaz@wsx
  • !QAZ2wsx
  • Passw0rd321
  • Aa123456.
  • p@ssw0rd!
  • P@ssw0rd123
  • 123.com
  • aaaAAA111
  • abc123456
  • Password@1
  • P@ssw0rd@123
  • 1qaz@WSX
  • P@$$w0rd1234
  • qwe123!@#
  • Melbourne@719%
  • 123.
  • password01!
  • jlkdkfdj34#$
  • 101010
  • smart
  • 123456123
  • 9379992
  • saas
  • 1234567890
  • root123
  • 222222
  • 1
  • toshiba
  • 159951
  • P@ssword1
  • P@ssw0rd1
  • admin123456
  • 123!@#qwe
  • 9999
  • 1qazXSW@
  • brain
  • password@12345
  • letmein
  • 123123
  • p@ssw0rd123
  • 123abc
  • adminadmin
  • abc.123
  • zxcvbn
  • Passw0rd!
  • aaaaaa
  • security
  • a123456
  • sa2017
  • qqq111
  • asd123!
  • 1980
  • qwerty123
  • pa$$w0rd
  • PASSWORD
  • football
  • welcome
  • 12
  • 21
  • 321
  • 123321
  • 111111
  • 654321
  • 666666
  • 121212
  • 000000
  • 888888
  • 1111
  • 555555
  • 1234567
  • 12345678
  • abc123
  • abcd@1234
  • p@ssword
  • P@SSWORD
  • P@SSW0RD
  • P@$$word
  • iloveyou
  • monkey
  • login
  • passw0rd
  • master
  • hello
  • qazwsx
  • password1
  • qwerty
  • baseball
  • qwertyuiop
  • superman
  • 1qaz2wsx
  • fuckyou
  • 123qwe
  • love
  • administrator
  • 123123123
  • 88888888
  • 111111111
  • 112233
  • 123456a
  • 5201314
  • 1q2w3e4r
  • qwe123
  • a123456789
  • 123456789a
  • dragon
  • sunshine
  • princess
  • !@#$%^&*
  • charlie
  • aa123456
  • Aa123456
  • homelesspa
  • 1q2w3e4r5t
  • sql2005
  • sa2008
  • abc
  • abcdefg
  • sapassword
  • Aa12345678
  • ABCabc123
  • sqlpassword
  • 1qaz!QAZ
  • ksa8hd4m@~#$%^&*()
  • 4yqbm4m`~!@~#$%^&*().;
  • 4yqbm4m`~!@~#$%^&*().;
  • A123456
  • database
  • saadmin
  • sql2000
  • sql123
  • sasasa
  • adminsa
  • sql2010
  • sa12345
  • sa123456
  • sqlpass