Ransom.PS1.VULPIX.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It encrypts files found in specific folders. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Dropping Routine

This Ransomware drops the following files:

• {Malware Path}\Vulpixlist.txt → contains a text of the path of the ransom note
  

Other Details

This Ransomware does the following:

• It avoids encrypting files with attributes set to HIDDEN.
• It overwrites the content of the target files using the following format:
  • {Encrypted Data}{"ASTRID"}{Encryption Key Length}{Encryption IV Length}{Encryption Key}{Encryption IV}
• It displays a fixed window while encrypting files:
  

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .doc
• .docx
• .jpeg
• .pdf
• .sql
• .xls
• .xlsx

It encrypts files found in the following folders:

• C:\Adata → including subfolders

It appends the following extension to the file name of the encrypted files:

• .vulpix

It drops the following file(s) as ransom note:

• C:\Adata\VulpixReadMe.txt