Ransom.Win32.EVILANT.THAOBBD

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It steals certain information from the system and/or the user.

It encrypts files found in specific folders.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• C:\Users\{Username}\Desktop\custom_wallpaper.jpg → used to change the Desktop's wallpaper.

It drops the following component file(s):

• %User Temp%\_MEI[Random Numbers}\{Python Component Files}
• %User Temp%\_{Random Characters}
• %User Temp%\tmp{Random Characters}\gen_py\__init__.py
• %User Temp%\tmp{Random Characters}\gen_py\dicts.dat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• powershell "REG ADD \"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\" /v DisableAntiSpyware /t REG_DWORD /d 1 /f" → if the malware is executed on Windows 7.
• powershell "Set-MpPreference -DisableRealtimeMonitoring $true" → if the malware is not executed on Windows 7.

Other System Modifications

This Ransomware modifies the following registry entries:

If running on Windows 7:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

(Note: The default value data of the said registry entry is 0.)

If running on Windows 7 and after decryption routine:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 0

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = C:\Users\{Username}\Desktop\custom_wallpaper.jpg

(Note: The default value data of the said registry entry is {Default Image Filename}.)

Information Theft

This Ransomware steals the following information:

• System's IP Address
• OS Information

Other Details

This Ransomware connects to the following URL(s) to get the affected system's IP address:

• https://{BLOCKED}n.org/ip

It does the following:

• It displays the following message box prompting the user to execute the malware with elevated privileges:
  
• It terminates itself if found running on the following virtual environments by checking the system's processor information:
  
  • Oracle VM Virtualbox
  • VMWare Workstation
  • VMWare Player
  • Microsoft Hyper-V
  • Parallels Desktop
  • KVM/QEMU
  • Xen
  • Windows Hyper-V
• It connects to a Telegram bot using the following API endpoint:
  
  • https://{BLOCKED}egram.org/bot6893451039:{BLOCKED}Y19-RF8rfOKQUSizMAqvr28{BLOCKED}/sendMessage
  • Channel ID = "-1002134979192"
• It sends the following messages and stolen information to the Telegram bot:
  
  • "infected..." → sent after getting the system's IP and OS information.
  • "{System's IP Address} {OS Information} → sent after getting the system's IP address and OS information.
  • "encrypted" → sent after encrypting files and changing the wallpaper.
  • "don't wanna pay" → sent after the user selected Yes in "I don't wanna pay" prompt.
  • "decrypted" → sent after decrypting the files.
• It encrypts files including backup files (.bak).
• After encryption and 14 seconds delay, it sets the Desktop wallpaper using the following image:
  
• It displays a GUI which consists of the following:
  
  • Ransom note
  • 24-hour countdown
  • CPU usage in percent
  • Memory usage in percent
  • Disk usage in percent
  • "how to buy bitcoin" button
  • "I don't wanna pay" button
  • "can i recover my files?" button
  • "I'm safe?" button
  • "help" button
  • "unlock me now" button
  • Textbox to input the unlock key
    
• It opens the following websites if the user clicked the "how to buy bitcoin" button:
  
  • https://en.wikipedia.org/wiki/Bitcoin
  • https://www.binance.com/en/how-to-buy/bitcoin
• It displays the following message box if the user clicked the "I don't wanna pay" button:
  
  • It restarts the system after 0.25 second if the user clicked "Yes".
  • It displays the following message box if the user clicked "No":
    
• It displays the following message box if the user clicked the "can i recover my files?" button:
  
• It displays the following message box if the user clicked the "i'm safe?" button:
  
• It displays the following message box if the user clicked the "help" button:
  
• If the user inputs the correct unlock key and clicked the "unlock me now!" button, it triggers the following decryption routine:
  
  • It decrypts all encrypted files.
  • It displays the following message box:
    
  • It enables the Windows Defender by executing the following processes:
    
    • powershell "REG ADD \"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\" /v DisableAntiSpyware /t REG_DWORD /d 0 /f" → if the malware is executed on Windows 7.
    • powershell "Set-MpPreference -DisableRealtimeMonitoring $false" → if the malware is not executed on Windows 7.
  • It drops the following text file:
    
    • C:\ESD\messagefroms13.txt
      
  • It executes the following process to open the dropped text file:
    
    • "%System%\NOTEPAD.EXE" C:\ESD\messagefroms13.txt
  • It restarts the machine after 11 seconds.
• It displays the following message box if the user clicked the "unlock me now!" button with no input unlock key:
  
• It restarts the system if the 24-hour countdown reaches 00:00:00.
• The GUI updates every second.

Ransomware Routine

This Ransomware encrypts files found in the following folders:

• C:\Users\{Username}\Documents
• C:\Users\{Username}\Videos
• C:\Users\{Username}\Pictures
• C:\Users\{Username}\Downloads
• C:\Users\{Username}\Desktop
• C:\Users\{Username}\Links
• C:\Users\{Username}\OneDrive
• C:\Users\{Username}\Music
• C:\Users\{Username}\Source
• C:\Users\{Username}\Serches
• C:\Users\{Username}\Contacts
• C:\Users\{Username}\Favorites
• D:\
• E:\
• G:\
• H:\
• F:\

It avoids encrypting files with the following strings in their file name:

• s13.exe
• Recycle Bin.exe