TROJ_CRILOCK.ER

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• {Path Name}\README TO UNLOCK.txt
• %User Temp%\Email.pdf - it will be also executed
• {Path Name}\READMETOUNLOCK.txt
• %User Temp%\MailMessage.exe - detected as TROJ_CRILOCK.ER
• %User Temp%\{variable name 1}.exe - detected as TROJ_CRILOCK.ER

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It leaves text files that serve as ransom notes containing the following:

• ** Your files have been locked and encrypted with a unique RSA-2048 key! **
  To unlock your files/data:
  1. Download and install the Tor browser from:
  https://www.torproject.org/projects/torbrowser.html.en
  2. Now go to:
  http://{BLOCKED}54x5f3.onion
  (From within the Tor browser)
  Follow the instructions. You will then receive the decryption key (password) and decryptor within 12 hours.
  BEWARE - this is NOT a virus.
  The ONLY way to get your files back is to pay for the decryptor + decryption key (password).
  Guaranteed recovery is provided within 10 days.
  ** Your ID# is {ID} **

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{variable name 2} = "%User Temp%\{variable name 1}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CLASSES_ROOT\.{variable name 3}

HKEY_CLASSES_ROOT\{variable name 4}

HKEY_CLASSES_ROOT\{variable name 4}\DefaultIcon

HKEY_CLASSES_ROOT\{variable name 4}\shell\
open\command

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.{variable name 3}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{variable name 4}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{variable name 4}\DefaultIcon

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{variable name 4}\shell\open\
command

It adds the following registry entries:

HKEY_CLASSES_ROOT\.{variable name 3}
(Default) = "{variable name 4}"

HKEY_CLASSES_ROOT\{variable name 4}
(Default) = "LOCKED"

HKEY_CLASSES_ROOT\{variable name 4}\DefaultIcon
(Default} = "%User Temp%\{variable name 1}.exe,0"

HKEY_CLASSES_ROOT\{variable name 4}\shell\
open\command
(Default) = "%User Temp%\{variable name 1}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.{variable name 3}
(Default) = "{variable name 4}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{variable name 4}
(Default) = "LOCKED"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{variable name 4}\DefaultIcon
(Default) = "%User Temp%\{variable name 1}.exe,0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{variable name 4}\shell\open\
command
(Default) = "%User Temp%\{variable name 1}.exe"

Other Details

This Trojan encrypts files with the following extensions:

• *.1cd
• *.3gp
• *.7z
• *.ac3
• *.accdb
• *.ai
• *.ape
• *.avi
• *.bmp
• *.cdr
• *.cdr
• *.cer
• *.csv
• *.dbf
• *.dcr
• *.divx
• *.djvu
• *.doc
• *.docx
• *.dwg
• *.dwg
• *.dxf
• *.dxg
• *.eps
• *.epub
• *.flac
• *.flv
• *.gif
• *.gzip
• *.htm
• *.html
• *.ifo
• *.indd
• *.iso
• *.jpeg
• *.jpg
• *.kdc
• *.kwm
• *.m2v
• *.max
• *.md
• *.mdb
• *.mdf
• *.mkv
• *.mov
• *.mp3
• *.mp4
• *.mpeg
• *.mpg
• *.odt
• *.p12
• *.p7b
• *.p7c
• *.pdf
• *.pfx
• *.png
• *.pps
• *.ppt
• *.pptm
• *.pptx
• *.psd
• *.pst
• *.pwm
• *.qbb
• *.qbw
• *.rar
• *.raw
• *.tar
• *.tif
• *.torrent
• *.txt
• *.vob
• *.wav
• *.wma
• *.wmv
• *.wpd
• *.xls
• *.xlsx
• *.zip

It renames encrypted files using the following names:

• {filename and extension}.CRYPTOLOCKER

NOTES:

This Trojan also encrypts files from the following drives and sub-folders:

• {removable drive}
• {network drive}
• {physical drive}

It may show the following message once a computer is infected the machine or when a user clicks on an encrypted file:

Variable names may vary depending on the files detected as TROJ_CRILOCK.ER. Some of the variables are the following:

• {variable name 1 }
  • hfqKbCfdb5R9xA9
  • voU3Rc5y67MY4tU
• {variable name 2}
  • Alcmeter
  • winserveupd
• {variable name 3}
  • LOCKED
  • CRYPTOLOCKER
• {variable name 4}
  • TMDCHXKKVCVJWNI
  • PUGTKOTUDANZZVG