RANSOM_MADLOCKER.BYZ

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware creates the following folders:

• %User Profile%\Documents\XXX

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Download Routine

This Ransomware accesses the following websites to download files:

• https://blog.{BLOCKED}ebytes.com/wp-content/uploads/2016/01/dma_english.png

It saves the files it downloads using the following names:

• %User Profile%\Documents\XXX\obvestilo.png

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Other Details

This Ransomware does the following:

• Displays the following message box if %User Profile%\Documents\XXXis not existing:
  
• Displays the following message box if %User Profile%\Documents\XXX is existing:
  
• Displays obvestilo.png:
  
• It renames files found in %User Profile%\Documents from {original filename with extension} to XXX_{original filename with extension}
• It does not encrypt files.