RANSOM_ZCRYPT.B

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %Application Data%\zcrypt.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %Application Data%\cid.ztxt
• %Application Data%\public.key
• %Application Data%\AnimGif.dll
• %Application Data%\CloseKillock.mdR
• %Application Data%\Rifacimento.M

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• zcrypt1.0

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
zcrypt = {path of the executed malware}

It drops the following files:

• {Removable Drive Letter}:\autorun.inf

It drops the following file(s) in the Windows Startup folder to enable its automatic execution at every system startup:

• %User Startup%\zcrypt.lnk

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {Removable Drive Letter}:\System.exe

Other Details

This worm connects to the following possibly malicious URL:

• http://{BLOCKED}rewq.ml/rsa/rsa.php?computerid={victim ID}&private=1

It encrypts files with the following extensions:

• .3fr
• .accdb
• .apk
• .arw
• .aspx
• .avi
• .bak
• .bay
• .bmp
• .cdr
• .cer
• .cgi
• .class
• .cpp
• .cr2
• .crt
• .crw
• .dbf
• .dcr
• .der
• .dng
• .doc
• .docx
• .dwg
• .dxg
• .emlx
• .eps
• .erf
• .gz
• .html
• .indd
• .jar
• .java
• .jpeg
• .jpg
• .jsp
• .kdc
• .log
• .mdb
• .mdf
• .mef
• .mp4
• .mpeg
• .msg
• .nrw
• .odb
• .odp
• .ods
• .odt
• .orf
• .p12
• .p7b
• .p7c
• .pdb
• .pdd
• .pdf
• .pef
• .pem
• .pfx
• .php
• .png
• .ppt
• .pptx
• .psd
• .pst
• .ptx
• .r3d
• .raf
• .raw
• .rtf
• .rw2
• .rwl
• .sav
• .sql
• .srf
• .srw
• .swf
• .tar
• .tar
• .txt
• .vcf
• .wb2
• .wmv
• .wpd
• .xls
• .xlsx
• .xml
• .zip

It renames encrypted files using the following names:

• {original filename}.zcrypt

It does the following:

• Encrypts files in removable drive

However, as of this writing, the said sites are inaccessible.