TROJ_RANSOM.EJH

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\{GUID}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It executes then deletes itself afterward.

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{GUID} = "%Application Data%\{GUID}.exe"

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}.{BLOCKED}.59.55/knock?uid={value}&os={value}&partner_id={value}&hostname={value}&account={value}&language={value}&codepage={value}

NOTES:
It copies all the registry entries of HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot into HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot0. It then tries to delete the registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot.