Ransom.Win32.JOBCRYPTER.THOAAGAI

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It gathers certain information on the affected computer.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops and executes the following files:

• %Application Data%\nlo.exe -> copy of itself

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.)

It drops the following non-malicious files:

• %User Temp%\1.png
• %User Temp%\2.png
• %User Temp%\Screen.jpg ->screen capture of the affected system

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
JOJA = %Application Data%\nlo.exe

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software
MOI = {67 random digits} -> deleted once files have been encrypted

HKEY_CURRENT_USER\Software
1 = 1

It sets the system's desktop wallpaper to the following image:

• %User Temp%\2.png
  

Information Theft

This Ransomware gathers the following information on the affected computer:

• Volume Serial Number
• Running Processes
• Machine Name

Stolen Information

This Ransomware sends the data it gathers to the following email addresses via SMTP:

• Host: auth.smtp.1and1.fr
• Email address: {BLOCKED}24@gmail.com

Other Details

This Ransomware does the following:

• It encrypts files in all available drives
• It sleeps when it finds AvastSvc process running in the affected computer
• The email it sends out contains the following:
  
  • Subject:
    V3.1 New Client {Volume Serial Number}
  • Body:
    "------Process List------\r\n{process 1} | \r\n{process 2} | ... | \r\n------------------------\r\nSerial Number: {67 random numbers}"
  • Attachment:
    Screen capture (%User Temp%\Screen.jpg)
  • From:
    {BLOCKED}c@sagform.fr "{Machine Name}"
• It displays the following:
  
• Encrypted files contain a ransom note prepended before the actual encrypted file:
  

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• boot.ini
• autoexec.bat
• Bootfont.bin
• config.sys
• io.sys
• msdos.sys
• ntdetect.com
• ntldr
• pagefile.sys
• desktop.ini
• Google Chrome.lnk
• Mozilla Firefox.lnk
• Internet Explorer.lnk
• Locker.exe
• .css

It avoids encrypting files with the following strings in their file path:

• Program Files
• Windows

It renames encrypted files using the following names:

• {encrypted file}.css

It drops the following file(s) as ransom note:

• %Desktop%\Comment débloquer mes fichiers .txt
• %User Startup%\Readme.txt
  however the malware encountered an exception in its code while writing the contents of the note, hence these files contain nothing

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista, 7, and 8.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows XP, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)