Ransom.Win64.RARA.THAABAH

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following non-malicious files:

• %Application Data%\{5 characters}\public.key
• %Application Data%\{5 characters}\private.enc
• %Desktop%\PERSONAL-ID.txt

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %Application Data%\{5 characters}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {5 characters}

Process Termination

This Ransomware terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• msftesql.exe
• sqlagent.exe
• qlbrowser.exe
• sqlservr.exe
• sqlwriter.exe
• oracle.exe
• ocssd.exe
• dbnsmp.exe
• synctime.exe
• mydesktopqos.exe
• agntsvc.exe
• isqlplussvc.exe
• xfssvccon.exe
• mydesktopservice.exe
• ocautopds.exe
• encsvc.exe
• firefoxconfig.exe
• tbirdconfig.exe
• ocomm.exe
• mysqld.exe
• mysqld-nt.exe
• mysqld-opt.exe
• dbeng50.exe
• sqbcoreservice.exe
• excel.exe
• infopath.exe
• msaccess.exe
• mspub.exe
• onenote.exe
• outlook.exe
• powerpnt.exe
• steam.exe
• thebat.exe
• thebat64.exe
• thunderbird.exe
• visio.exe
• winword.exe
• wordpad.exe

Information Theft

This Ransomware gathers the following data:

• Username
• Workgroup
• Locale Information
• Volume Information
• IP address
• Installed Security Applications

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• {BLOCKED}vkxg.onion.to/hello

Other Details

This Ransomware connects to the following possibly malicious URL:

• {BLOCKED}o.co/1F7w27

It does the following:

• It disables system recovery, and deletes shadow volume copies using the following commands:
  • vssadmin.exe Delete Shadows /All Quiet
  • bcdedit.exe /set {default} recoveryenabled No
  • bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
• It avoids encrypting files with the following extensions:
  • ani
  • cab
  • cpl
  • cur
  • diagcab
  • diagpkg
  • dll
  • drv
  • hlp
  • icl
  • icns
  • ico
  • ics
  • lnk
  • key
  • idx
  • mod
  • mpa
  • msc
  • msp
  • msstyles
  • msu
  • nomedia
  • ocx
  • prf
  • rom
  • rtp
  • scr
  • shs
  • spl
  • sys
  • theme
  • themepack
  • exe
  • bat
  • cmd
  • {5 characters}
  • tmp
• It checks if the following applications are installed in the affected system:
  • AVP.exe
  • ekrn.exe
  • avgnt.exe
  • ashDisp.exe
  • NortonAntiBot.exe
  • Mcshield.exe
  • avengine.exe
  • cmdagent.exe
  • smc.exe
  • persfw.exe
  • pccpfw.exe
  • fsguiexe.exe
  • cfp.exe
  • msmpeng.exe
  • MBAMService.exe
• It encrypts files in all available drives.

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• thumbs.db

It avoids encrypting files found in the following folders:

• tmp
• winnt
• Application Data
• AppData
• Program Files(x86)
• Program Files
• temp
• $Recycle.Bin

It renames encrypted files using the following names:

• {base64 encoded string of original file name and extension}.{5 characters}

It drops the following file(s) as ransom note:

• %Desktop%\README IMPORTANT.html