TSPY_RANSOM.IUV

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It employs registry shell spawning by adding certain registry entries. This allows this malware to execute even when other applications are opened.

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This spyware drops the following copies of itself into the affected system:

• %User Temp%\vQVykYApjMM758B.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Alcmeter = "%User Temp%\vQVykYApjMM758B.exe"

It employs registry shell spawning to ensure its execution when certain file types are accessed by adding the following entries:

HKEY_CLASSES_ROOT\ZIBXKKHVYMVCCPW\shell\
open\command
{default} = "%User Temp%\vQVykYApjMM758B.exe"

HKEY_CLASSES_ROOT\Applications\vQVykYApjMM758B.exe\
shell\open\command
{default} = "%User Temp%\vQVykYApjMM758B.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ZIBXKKHVYMVCCPW\shell\open\
command
{default} = "%User Temp%\vQVykYApjMM758B.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\vQVykYApjMM758B.exe\shell\
open\command
{default} = "%User Temp%\vQVykYApjMM758B.exe"

Other System Modifications

This spyware adds the following registry entries as part of its installation routine:

HKEY_CLASSES_ROOT\ZIBXKKHVYMVCCPW\DefaultIcon
{default} = "%User Temp%\vQVykYApjMM758B.exe,0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
FileExts\.EnCiPhErEd\OpenWithList
a = "vQVykYApjMM758B.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ZIBXKKHVYMVCCPW\DefaultIcon
{default} = "%User Temp%\vQVykYApjMM758B.exe,0"

It adds the following registry keys as part of its installation routine:

HKEY_CLASSES_ROOT\.EnCiPhErEd

HKEY_CLASSES_ROOT\ZIBXKKHVYMVCCPW

HKEY_CLASSES_ROOT\Applications\vQVykYApjMM758B.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
FileExts\.EnCiPhErEd

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.EnCiPhErEd

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ZIBXKKHVYMVCCPW

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Applications\vQVykYApjMM758B.exe

NOTES:

It encrypts files with the following file extensions:

• *.1cd
• *.3gp
• *.ac3
• *.ape
• *.avi
• *.bmp
• *.cdr
• *.cer
• *.dbf
• *.divx
• *.djvu
• *.doc
• *.docx
• *.dwg
• *.flac
• *.flv
• *.gif
• *.gzip
• *.htm
• *.html
• *.ifo
• *.jpeg
• *.jpg
• *.kwm
• *.lnk
• *.m2v
• *.max
• *.mdb
• *.mdf
• *.mkv
• *.mov
• *.mp3
• *.mp4
• *.mpeg
• *.mpg
• *.odt
• *.p12
• *.pdf
• *.pfx
• *.png
• *.ppt
• *.pptx
• *.psd
• *.pwm
• *.rar
• *.tar
• *.torrent
• *.txt
• *.vob
• *.wav
• *.wma
• *.wmv
• *.xls
• *.xlsx
• *.zip

It creates the file HOW TO DECRYPT FILES.txt on all folders where there is an encrypted file.

When the encrypted files are accessed, the following message boxes are displayed:

In order to restore the files, the user must pay a ransom to receive the password.

The user is alloted to 5 attempts only. When the user exceeds attempts to enter the correct password, the dropped copy is deleted and the files can't be restored anymore.