Ransom.Win32.FCRYPT.THBAAAI

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\{8random characters}.bat;
• %User Temp%\qb{6random characters}.{2random characters}\delsc.vbs;
• %User Temp%\qb{6random characters}.{2random characters}\FCrypt.txt.tmp;
• %User Temp%\qb{6random characters}.{2random characters}\FCRYPT_RSA_PUBLIC_KEY.TMP;
• %User Temp%\qb{6random characters}.{2random characters}\gpg.exe;
• %User Temp%\qb{6random characters}.{2random characters}\gpg-agent.exe;
• %User Temp%\qb{6random characters}.{2random characters}\libassuan-0.dll;
• %User Temp%\qb{6random characters}.{2random characters}\libgcrypt-20.dll;
• %User Temp%\qb{6random characters}.{2random characters}\libgpg-error-0.dll;
• %User Temp%\qb{6random characters}.{2random characters}\libgpgme-11.dll;
• %User Temp%\qb{6random characters}.{2random characters}\libksba-8.dll;
• %User Temp%\qb{6random characters}.{2random characters}\libnpth-0.dll;
• %User Temp%\qb{6random characters}.{2random characters}\libsqlite3-0.dll;
• %User Temp%\qb{6random characters}.{2random characters}\md5.exe;
• %User Temp%\qb{6random characters}.{2random characters}\svchost.exe;
• %User Temp%\qb{6random characters}.{2random characters}\zlib1.dll;
• %User Temp%\FCRYPT.KEY;
• %User Temp%\#HELP-DECRYPT-FCRYPT1.1#.txt;
• %User Temp%\FCRYPT_VICTIM.TMP;
• %Desktop%\#HELP-DECRYPT-FCRYPT1.1#.txt;

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista, 7, and 8.)

It adds the following processes:

• cmd.exe /c ""%User Temp%\{8random characters}.bat" {malware filename}.exe"
• %User Temp%\qb{6random characters}.{2random characters}\svchost.exe -e {random generated md5 hash} "{target file}" "{targetfile}.FCrypt" - for every file targeted

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It creates the following folders:

• %User Temp%\qb{6random characters}.{2random characters}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

Other System Modifications

This Ransomware deletes the following files:

• %User Temp%\{8random characters}.bat;
• %User Temp%\qb{6random characters}.{2random characters}\delsc.vbs;
• %User Temp%\qb{6random characters}.{2random characters}\FCrypt.txt.tmp;
• %User Temp%\qb{6random characters}.{2random characters}\FCRYPT_RSA_PUBLIC_KEY.TMP;
• %User Temp%\qb{6random characters}.{2random characters}\gpg.exe;
• %User Temp%\qb{6random characters}.{2random characters}\libgpgme-11.dll;
• %User Temp%\qb{6random characters}.{2random characters}\libksba-8.dll;
• %User Temp%\qb{6random characters}.{2random characters}\libsqlite3-0.dll;
• %User Temp%\qb{6random characters}.{2random characters}\md5.exe;
• %User Temp%\qb{6random characters}.{2random characters}\svchost.exe;
• %User Temp%\qb{6random characters}.{2random characters}\zlib1.dll;

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
FCRYPT\Shell\Open\
Command

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
FCRYPT\DefaultIcon
{default} = C:\Windows\System32\shell32.dll,-48

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.FCrypt
{default} = FCRYPT

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
FCRYPT1 = notepad %User Temp%\#HELP-DECRYPT-FCRYPT1.1#.txt"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
FCRYPT2 = attrib -h C:\Users\dyituser_732\Desktop\#HELP-DECRYPT-FCRYPT1.1#.txt

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
FCRYPT3 = copy %User Temp%\#HELP-DECRYPT-FCRYPT1.1#.txt %Desktop%\#HELP-DECRYPT-FCRYPT1.1#.txt

Other Details

This Ransomware does the following:

• The malware changes the icon of the files it encrypts
  
• Upon opening an encrypted file, a message box appears
  

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .xls
• .doc
• .xlsx
• .docx
• .pdf
• .rtf
• .cdr
• .psd
• .dwg
• .cd
• .mdb
• .1cd
• .dbf
• .sqlite
• .jpg
• .jpeg
• .zip
• .bmp
• .txt
• .rar
• .mp4
• .sql
• .c
• .cpp
• .java
• .php
• .asp
• .svg
• .psd
• .bak
• .html

It appends the following extension to the file name of the encrypted files:

• .Fcrypt

It drops the following file(s) as ransom note:

• %Desktop%\#HELP-DECRYPT-FCRYPT1.1#.txt