RANSOM_PENDOR.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

It encrypts files with specific file extensions. It encrypts files found in specific folders.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {Directory of malicious file}\nope.bin
• {Directory of malicious file}\pendor.exe -> Used as the decryptor
• {Directory of malicious file}\error.ico -> Icon for encrypted files
• {Directory of malicious file}\instruction.txt -> Ransom note
• {Directory of malicious file}\pendor_key.txt -> Contains UniqueID of victim
• {Directory of malicious file}\scvhsot.exe -> connects to the C&C server
• %UserProfile%\K3Log.txt -> Installation date

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CLASSES_ROOT\Pendor\DefaultIcon
{Default} = {Directory of malicious file}\error.ico

HKEY_CLASSES_ROOT\Pendor\shell\
open\command
{Default} = "{Directory of malicious file}\pendor.exe" "%1"

HKEY_CLASSES_ROOT\Pendor
{Default} =

HKEY_CLASSES_ROOT\.PNR
{Default} = Pendor

Other Details

This Ransomware connects to the following website to send and receive information:

• http://{BLOCKED}fnxh.onion/gt.php?h={Unique ID}&k={Unique Key}

It does the following:

• The ransom note can also be viewed by running the {Directory of malicious file}\pendor.exe
  
  
  
• This Ransomware executes the following commands:
  • {Directory of malicious file}\svchsot.exe "http://pendor4cys5ofnxh.onion/gt.php?h={Unique ID}&k={Unique Key}"
  • {Directory of malicious file}\pendor.exe "kill "{Directory of malicious file}\{Malware filename}.exe""
  • taskkill /F /IM {Directory of malicious file}\scvhsot.exe

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .doc
• .docx
• .xls
• .xlsx
• .ppt
• .pptx
• .pst
• .ost
• .msg
• .eml
• .vsd
• .vsdx
• .csv
• .rtf
• .wks
• .wk1
• .pdf
• .dwg
• .onetoc2
• .snt
• .jpeg
• .jpg
• .docb
• .docm
• .dot
• .dotm
• .dotx
• .xlsm
• .xlsb
• .xlw
• .xlt
• .xlm
• .xlc
• .xltx
• .xltm
• .pptm
• .pot
• .pps
• .ppsm
• .ppsx
• .ppam
• .potx
• .potm
• .edb
• .hwp
• .sxi
• .sti
• .sldx
• .sldm
• .vdi
• .vmdk
• .vmx
• .gpg
• .aes
• .ARC
• .PAQ
• .bz2
• .tbk
• .bak
• .tar
• .tgz
• .gz
• .7z
• .rar
• .zip
• .backup
• .iso
• .vcd
• .bmp
• .png
• .gif
• .raw
• .cgm
• .tif
• .tiff
• .nef
• .psd
• .ai
• .svg
• .djvu
• .m4u
• .m3u
• .mid
• .wma
• .flv
• .3g2
• .mkv
• .3gp
• .mp4
• .mov
• .avi
• .asf
• .mpeg
• .vob
• .mpg
• .wmv
• .fla
• .swf
• .wav
• .mp3
• .sh
• .class
• .jar
• .java
• .rb
• .asp
• .php
• .jsp
• .brd
• .sch
• .dch
• .dip
• .pl
• .vb
• .vbs
• .ps1
• .bat
• .cmd
• .js
• .asm
• .h
• .pas
• .cpp
• .ÿÿÿÿ
• .c
• .cs
• .suo
• .sln
• .ldf
• .mdf
• .ibd
• .myi
• .myd
• .frm
• .odb
• .dbf
• .db
• .mdb
• .accdb
• .sql
• .sqlitedb
• .sqlite3
• .asc
• .lay6
• .lay
• .mml
• .sxm
• .otg
• .odg
• .uop
• .std
• .sxd
• .otp
• .odp
• .wb2
• .slk
• .dif
• .stc
• .sxc
• .ots
• .ods
• .3dm
• .max
• .3ds
• .uot
• .stw
• .sxw
• .ott
• .odt
• .pem
• .p12
• .csr
• .crt
• .key
• .pfx
• .der

It encrypts files found in the following folders:

• %UserProfile%
• {All fixed and remote drives except for System Root}

It appends the following extension to the file name of the encrypted files:

• .pnr