RANSOM_POGOTEAR.B

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It deletes itself after execution. It gathers information and reports it to its servers.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by other malware.

Installation

This Trojan adds the following processes:

• cmd.exe", "/C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del " + {malware path}
• C:\Users\{username}\Downloads\Pokemon\Pokemon.exe

Other System Modifications

This Trojan sets the system's desktop wallpaper to the following image:

• %User Profile%\Downloads\Pokemon\bg.jpg-serves as ransom note

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Dropping Routine

This Trojan drops the following files:

• %User Profile%\Downloads\Pokemon\key.pkm-contains the generated public key
• %User Profile%\Downloads\Pokemon\Pokemon\total.pkm-contains total number of encrypted files

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Other Details

This Trojan encrypts files with the following extensions:

• .bak
• .mdf
• .sql
• .cs
• .php
• .xls
• .doc
• .xlsx
• .docx
• .zip
• .rar
• .7z
• .tar.bz2
• .tar
• .cab
• .iso
• .dat
• .mdb
• .db
• .sqlite
• .csv
• .s3db
• .sqlitedb
• .dbf
• .myd
• .ibd
• .ibz
• .xlt
• .ppt
• .pptx
• .backup
• .3ds
• .pdf
• .eps
• .psd
• .psb
• .acbl
• .cdr
• .txt
• .xml
• .pst
• .jpg
• .jpeg
• .bmp
• .JPG
• .JPEG
• .BMP
• .cpr
• .all
• .rns
• .pptx
• .xltx
• .png
• .PNG
• .GIF
• .gif
• .dwg
• .der
• .crt
• .cer

It does the following:

• It encrypts files in drives with the following file types:
  • Fixed
  • Network
  • Removable
  • Ram
• Send the generated public key and request private key to the following URL:
  • http://downloadfiles.{BLOCKED}f.com/generate.php
• Stops services with "SQL" string in their names
• Sends the gathered information to the following URL:
  • http://downloadfiles.{BLOCKED}f.com/complete.php
• Requires its other components to execute properly:
  • Pokemon.exe
  • bg.jpg
  • pok.wav

It deletes itself after execution.

It gathers the following information and reports it to its servers:

• Public Key
• UserName
• MachineName
• OS Pruduct Name and version
• Processor version and manufacturer
• Drive Names and Total Capacity in GigaBytes