Ransom.Win32.EVILANT.THAOBBD

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Roba determinada información del sistema y/o del usuario.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• C:\Users\{Username}\Desktop\custom_wallpaper.jpg → used to change the Desktop's wallpaper.

Este malware infiltra el/los siguiente(s) archivo(s):

• %User Temp%\_MEI[Random Numbers}\{Python Component Files}
• %User Temp%\_{Random Characters}
• %User Temp%\tmp{Random Characters}\gen_py\__init__.py
• %User Temp%\tmp{Random Characters}\gen_py\dicts.dat

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Agrega los procesos siguientes:

• powershell "REG ADD \"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\" /v DisableAntiSpyware /t REG_DWORD /d 1 /f" → if the malware is executed on Windows 7.
• powershell "Set-MpPreference -DisableRealtimeMonitoring $true" → if the malware is not executed on Windows 7.

Otras modificaciones del sistema

Modifica las siguientes entradas de registro:

If running on Windows 7:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

(Note: The default value data of the said registry entry is 0.)

If running on Windows 7 and after decryption routine:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 0

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = C:\Users\{Username}\Desktop\custom_wallpaper.jpg

(Note: The default value data of the said registry entry is {Default Image Filename}.)

Robo de información

Roba la siguiente información:

• System's IP Address
• OS Information

Otros detalles

Hace lo siguiente:

• It displays the following message box prompting the user to execute the malware with elevated privileges:
  
• It terminates itself if found running on the following virtual environments by checking the system's processor information:
  
  • Oracle VM Virtualbox
  • VMWare Workstation
  • VMWare Player
  • Microsoft Hyper-V
  • Parallels Desktop
  • KVM/QEMU
  • Xen
  • Windows Hyper-V
• It connects to a Telegram bot using the following API endpoint:
  
  • https://{BLOCKED}egram.org/bot6893451039:{BLOCKED}Y19-RF8rfOKQUSizMAqvr28{BLOCKED}/sendMessage
  • Channel ID = "-1002134979192"
• It sends the following messages and stolen information to the Telegram bot:
  
  • "infected..." → sent after getting the system's IP and OS information.
  • "{System's IP Address} {OS Information} → sent after getting the system's IP address and OS information.
  • "encrypted" → sent after encrypting files and changing the wallpaper.
  • "don't wanna pay" → sent after the user selected Yes in "I don't wanna pay" prompt.
  • "decrypted" → sent after decrypting the files.
• It encrypts files including backup files (.bak).
• After encryption and 14 seconds delay, it sets the Desktop wallpaper using the following image:
  
• It displays a GUI which consists of the following:
  
  • Ransom note
  • 24-hour countdown
  • CPU usage in percent
  • Memory usage in percent
  • Disk usage in percent
  • "how to buy bitcoin" button
  • "I don't wanna pay" button
  • "can i recover my files?" button
  • "I'm safe?" button
  • "help" button
  • "unlock me now" button
  • Textbox to input the unlock key
    
• It opens the following websites if the user clicked the "how to buy bitcoin" button:
  
  • https://en.wikipedia.org/wiki/Bitcoin
  • https://www.binance.com/en/how-to-buy/bitcoin
• It displays the following message box if the user clicked the "I don't wanna pay" button:
  
  • It restarts the system after 0.25 second if the user clicked "Yes".
  • It displays the following message box if the user clicked "No":
    
• It displays the following message box if the user clicked the "can i recover my files?" button:
  
• It displays the following message box if the user clicked the "i'm safe?" button:
  
• It displays the following message box if the user clicked the "help" button:
  
• If the user inputs the correct unlock key and clicked the "unlock me now!" button, it triggers the following decryption routine:
  
  • It decrypts all encrypted files.
  • It displays the following message box:
    
  • It enables the Windows Defender by executing the following processes:
    
    • powershell "REG ADD \"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\" /v DisableAntiSpyware /t REG_DWORD /d 0 /f" → if the malware is executed on Windows 7.
    • powershell "Set-MpPreference -DisableRealtimeMonitoring $false" → if the malware is not executed on Windows 7.
  • It drops the following text file:
    
    • C:\ESD\messagefroms13.txt
      
  • It executes the following process to open the dropped text file:
    
    • "%System%\NOTEPAD.EXE" C:\ESD\messagefroms13.txt
  • It restarts the machine after 11 seconds.
• It displays the following message box if the user clicked the "unlock me now!" button with no input unlock key:
  
• It restarts the system if the 24-hour countdown reaches 00:00:00.
• The GUI updates every second.