Ransom.Win32.BLACKBASTA.THBBHBC

This Ransomware may be unknowingly downloaded by a user while visiting malicious websites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Ransomware drops the following files:

• %User Temp%\fkdjsadasd.ico
• {All Affected Drives}\instructions_read_me.txt
• {All Affected Folders}\instructions_read_me.txt

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• %System%\cmd.exe /c %Windows%\SysNative\vssadmin.exe delete shadows /all /quiet
• %System%\cmd.exe /c start /MAX notepad.exe c:\instructions_read_me.txt

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• ofijweiuhuewhcsaxs.mutex

Other Details

This Ransomware does the following:

• It displays "ESET" as its legal copyright and "ESET Update Reminder" as its product name to evade detection
  It encrypts files found in the following drive types:
  • Fixed drive
  • Network drive
  • RAM Disks
  
  It changes the icon of all encrypted files using the file "fkdjsadasd.ico"
  It accepts the following parameters:
  • -bomb
  • -killservices
  • -killprocesses
  • -forceprivate
  • -forcepath
  • -nomutex
  • -disablewhitelist
  • -file
  • -threads

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• instructions_read_me.txt
• fkdjsadasd.ico
• NTUSER.DAT

It avoids encrypting files with the following strings in their file path:

• $Recycle.Bin
• Windows
• Local Settings
• Application Data
• Boot

It appends the following extension to the file name of the encrypted files:

• .vokou2s5g

It drops the following file(s) as ransom note:

• {Infected Drive\Folders}\instructions_read_me.txt
  

It avoids encrypting files with the following file extensions:

• .vokou2s5g