RANSOM_HIDDENTEARCRYMORE.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files found in specific folders.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %AppDataLocal%\CryMore\{Malware name}_Url_{Random string}\1.0.0.0\user.config

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Ransomware does the following:

• This ransomware avoids encrypting folders with hidden attribute.

Ransomware Routine

This Ransomware encrypts files found in the following folders:

• C:\Users\TMC\Desktop\testcd

It avoids encrypting files with the following strings in their file name:

• .jar
• .sys
• .exe
• .vbs
• .dll
• .lnk
• .encrypt
• {files with no extension}

It avoids encrypting files with the following strings in their file path:

• :\Windows
• :\Programmes
• :\Program Files
• ProgramData

It appends the following extension to the file name of the encrypted files:

• .encrypt

NOTES:

It displays the following window when encrypting files:

It displays the following window as its ransom note: