RANSOM_GOOPIC.A

This Trojan modifies Internet Explorer security settings. This puts the affected computer at greater risk, as it allows malicious URLs to be accessed by the computer.

It gathers certain information on the affected computer.

It connects to certain websites to send and receive information.

Arrival Details

This malware arrives via the following means:

• Rig exploit kit

Installation

This Trojan drops the following file(s)/component(s):

• %Application Data%\Bunch.jVk
• %Application Data%\Purificator.YKM
• %Application Data%\NsResize.dll
• %User Temp%\ns{random value}.tmp\System.dll

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system:

• %AppDataLocal%\service.exe

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Services = "%AppDataLocal%\service.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap\EscDomains\googleapis.com

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap\AutoDetect

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap\EscDomains\googlecode.com

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\GooglePic\
PCB

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap\EscDomains\bootstrapcdn.com

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap\EscDomains\exodus99.ru

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap\UNCAsIntranet

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap\EscDomains\jqueryscript.net

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap\EscDomains\bdimg.com

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\GooglePic
PCB = {value}

Web Browser Home Page and Search Page Modification

This Trojan modifies Internet Explorer zone settings.

Information Theft

This Trojan gathers the following information on the affected computer:

• BIOS
• DiskDrive
• CPU Name
• Processor
• Video Controller

Other Details

This Trojan connects to the following website to send and receive information:

• {BLOCKED}99.ru
  ip: {BLOCKED}.{BLOCKED}.40.157

It renames encrypted files using the following names:

• {Original Filename}.LOCK

It does the following:

• It deletes shadow copies by executing the following command:
  vssadmin.exe Delete Shadows /All /Quiet