RANSOM_HIDDENTEARNZMR.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It is capable of encrypting files in the affected system.

It encrypts files with specific file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Ransomware sets the system's desktop wallpaper to the following image:

Download Routine

This Ransomware connects to the following URL(s) to download its component file(s):

• http://i.{BLOCKED}r.com/y8q3H4q.jpg

It saves the files it downloads using the following names:

• %User Profile%/ransom.jpg <- Ransom note

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Other Details

This Ransomware does the following:

• This Ransomware connects to the following malicious URL to create and send encryption keys:
  • http://{BLOCKED}vv2z7lassu.onion.link/ed2/createkeys.php
  • http://{BLOCKED}vv2z7lassu.onion.link/ed2/savekey.php

It is capable of encrypting files in the affected system.

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .txt
• .doc
• .docx
• .xls
• .xlsx
• .c
• .ppt
• .pptx
• .odt
• .jpg
• .png
• .csv
• .sql
• .mdb
• .sln”
• .php
• .asp
• .aspx
• .html
• .xml
• .psd
• .mp4
• .avi
• .mpeg
• .py
• .vbs

It appends the following extension to the file name of the encrypted files:

• {Filename.extension}.nzmr