Ransom.PS1.FTCODE.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following folders:

• %Public%\OracleKit

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

It drops the following files:

• %User Temp%\quanto00.tmp → contains date/time logs
• %User Temp%\{system generated}.tmp → contains malware's powershell logs
• %Public%\OracleKit\w00log03.tmp → contains GUID

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

It adds the following processes:

• bcdedit /set ijgaxiv bootstatuspolicy ignoreallfailures → disable Windows Error Recovery
• bcdedit /set ijgaxiv → disable Windows Automatic Repair
• wbadmin delete catalog -quiet → delete backup catalog
• wbadmin delete systemstatebackups → delete system state backups
• wbadmin delete backup → delete other backups
• vssadmin delete shadows /all /quiet → delete shadow copies

Autostart Technique

This Ransomware drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

• WindowsApplicationService.lnk

Download Routine

This Ransomware accesses the following websites to download files:

• http://dbi.{BLOCKED}ges.com/?need=aegzfej&vid=dpec22&

It saves the files it downloads using the following names:

• %Public%\Libraries\WindowsIndexingService.vbs

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

Information Theft

This Ransomware attempts to get stored information such as user names, passwords, and hostnames from the following browsers:

• Mozilla Firefox
• Google Chrome
• Internet Explorer

It attempts to steal stored email credentials from the following:

• Microsoft Outlook
• Mozilla Thunderbird

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• http://books.{BLOCKED}lebooks.com/ - updates about ransom routine
• http://stats.{BLOCKED}tudelistproject.org/ - updates about information stealing routine

Other Details

This Ransomware does the following:

• It encrypts drives with free disk space greater than 50MB
• It won't proceed to its encryption routine and terminate itself if the following condition is met:
  • If %User Temp%\quanto00.tmp creation time is less than 30 minutes.
  • If http://books.{BLOCKED}lebooks.com is inaccessible
• It gathers the following information and reports it to its servers:
  • Appended File Extension
  • Encryption Key
  • Error Log
  • GUID
  • Malware Version
  • Number of Encrypted Files
  • Powershell Version
  • Status

However, as of this writing, the said sites are inaccessible.

It adds the following scheduled tasks:

• Task Name: WindowsApplicationService
  • Schedule: DAILY
  • StartTime: 00:00
  • Interval: 15 minutes
  • Duration: 23:59
  • TaskRun: "%Public%\Libraries\WindowsIndexingService.vbs"

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .3fr
• .7z
• .accdb
• .ai
• .apk
• .arch00
• .arw
• .asset
• .avi
• .bar
• .bay
• .bc6
• .bc7
• .bigwallet
• .bik
• .bkf
• .bkp
• .blob
• .bsa
• .cas
• .cdr
• .cer
• .cfr
• .cr2
• .crt
• .crw
• .css
• .csv
• .d3dbsp
• .das
• .dazip
• .db0
• .dba
• .dbf
• .dcr
• .der
• .desc
• .dmp
• .dng
• .doc
• .docm
• .docx
• .dwg
• .dxg
• .epk
• .eps
• .erf
• .esm
• .ff
• .flv
• .forge
• .fos
• .fpk
• .fsh
• .gdb
• .gho
• .hkdb
• .hkx
• .hplg
• .hvpl
• .ibank
• .icxs
• .indd
• .itdb
• .itl
• .itm
• .iwd
• .iwi
• .jpe
• .jpeg
• .jpg
• .js
• .kdb
• .kdc
• .kf
• .layout
• .lbf
• .litemod
• .lrf
• .ltx
• .lvl
• .m2
• .m3u
• .m4a
• .map
• .mcmeta
• .mdb
• .mdbackup
• .mddata
• .mdf
• .mef
• .menu
• .mlx
• .mov
• .mp4
• .mpqge
• .mrwref
• .ncf
• .nrw
• .ntl
• .odb
• .odc
• .odm
• .odp
• .ods
• .odt
• .orf
• .p12
• .p7b
• .p7c
• .pak
• .pdd
• .pdf
• .pef
• .pem
• .pfx
• .pkpass
• .png
• .ppt
• .pptm
• .pptx
• .psd
• .psk
• .pst
• .ptx
• .py
• .qdf
• .qic
• .r3d
• .raf
• .rar
• .raw
• .rb
• .re4
• .rgss3a
• .rim
• .rofl
• .rtf
• .rw2
• .rwl
• .sav
• .sb
• .sid
• .sidd
• .sidn
• .sie
• .sis
• .slm
• .snx
• .sql
• .sr2
• .srf
• .srw
• .sum
• .svg
• .syncdb
• .t12
• .t13
• .tax
• .tor
• .txt
• .upk
• .vcf
• .vdf
• .vfs0
• .vpk
• .vpp_pc
• .vtf
• .w3x
• .wb2
• .wma
• .wmo
• .wmv
• .wotreplay
• .wpd
• .wps
• .x3f
• .xf
• .xlk
• .xls
• .xlsb
• .xlsm
• .xlsx
• .xxx
• .zip
• .ztmp

It appends the following extension to the file name of the encrypted files:

• .{6 random characters}

It drops the following file(s) as ransom note:

• {Encrypted Directory}\READ_ME_NOW.htm