RANSOM_KAOTEAR.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan leaves text files that serve as ransom notes containing the following:

• 당신의 파일이 암호화 되었습니다.{password}

Dropping Routine

This Trojan drops the following files:

• %Desktop%\ReadMe.txt -Serves as ransom note

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Trojan encrypts files with the following extensions:

• .txt
• .doc
• .docx
• .xls
• .xlsx
• .ppt
• .pptx
• .odt
• .jpg
• .png
• .csv
• .sql
• .mdb
• .hwp
• .pdf
• .php
• .asp
• .aspx
• .html
• .xml
• .psd

It renames encrypted files using the following names:

• {filename of encrypted file}.암호화됨-translated as "encrypted"

It does the following:

• It encrypts the files found in the following directories:
  • %Desktop%\
  • %Desktop%\{subfolders}\

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It deletes itself after execution.

NOTES:

It displays the following as Ransom Note:

The text is translated as follows:

Your files have been encrypted.
Go to the following address:
You can check the information for decryption:
http://{BLOCKED}t225dfs5mom.{BLOCKED}n.city
Go to the site above. TOR browser is required

As of this writing the said site is already inaccessible.

It also have the following capabilities which have not been used upon its execution:

• Send the generated password to the following URL:
  • https://www.{BLOCKED}e.com/hidden-tear/write.php?info={random} {password}
• Displays the following:

  식별아이디: ADEFE4B1: 49A860F8: 5D9CF787: B15772D6
  자세한 설명은 아래 링크 참조
  1 - http://{BLOCKED}ao5mom.onion.to
  2 - http://{BLOCKED}5ao5mom.onion.city
  1 - 다운로드 토르브라우져: http://www.torproject.org/projects/torbrowser.html.en
  토르브라우져 다운로드후 아래주소로 접속
  http://t352fwt225ao5mom.onion
  식별아이디를 이용하여 결제
  자세한 내용은 홈페이지에있습니다.
  

The text is translated as follows:

Identification ID: ADEFE4B1: 49A860F8: 5D9CF787: B15772D6
See the link below for further explanation
1 - http://{BLOCKED}25ao5mom.onion.to
2 - http://t352fwt225ao5mom.onion.to
1 - Download Tor Browser: http://www.torproject.org/projects/torbrowser.html.en
Connect to the following address after downloading Tor Browser
http: //t352fwt225ao5mom.onion
Payments using the identification ID
Details are on the website.