TROJ_RANSOM.AGY

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %System Root%\ProgramData\{random folder name 2}\{random file name 2}.dlls - contains key
• %System Root%\ProgramData\{random folder name 1}\{random file name 1}.dll - contains key
• %System Root%\ProgramData\svcfnmainstvestvs\stppthmainfv.dll - contains list of random strings
• %System Root%\how to decrypt files.lnk

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\ProgramData\{random folder name 2}
• %System Root%\{random folder name 3}
• %System Root%\ProgramData\{random folder name 1}
• %System Root%\ProgramData\svcfnmainstvestvs
• %System Root%\ProgramData\svtstcrs

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\svchhostlvsple
ImagePath = "{malware path and filename}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\svchhostlvsple
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\svchhostlvsple
DisplayName = "Users Profile System Services"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\svchhostlvsple
Description = "This service is responsible for loading and unloading user profiles. If this service is stopped or disabled, users will no longer be able to successfully logon or logoff applications may have problems getting to users' data, and components registered to receive profile event notifications will not receive them."

Information Theft

This Trojan accepts the following parameters:

• "-i" - Install the malware as a service
• "install" - Install the malware as a service
• "-d" - Delete the service
• "-u" - Delete the service
• "delete" - Delete the malware service
• "-s" - Start the malware service
• "start" - Start the malware service
• "-k" - Stop the malware service
• "kill" - Stop the malware service
• "stop" - Stop the malware service

NOTES:

It deletes all entries and subkeys under the following registry key to disable safe mode:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot

It deletes all entries under the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

It shutdowns the affected system and displays any of the following messages:

• windows update
• sys