RANSOM_ZYKLON.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information. It gathers information and reports it to its servers.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• UNLOCK_FILES_README_{random charactesr}.txt (whenever it succeeds in encrypting files)
• UNLOCK_FILES_README_{random charactesr}.html (whenever it succeeds in encrypting files)

It drops the following component file(s):

• %Application Data%\{random characters 1}\Xmvenagxehd.xml
• %Application Data%\{random characters 1}\Zrmkwhrrxoeoaon.png

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops and executes the following files:

• %Application Data%\{random characters 1}\Cgkgcrykd.exe (detected as Ransom_ZYKLON.A)

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It leaves text files that serve as ransom notes containing the following:

• Your files are locked / encrypted by Zyklon Locker
• You can unlock your files by paying ~$/€250
• All your important files are encrypted using an unique 32 characters AES-256 password.
• (it will take a computer over a billion years to crack this password)
• The only way to get your files back is by purchasing the password!
• In order to unlock your files you will have to purchase the private password for this computer. For more information navigate to your personal unlocking page.
• Warning! You must pay the specified amount before {deadline, day of the week}, {deadline, Month dd, yyyy} or the amount you have to pay will TRIPLE!
• Warning! The only way to get your files back is by paying! Antivirus software CANNOT recover your files!
• Visit one of the websites below to purchase your decryption password and unlock your files!
• http://gatewaypage1.ru/e1c2a95580
• http://personalgateway1.ru/e1c2a95580
• If this website doesn't work follow the steps below
• 1. Download the TOR Browser Bundle https://www.torproject.org/projects/torbrowser.html.en#downloads
• 2. Install and then open the Tor Browser Bundle.
• 3. Inside the Tor Browser Bundle navigate to snjwcuabix664kmg.onion/e1c2a95580

Autostart Technique

This Trojan drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

• %Start Menu%\Programs\Startup\Cgkgcrykd.lnk

(Note: %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Trojan connects to the following website to send and receive information:

• http://{BLOCKED}page1.ru/gate.php?action=write&1={random characters}&2={computer name}&3={username}&4={external ip address}=nlmail22&6={geolocation}
• http://{BLOCKED}gateway1.ru/gate.php?action=write&1={random characters}&2={computer name}&3={username}&4={external ip address}=nlmail22&6={geolocation}

It encrypts files with the following extensions:

• .pps
• .ppsm
• .ppsx
• .ppt
• .pptm
• .pptx
• .prf
• .ps
• .psafe3
• .psd
• .pspimage
• .pst
• .ptx
• .py
• .qba
• .qbb
• .qbm
• .qbr
• .qbw
• .qbx
• .qby
• .r3d
• .raf
• .rar
• .rat
• .raw
• .rdb
• .rm
• .rtf
• .rw2
• .rwl
• .rwz
• .s3db
• .sas7bdat
• .say
• .sd0
• .sda
• .sdf
• .sldm
• .sldx
• .sql
• .sqlite
• .sqlite3
• .sqlitedb
• .sr2
• .srf
• .srt
• .srw
• .st4
• .st5
• .st6
• .st7
• .st8
• .sta
• .stc
• .std
• .sti
• .stw
• .stx
• .svg
• .swf
• .sxc
• .sxd
• .sxg
• .sxi
• .sxm
• .sxw
• .tex
• .tga
• .thm
• .tiff
• .tlg
• .vb
• .vob
• .wallet
• .wav
• .wb2
• .wmv
• .wpd
• .wps
• .x11
• .x3f
• .xis
• .xla
• .xlam
• .xlk
• .xlm
• .xlr
• .xls
• .xlsb
• .xlsm
• .xlsx
• .xlt
• .xltm
• .xltx
• .xlw
• .xml
• .ycbcra
• .yuv
• .zip
• .3dm
• .3ds
• .3fr
• .3g2
• .3gp
• .3pr
• .7z
• .ab4
• .accdb
• .accde
• .accdr
• .accdt
• .ach
• .acr
• .act
• .adb
• .ads
• .agdl
• .ai
• .ait
• .al
• .apj
• .arw
• .asf
• .asm
• .asp
• .asx
• .avi
• .awg
• .back
• .backup
• .backupdb
• .bak
• .bank
• .bay
• .bdb
• .bgt
• .bik
• .bkp
• .blend
• .bpw
• .c
• .cd2
• .cdf
• .cdr
• .cdr3
• .cdr4
• .cdr5
• .cdr6
• .cdrw
• .cdx
• .ce1
• .cer
• .cfp
• .cgm
• .cib
• .class
• .cls
• .cmt
• .cpi
• .cpp
• .cr2
• .craw
• .crt
• .crw
• .cs
• .csh
• .csl
• .csv
• .dac
• .db
• .db-jounral
• .db3
• .dbb
• .dbf
• .dc2
• .dcr
• .dcs
• .ddd
• .ddoc
• .ddrw
• .dds
• .der
• .des
• .design
• .dgc
• .djvu
• .dng
• .doc
• .docm
• .docx
• .dot
• .dotm
• .dotx
• .drf
• .drw
• .dtd
• .dwg
• .dxb
• .dxf
• .dxg
• .eml
• .eps
• .erbsql
• .erf
• .exf
• .fdb
• .ffd
• .fff
• .fh
• .fhd
• .fla
• .flac
• .flv
• .fpx
• .fxg
• .gray
• .grey
• .gry
• .h
• .hbk
• .hpp
• .htm
• .ibank
• .ibd
• .ibz
• .idx
• .iif
• .iiq
• .incpas
• .indd
• .java
• .jpe
• .jpeg
• .jpg
• .kc2
• .kdb
• .kdbx
• .kdx
• .key
• .kpdx
• .lua
• .m
• .m4v
• .max
• .mdb
• .mdc
• .mdf
• .mef
• .mfw
• .mmw
• .moneywell
• .mos
• .mov
• .mp3
• .mp4
• .mpg
• .mrw
• .msg
• .myd
• .nd
• .ndd
• .nef
• .nk2
• .nop
• .nrw
• .ns2
• .ns3
• .ns4
• .nsd
• .nsf
• .nsg
• .nsh
• .nwb
• .nx2
• .nxl
• .nyf
• .oab
• .obj
• .odb
• .odc
• .odf
• .odg
• .odm
• .odp
• .ods
• .odt
• .oil
• .orf
• .ost
• .otg
• .oth
• .otp
• .ots
• .ott
• .p12
• .p7b
• .p7c
• .pab
• .pages
• .pas
• .pat
• .pcd
• .pct
• .pdb
• .pdd
• .pdf
• .pef
• .pem
• .pfx
• .php
• .pl
• .plc
• .png
• .pot
• .potm
• .potx
• .ppam

It renames encrypted files using the following names:

• {original file name and file extension}.zyklon

It gathers the following information and reports it to its servers:

• computer name
• username
• external ip
• geolocation

NOTES:

This ransomware executes the following command to delete shadow copies:

WMIC.exe shadowcopy delete /nointeractive

It avoids encryption in the following folders:

• %Windows%\
• %Program Files%\

The site in the ransom note, when visited, displays the following webpage: