TROJ_RANSOM.JM

This ransomware Trojan uses social engineering methods to lure users into performing certain actions that may, directly or indirectly, cause malicious routines to be performed. Specifically, upon its execution, the infected system is shut down and then restart, rendering the system unusable. It prompts user to pay a certain amount to receive the key that would unlock the system.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

It locks the Windows desktop and prompts the user to call the number 9653919220 and pay the 450 Rubles ($15) ransom to receive a key. Based on its code, the key to unlock the desktop is "TNMTTF". Unless the user pays the ransom, the system remains unusable. It displays the following GUI:

This Trojan may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

Arrival Details

This Trojan may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following files:

• %User Profile%\161933172\161933172.exe - also detected as TROJ_RANSOM.JM

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It creates the following folders:

• %User Profile%\161933172

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
ZDF161933172AWrt161933172AdsWrt161933172aAdsWrtenZDF161933172_1619331720 = %User Profile%\161933172\161933172.EXE

Other Details

This Trojan does the following:

• Locks the Windows desktop and prompts the user to call a certain number and pay the 450 Rubles ($15) ransom to receive a key. Based on its code, the key to unlock the desktop is "TNMTTF". Unless the user pays the ransom, the system remains unusable. It displays the following GUI: