RANSOM.MSIL.VAPOR.THAAAIAH

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It encrypts files found in specific folders.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Information Theft

This Ransomware gathers the following data:

• Date of Infection
• Total number of Infected files
• Username
• Machine name
• Processor Count
• OS Version
• OS Architecture
• IP Address of victim
• The following details about the local user's account:
  • Account type
  • Full name
  • If password is required to access the account
  • Security ID
  • Security ID Type
  • Account Status

Stolen Information

This Ransomware sends the data it gathers to the following email addresses via SMTP:

• {BLOCKED}eenBot@reborn.com

Other Details

This Ransomware displays the following message boxes:

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• {All files}

It encrypts files found in the following folders:

• %Desktop%
• %User Profile%\Pictures
• %User Profile%\Videos
• %User Profile%\Music
• %Application Data%
• %Cookies%

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista, 7, and 8.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista, 7, and 8.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.. %Cookies% is the Internet Explorer browser cookies folder, which is usually C:\Documents and Settings\{user name}\Cookies on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Cookies on Windows Vista and 7, or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCookies on Windows 8.)

It appends the following extension to the file name of the encrypted files:

• .Vapor