RANSOM_CRYPTESLA.XXRH

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %Application Data%\vcw{random letters}.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %User Profile%\My Documents\Recovery_File_{random letters}.txt
• %Desktop%\RESTORE_FILES.HTML
• %Desktop%\RESTORE_FILES.TXT
• %Desktop%\RESTORE_FILES.BMP

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSCONFIG = "%Application Data%\vcw{random letters}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSCONFIG = "%Application Data%\vcw{random letters}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\msys

HKEY_CURRENT_USER\Software\{installation ID}

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnabledLinkConnections = "1"

HKEY_CURRENT_USER\Software\{installation ID}
data = "{encryption information}"

HKEY_CURRENT_USER\Software\msys
ID = "{installation ID}"

Other Details

This Trojan connects to the following URL(s) to get the affected system's IP address:

• http://ipinfo.io/ip

It connects to the following possibly malicious URL:

• https://{BLOCKED}q4bgmutfnf.onion.to
• https://{BLOCKED}q4bgmutfnf.tor2web.org
• http://{BLOCKED}almarketing.com/{path}/{data}
• http://{BLOCKED}erheath.ru/{path}/{data}
• http://{BLOCKED}erests.com/{path}/{data}
• http://{BLOCKED}ppen.nl/{path}/{data}
• http://{BLOCKED}rnotube.org/{path}/{data}
• http://{BLOCKED}itynowbooksandgifts.com/{path}/{data}

It deletes the initially executed copy of itself

NOTES:

It is capable of encrypting files in all folders found in the physical drives and appends .aaa in the file name of the encrypted files.

It drops restore_files_{random letters}.html and restore_files_{random letters}.txt to the folders where the files are encrypted.