RANSOM_CRYPTOR.C

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following non-malicious files:

• README_FOR_DECRYPT.txt - to all folders where files are encrypted.

Other Details

This Trojan encrypts files with the following extensions:

• .php
• .html
• .tar
• .gz
• .sql
• .js
• .css
• .pdf
• .tgz
• .war
• .jar
• .java
• .class
• .ruby
• .rar
• .zip
• .db
• .7z
• .doc
• .pdf
• .xls
• .properties
• .xml
• .jpg
• .jpeg
• .png
• .gif
• .mov
• .avi
• .wmv
• .mp3
• .mp4
• .wma
• .aac
• .wav
• .pem
• .pub
• .docx
• .apk
• .exe
• .dll
• .tpl
• .psd
• .asp
• .phtml
• .aspx
• .csv

It opens the following files:

• ./readme.crypto - Contains data to be written in README_FOR_DECRYPT.txt
• ./index.crypto

It renames encrypted files using the following names:

• {Filename}.encrypted

It deletes the initially executed copy of itself

NOTES:

This Trojan initially encrypts files found in the following folders:

• /etc/apache2
• /etc/nginx
• /home
• /root
• /var/lib/mysql
• /var/log
• /var/www

It avoids encrypting files in the following folders:

• /root/.ssh
• /usr/bin
• /etc/ssh