RANSOM_HIDDENTEARBKDR.A

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It listens on port(s). It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following files:

• %Desktop%\README.txt - Ransom Note

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following copies of itself into the affected system:

• %System%\msmgr.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• msmgr.201

Autostart Technique

This worm modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%System%\Userinit.exe, %System%\msmgr.exe"

(Note: The default value data of the said registry entry is "%System%\Userinit.exe".)

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {Drive Letter}:\My Pictures.exe
• {Drive Letter}:\My Pictures\My Pictures.exe - if above already exists

Backdoor Routine

This worm listens on the following port(s):

• 13000

It executes the following commands from a remote malicious user:

• cmd.exe /C {Received Information}
• Display {Received Information} via Message Box

It connects to the following websites to send and receive information:

• http://{BLOCKED}.{BLOCKED}.243.217/crypt.php?key={Generated Passowrd} {Host Name}-{Computer Name}

Other Details

This worm encrypts files with the following extensions:

• .txt
• .doc
• .docx
• .xls
• .xlsx
• .ppt
• .pptx
• .odt
• .jpg
• .png
• .csv
• .sql
• .mdb
• .sln
• .php
• .asp
• .aspx
• .html
• .xml
• .psd

It renames encrypted files using the following names:

• {host file}.locked

NOTES:

It encrypts files in the following directories:

• %Desktop%

It tries to send an email to {BLOCKED}l@e{BOCKED}l.com with the following composition:

Subject Test Mail
body:
{Computer Name}\{User Name}
{host ip}
{host public ip}

It sets the following file time of the drop copy of itself in non-fixed drives:

Creation time:
10/02/1992 - 02:18:21
Last Write Time:
11/04/1992 - 02:21:07