RANSOM_SPORA.B

This ransomware uses a client console, giving the affected user a variety of options. including a free trial individual file restore. These options vary in prices. Furthermore, the ransom note language adapts with country code.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops a copy of itself in the following folders using different file names:

• %Desktop%{random values}.exe - set attributes to Hidden
• %AppDataLocal%\Temp\{random values}.exe
• {all removable and fixed drives}\{random values}.exe - set attributes to Hidden

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %Desktop%\{unique id}.HTML - ransom note
• %Desktop%\{unique id}.KEY
• %Application Data%\{unique id}.HTML - ransom note
• %Application Data%\{unique id}.KEY
• %Application Data%\{unique id}.LST
• %Application Data%\Microsoft\Windows\Templates\{unique id}.HTML - ransom note
• %Application Data%\Microsoft\Windows\Templates\{unique id}.KEY
• %Application Data%\Microsoft\Windows\Templates\{unique id}.LST
• {Fixed and Removable Drive Letter}:\{Shortcut files with the filename of every folder in the removable and fixed drive}
  • The malware creates these shortcut files in order to trick the user due to its folder icon and legit filenames.
  • The target path of these shortcuts is set to: %System%\cmd.exe /C explorer.exe "{folder name - where original files are stored}" & type "{random values}.exe - dropped copy of the malware" - "%tmp%\{random values}.exe - dropped copy of the malware" & start "{folder name - where original files are stored}" "%tmp%\{random values}.exe - dropped copy of the malware"
• %Application Data%\{10 digit number}

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Trojan encrypts files with the following extensions:

• .backup
• .7z
• .rar
• .zip
• .tiff
• .jpeg
• .jpg
• .accdb
• .sqlite
• .dbf
• .1cd
• .mdb
• .cd
• .cdr
• .dwg
• .psd
• .pdf
• .odt
• .rtf
• .docx
• .xlsx
• .doc
• .xls

It does the following:

• This ransomware deletes all shadow copies by executing the following command:
  • vssadmin delete shadows/all/quiet
• It prevents encrypting files containing any of the strings in its full path name:
  • games
  • program files (x86)
  • program files
  • windows
• It disables Windows Startup Repair by executing the following command:
  • bcdedit.exe /set {default} recoveryenabled no
  • bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

NOTES:

This ransomware displays the following images: