TROJ_CRILOCK.NS

This CryptoLocker is downloaded by a ZeuS/ZBOT variant detected as TSPY_ZBOT.VNA. When executed, it encrypts files and asks users to purchase a decrypting tool.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %Application Data%\{random GUID}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {random string 1}
• {random string 2}

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
CryptoLocker = "%Application Data%\{random GUID}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\CryptoLocker

HKEY_CURRENT_USER\Software\CryptoLocker\
Files

It adds the following registry entries:

HKEY_CURRENT_USER\Software\CryptoLocker
PublicKey = “{random values}"

HKEY_CURRENT_USER\Software\CryptoLocker\
Files
{path and file name of encrypted file} = “{hex value}”

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\CryptoLocker

HKEY_CURRENT_USER\Software\CryptoLocker\
Files

NOTES:

This Trojan attempts to download the key to be used in encrypting files by connecting to random generated domains with the following extensions:

• biz/home
• co.uk/home
• com/home
• info/home
• net/home
• org/home
• ru/home

It encrypts files with the following extensions:

• *.3fr
• *.accdb
• *.arw
• *.bay
• *.cdr
• *.cer
• *.cr2
• *.crt
• *.crw
• *.dbf
• *.dcr
• *.der
• *.dng
• *.doc
• *.docm
• *.docx
• *.dwg
• *.dxf
• *.dxg
• *.eps
• *.erf
• *.indd
• *.kdc
• *.mdb
• *.mdf
• *.mef
• *.mrw
• *.nef
• *.nrw
• *.odb
• *.odc
• *.odm
• *.odp
• *.ods
• *.odt
• *.orf
• *.p12
• *.p7b
• *.p7c
• *.pdd
• *.pef
• *.pem
• *.pfx
• *.ppt
• *.pptm
• *.pptx
• *.psd
• *.pst
• *.ptx
• *.r3d
• *.raf
• *.raw
• *.rtf
• *.rw2
• *.rwl
• *.sr2
• *.srf
• *.srw
• *.wb2
• *.wpd
• *.wps
• *.x3f
• *.xlk
• *.xls
• *.xlsb
• *.xlsm
• *.xlsx

It uses AES-265 and RSA encryption. Decrypting the encrypted files is not feasible as of this writing.

It demands users to pay a fine via any of the following payment methods:

• Bitcoin
• cashU
• MoneyPak
• Ukash