TROJ_RANSOM.SMAR

This malware is the final payload of a USTEAL variant that was reported on late April 2014. It encrypts certain files detected on the affected system and demands the user pay the ransom to have them restored. Users affected by this malware may find certain file types on their system encrypted, as well as personal information potentially being stolen (due to this malware's carrier).

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Temp%\{random}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It leaves text files that serve as ransom notes containing the following:

• Внимание! Все Ваши файлы зашифрованы! Чтобы восстановить свои файлы и получить к ним доступ, отправьте смс с текстом XXXX на номер YYYY У вас есть N попыток ввода кода. При превышении этого количества, все данные необратимо испортятся. Будьте внимательны при вводе кода!

It leaves the following text files:

• %Desktop%\HOW TO DECRYPT FILES.txt

(Note: %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Alcmeter = "%User Temp%\{random}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CLASSES_ROOT\{random key}

HKEY_LOCAL_MACHINE\Software\Classes\
{random key}

It adds the following registry entries:

HKEY_CLASSES_ROOT\{random key}\DefaultIcon
(Default) = "%User Temp%\{random}.exe,0"

HKEY_CLASSES_ROOT\{random key}
(Default) = "CRYPTED!"

HKEY_CLASSES_ROOT\{random key}\shell\
open\command
(Default) = "%User Temp%\{random}.exe"

Other Details

This Trojan encrypts files with the following extensions:

• .zip
• .tar
• .gzip
• .jpg
• .jpeg
• .psd
• .cdr
• .dwg
• .max
• .bmp
• .gif
• .png
• .doc
• .docx
• .xls
• .xlsx
• .ppt
• .pptx
• .txt
• .pdf
• .djvu
• .htm
• .html
• .mdb
• .cer
• .p12
• .pfx
• .kwm
• .pwm
• .1cd
• .mdf
• .dbf
• .odt
• .vob
• .ifo
• .lnk
• .torrent
• .mov
• .m2v
• .3gp
• .mpeg
• .mpg
• .flv
• .avi
• .mp4
• .wmv
• .divx
• .mkv
• .mp3
• .wav
• .flac
• .ape
• .wma
• .ac3

It renames encrypted files using the following names:

• {original file name and extension}.bat

NOTES:

This Trojan modifies the following registry entries to enable its automatic execution every time an encrypted file (files using .bat extension) is opened:

HKEY_CLASSES_ROOT\.bat
(Default) = {random key}

Once a user opens an encrypted file, it opens the following window:

This will require the user to enter a password (1st Button). If the entered password is detected to be the incorrect password multiple times, a dialog will appear notifying the user that the limit for password attempts has been reached.

When the second button is pressed, another dialog with instructions will appear.

When the the correct password is entered it will display another dialog that declares the password entry as successful and restore all .bat files to its original form.