RANSOM_FILECRYPTOR.R046C0DB618

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It encrypts files found in specific folders.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following component file(s):

• {malware file path}\8F185AD69BC908.key

It drops and executes the following files:

• {malware file path}\8F185AD69BC908.cmd - is a batch file which searches for particular file extensions and launches 8F185AD69BC908.exe which performs encryption on the found files.
• {malware file path}\8F185AD69BC908.exe - contains the encryption routine

Other System Modifications

This Ransomware deletes the following files:

• {malware file path}\8F185AD69BC908.cmd
• {malware file path}\8F185AD69BC908.exe
• {malware file path}\8F185AD69BC908.key

Other Details

This Ransomware drops the following file(s)/component(s):

• %Application Data%\{volume serial number}

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It does the following:

• If the malware is run on a Windows operating system version lower than Windows 2000, it displays the following message box and exits:
• It executes the following commands:
  • ping -n 30 127.0.0.1
  • msg "%USERNAME%" "SPORA: LOCAL DECRYPTED"
  • 8F185AD69BC908.exe /key 8F185AD69BC908.key /file "%%~fd"
• After it gathers files and the encryption routine is performed on those files, it displays the following windows:
  

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .docxml
• .dot
• .doc
• .docx
• .docm
• .xls
• .xlsx
• .xlsm
• .xlsb
• .xltx
• .xltm
• .xlam
• .odt
• .rtf
• .pdf
• .bpdx
• .msg
• .email
• .pptx
• .pptm
• .potx
• .potm
• .ppsx
• .ppsm
• .psd
• .dwg
• .cdr
• .jpg
• .jpeg
• .tiff
• .wmv
• .mp4
• .avi
• .bmp
• .cd
• .1cd
• .dbf
• .sqlite
• .dt
• .cf
• .cfu
• .epf
• .log
• .lgf
• .lgp
• .elf
• .cdn
• .efd
• .geo
• .gsf
• .zip
• .rar
• .7z
• .backup
• .tib
• .bak
• .bak1
• .bak2
• .bak3
• .bak4
• .002
• .003
• .004
• .005
• .006
• .007
• .008
• .009
• .010
• .wbk
• .ful
• .wbcat
• .backupdb
• .pdb
• .mdb
• .accdb
• .ace
• .arj
• .tar
• .cab
• .cfg
• .dxf
• .dwf
• .vbox
• .vdi
• .vhd
• .vhdx
• .vmdk
• .vmsd
• .vmx
• .vmxf
• .vob
• .pfx
• .cer
• .key
• .lic
• .sql
• .sql1
• .sql2
• .db3
• .dbs
• .frm
• .ldf
• .sdb
• .tmd
• .sdf
• .iso
• .mdf
• .mds
• .bin
• .nrg
• .cue

It encrypts files found in the following folders:

• {malware directory and its subdirectories}

NOTES:

Though it is able to gather files for encryption, it is not able to encrypt files due to some errors on its encryption routine.