RANSOM_HEARTBLEED.THDOBAH

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It connects to a website to send and receive information.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following folders:

• %AppDataLocal%\H34rtBl33d

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• vssadmin.exe delete shadows /for=d: /all /quiet
• cmd.exe /C bcdedit /set {bootmgr} displaybootmenu no
• cmd.exe /C Net user D3g1d5 Dwixtkj37 /add
• cmd.exe /C Net localgroup Administrators D3g1d5 /add
• cmd.exe /C ping 6.9.6.9 -n 1 -w 1 {Malware Path} \

Autostart Technique

This Ransomware creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKCU\Software\Microsoft\
Windows\CurrentVersion\Run
H34rtBl33d Ransomware = "%AppDataLocal%\H34rtBl33d\H34rtBl33d.exe"

Other System Modifications

This Ransomware modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "1"

(Note: The default value data of the said registry entry is "0".)

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"

(Note: The default value data of the said registry entry is "0".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoRun = "1"

(Note: The default value data of the said registry entry is "0".)

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Windows\System
DisableCMD = "1"

(Note: The default value data of the said registry entry is "0".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoClose = "1"

(Note: The default value data of the said registry entry is "0".)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
ShutdownWithoutLogon = "0"

(Note: The default value data of the said registry entry is "1".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableLockWorkstation = "1"

(Note: The default value data of the said registry entry is "0".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableChangePassword = "1"

(Note: The default value data of the said registry entry is "0".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
NoClose = "1"

(Note: The default value data of the said registry entry is "0".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoClose = "1"

(Note: The default value data of the said registry entry is "0".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
NoLogoff = "1"

(Note: The default value data of the said registry entry is "0".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
HideFastUserSwitching = "1"

(Note: The default value data of the said registry entry is "0".)

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
EnableLUA = "0"

(Note: The default value data of the said registry entry is "1".)

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
NoClose = "1"

(Note: The default value data of the said registry entry is "0".)

It sets the system's desktop wallpaper to the following image:

Propagation

This Ransomware drops the following copies of itself in all physical and removable drives:

• Setup.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Backdoor Routine

This Ransomware connects to the following websites to send and receive information:

• hxxp://{BLOCKED}l33d.{BLOCKED}onlocker.xyz/gen.php

Dropping Routine

This Ransomware drops the following files:

• %AppDataLocal%\H34rtBl33d\H34rtBl33d.bmp -> wallpaper
• %AppDataLocal%\H34rtBl33d\H34rtBl33d.exe -> decryptor

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Information Theft

This Ransomware gathers the following data:

• Computer Name
• Victim IP Address
• Operating System

Stolen Information

This Ransomware sends the data it gathers to the following email addresses via SMTP:

• {BLOCKED}.{BLOCKED}1@gmail.com
• {BLOCKED}7@gmail.com
• {BLOCKED}5@gmail.com

Other Details

This Ransomware connects to the following URL(s) to check for an Internet connection:

• http://www.google.com

It displays the following message boxes:

It does the following:

• Injects a copy of itself in all .rar files excluding directories containing the following strings:
  • archive_db
  • Intel
  • NVIDIA
  • PerfLogs
  • Windows
  • Windows.old
  • ProgramFiles
  • ProgramData
  • ProgramFiles
  • $Recycle.Bin
  • Boot
  • Config.Msi
  • System Volume Information
  • Program Files
  • Program Files (x86)

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .123
• .3dm
• .3ds
• .3g2
• .3gp
• .602
• .7z
• .ARC
• .BAK
• .JPG
• .PAQ
• .accdb
• .aes
• .ai
• .asc
• .asf
• .asm
• .asp
• .avi
• .backup
• .bak
• .bat
• .bmp
• .brd
• .bz2
• .c
• .cache
• .cgm
• .class
• .cmd
• .config
• .cpp
• .crt
• .cs
• .csr
• .csv
• .db
• .dbf
• .dch
• .der
• .dif
• .dip
• .djvu
• .doc
• .docb
• .docm
• .docx
• .dot
• .dotm
• .dotx
• .dwg
• .edb
• .eml
• .fla
• .flv
• .frm
• .gif
• .gpg
• .gz
• .h
• .html
• .hwp
• .ibd
• .inf
• .iso
• .jar
• .java
• .jpeg
• .jpg
• .js
• .jsp
• .key
• .lay
• .lay6
• .ldf
• .m3u
• .m4u
• .manifest
• .max
• .mdb
• .mdf
• .mid
• .mkv
• .mml
• .mov
• .mp3
• .mp4
• .mpeg
• .mpg
• .msg
• .msi
• .myd
• .myi
• .nef
• .odb
• .odg
• .odp
• .ods
• .odt
• .onetoc2
• .ost
• .otg
• .otp
• .ots
• .ott
• .p12
• .pas
• .pdb
• .pdf
• .pem
• .pfx
• .php
• .phtml
• .pl
• .png
• .pot
• .potm
• .potx
• .ppam
• .pps
• .ppsm
• .ppsx
• .ppt
• .pptm
• .pptx
• .ps1
• .psd
• .pst
• .rar
• .rb
• .resources
• .resx
• .rtf
• .sch
• .sh
• .shtml
• .sldm
• .sldm
• .sldx
• .slk
• .sln
• .snt
• .sql
• .sqlite3
• .sqlitedb
• .stc
• .std
• .sti
• .stw
• .suo
• .svg
• .swf
• .sxc
• .sxd
• .sxi
• .sxm
• .sxw
• .tar
• .tbk
• .tgz
• .tif
• .tiff
• .txt
• .uop
• .uot
• .user
• .vb
• .vbproj
• .vbs
• .vcd
• .vdi
• .vmdk
• .vmx
• .vob
• .vsd
• .vsdx
• .wav
• .wb2
• .wk1
• .wks
• .wma
• .wmv
• .xlc
• .xlm
• .xls
• .xlsb
• .xlsm
• .xlsx
• .xlt
• .xltm
• .xltx
• .xlw
• .xml
• .zip

It avoids encrypting files with the following strings in their file path:

• .dll
• .sys
• Windows
• System32
• system32
• ProgramData
• AppData
• Program

It appends the following extension to the file name of the encrypted files:

• .H34rtBl33d

It drops the following file(s) as ransom note:

• %Desktop%\H34rtBl33d.html
• %Desktop%\H34rtBl33d.txt

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)