TROJ_CRILOCK.AE

This malware is one of the latest ransomware variants known as cryptolockers. When executed, it encrypts files and displays a warning message informing users that even though the malware has been deleted on their system, the encrypted files are inaccessible.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %Application Data%\{random file name}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {random letters}

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
CryptoLocker = "%Application Data%\{random file name}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
*CryptoLocker = "%Application Data%\{random file name}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\CryptoLocker

HKEY_CURRENT_USER\Software\CryptoLocker\
Files

It adds the following registry entries:

HKEY_CURRENT_USER\Software\CryptoLocker
PublicKey = “{random values}"

HKEY_CURRENT_USER\Software\CryptoLocker\
Files
{path and file name of encrypted file} = “{hex value}”

NOTES:

It attempts to download the key to be used in encrypting files by connecting to random generated domains with the following extensions:

• biz/home
• co.uk
• com
• info
• net
• org
• ru

It encrypts files with the following extensions:

• *.3fr
• *.accdb
• *.arw
• *.bay
• *.cdr
• *.cer
• *.cr2
• *.crt
• *.crw
• *.dbf
• *.dcr
• *.der
• *.dng
• *.doc
• *.docm
• *.docx
• *.dwg
• *.dxf
• *.dxg
• *.eps
• *.erf
• *.indd
• *.kdc
• *.mdb
• *.mdf
• *.mef
• *.mrw
• *.nef
• *.nrw
• *.odb
• *.odc
• *.odm
• *.odp
• *.ods
• *.odt
• *.orf
• *.p12
• *.p7b
• *.p7c
• *.pdd
• *.pef
• *.pem
• *.pfx
• *.ppt
• *.pptm
• *.pptx
• *.psd
• *.pst
• *.ptx
• *.r3d
• *.raf
• *.raw
• *.rtf
• *.rw2
• *.rwl
• *.sr2
• *.srf
• *.srw
• *.wb2
• *.wpd
• *.wps
• *.x3f
• *.xlk
• *.xls
• *.xlsb
• *.xlsm
• *.xlsx

After successfully encrypting files on the targeted system, it replaces the wallpaper with another image:

It demands users to pay a fine:

Users can pay via the following payment methods:

• Bitcoin
  

  

• MoneyPak