Ransom.Win32.EGREGOR.YAAK-A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %Program Data%\dtb.dat → Contains machine generated RSA public key and encrypted RSA key.
• {Encrypted Directory}\{CRC32 of Netbios Domain Name}.lnk → Deleted afterwards

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{Volume Serial Number + CRC32 Hash of Computer Name}

Process Termination

This Ransomware terminates the following services if found on the affected system:

• Services that contains the following string:
  
  • database
  • msexchange
  • sql
• If --killRDP argument is used:
  
  • Teamviewer
  • TermService

It terminates the following processes if found running in the affected system's memory:

• agntsvc.exe
• dbeng50.exe
• dbsnmp.exe
• dumpcap.exe
• encsvc.exe
• excel.exe
• firefoxconfig.exe
• infopath.exe
• ipython.exe
• isqlplussvc.exe
• msaccess.exe
• msftesql.exe
• mspub.exe
• mydesktopqos.exe
• mydesktopservice.exe
• mysqld-nt.exe
• mysqld-opt.exe
• mysqld.exe
• ocautoupds.exe
• ocomm.exe
• ocssd.exe
• onenote.exe
• oracle.exe
• outlook.exe
• powerpnt.exe
• procexp.exe
• procexp64.exe
• procmon.exe
• procmon64.exe
• python.exe
• QBW32.exe
• QBW64.exe
• sqbcoreservice.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlservr.exe
• sqlwriter.exe
• steam.exe
• synctime.exe
• tbirdconfig.exe
• thebat.exe
• thebat64.exe
• thunderbird.exe
• visio.exe
• winword.exe
• wordpad.exe
• wpython.exe
• xfssvccon.exe

Information Theft

This Ransomware gathers the following data:

• Computer Name
• User Name
• NetBios Domain Name
• Operating System Version
• Drive Type and disk space for each available drives
• Presence of Antivirus Product
• Volume Serial Number

Other Details

This Ransomware does the following:

• It requires the argument -pickyourmoney6 in order for it to continue with its ransomware routine
• It is capable of accepting the following arguments:
  
  • --greetings="{string}" → Set greetings in ransom note.
  • --append="{string}" → Set extension to append on encrypted files.
  • --path="{Folder Path}" → Specify path to only encrypt.
  • --norename → Does not append extension to encrypted files
  • --nonet → Do not encrypt network drives
  • --full → Encrypt both local and network drives
  • --target="{string}" → Target file extension to encrypt. (Will avoid files with other extension but will still encrypt files without extension)
  • --killrdp → Terminates TermService and Teamviewer Service. Disable RDP
  • --samba → Created LNK files will not have "DELETE_ON_CLOSE" attribute
  • --multiproc → Avoid creating Mutex (to allow multiple instance of malware)
  • --fast="{size in MB}" → Specify file size limit for encryption in MB.
  • --nomimikatz
• It checks for the computer's language and terminates itself if any the following language is detected:
  
  • Armenian
  • Azerbaijani
  • Azeri
  • Belarusian
  • Georgian
  • Kazakh
  • Kyrgyz
  • Romanian
  • Russian
  • Tajik
  • Tatar
  • Turkmen
  • Ukrainian
  • Uzbek
• It is capable of encrypting local and network drives.
• It deletes shadow copies.
• Due to the nature of how it drops its ransom notes, it is capable of printing physical copies of its ransom note through printers it has found in the network.

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• dtb.dat
• autorun.inf
• boot.ini
• desktop.ini
• ntuser.dat
• iconcache.db
• bootsect.bak
• ntuser.dat.log
• thumbs.db
• Bootfont.bin
• RECOVER-FILES.txt

It avoids encrypting files with the following strings in their file path:

• \All Users
• \cache2\entries\
• \Low\Content.IE5\
• \Program Files
• \ProgramData\
• \Tor Browser
• \User Data\Default\Cache\
• \Windows

It appends the following extension to the file name of the encrypted files:

• {Original Filename}.{Original File Extension}.{Random Characters}

It drops the following file(s) as ransom note:

• {Encrypted Directory}\RECOVER-FILES.txt
  

It avoids encrypting files with the following file extensions:

• .exe
• .dll
• .lnk
• .sys