Ransom.Win32.STOP.DL

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following folders:

• %AppDataLocal%\{GUID}
• %System Root%\{System ID}

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It drops the following copies of itself into the affected system:

• %AppDataLocal%\{GUID}\{Malware Filename}.exe

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• %System Root%\{System ID}\PersonalID.txt -> contains a unique identifier for the infected machine
• %AppDataLocal%\bowsakkdestx.txt -> contains response from CnC server

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• icacls "%AppDataLocal%\{GUID}" /deny *S-1-1-0:(OI)(CI)(DE,DC) -> changes access control of the malware file
• "{Malware Path}\{Malware Filename}.exe" --Admin IsNotAutoStart IsNotTask -> if executed with admin privileges

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
SysHelper = "%AppDataLocal%\{GUID}\{Malware Filename}{Malware Filename}.exe" --AutoStart

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
SysHelper = 1

Download Routine

This Ransomware connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}v.top/files/penelop/updatewin.exe
• http://{BLOCKED}v.top/files/penelop/updatewin1.exe
• http://{BLOCKED}v.top/files/penelop/updatewin2.exe
• http://{BLOCKED}v.top/files/penelop/3.exe
• http://{BLOCKED}v.top/files/penelop/4.exe
• http://{BLOCKED}v.top/files/penelop/5.exe

Information Theft

This Ransomware gathers the following data:

• Computer Name
• MAC Address
• IP Address

Other Details

This Ransomware connects to the following URL(s) to get the affected system's IP address:

• https://api.{BLOCKED}p.ua/geo.json
  • It terminates and deletes itself on the affected system if the return of the IP address location is any of the following:
    • RU (Russia)
    • BY (Belarus)
    • UA (Ukraine)
    • AZ (Azerbaijan)
    • AM (Armenia)
    • TJ (Tajikistan)
    • KZ (Kazakhstan)
    • KG (Kyrgyzstan)
    • UZ (Uzbekistan)
    • SY (Syrian Arab Republic)

It does the following:

• It connects to the following URL to get the arguments needed for "--Service" and "--ForNetRes" to perform their routine:
  • http://{BLOCEKD}v.top/nddddhsspen6/get.php?pid={MD5 hash of the machine's MAC Address}&first=true

However, as of this writing, the said sites are inaccessible.

It accepts the following parameters:

• --Admin -> runs the malware as admin
• --AutoStart -> executes using autorun registry keys.
• --ForNetRes -> {argument/s from URL}
• --Service {PID of parent malware} -> {argument/s from URL}
• IsAutoStart/IsNotAutoStart -> executes malware as an autostart or not
• IsTask/IsNotTask -> executes malware as a task or not

It adds the following scheduled tasks:

• Name: Time Trigger Task
• Trigger: One time. After triggered, repeat every 5 minutes
• Action: Start a program %AppDataLocal%\{GUID}\{Malware Filename}.exe --Task

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• ntuser.dat
• ntuser.dat.LOG1
• ntuser.dat.LOG2
• ntuser.pol

It avoids encrypting files found in the following folders:

• {Drive}:\SystemID\
• {Drive}:\Users\Default User\
• {Drive}:\Users\Public\
• {Drive}:\Users\All Users\
• {Drive}:\Users\Default\
• {Drive}:\Documents and Settings\
• {Drive}:\ProgramData\
• {Drive}:\Recovery\
• {Drive}:\System Volume Information\
• {Drive}:\Users\%username%\AppData\Roaming\
• {Drive}:\Users\%username%\AppData\Local\
• {Drive}:\Windows\
• {Drive}:\PerfLogs\
• {Drive}:\ProgramData\Microsoft\
• {Drive}:\ProgramData\Package Cache\
• {Drive}:\Users\Public\
• {Drive}:\$Recycle.Bin\
• {Drive}:\$WINDOWS.~BT\
• {Drive}:\dell\
• {Drive}:\Intel\
• {Drive}:\MSOCache\
• {Drive}:\Program Files\
• {Drive}:\Program Files (x86)\
• {Drive}:\Games\
• {Drive}:\Windows.old\

It appends the following extension to the file name of the encrypted files:

• {Original Filename}.{Original Extension}.ribd

It drops the following file(s) as ransom note:

• {System Root}\_readme.txt
• {Encrypted Directory}\_readme.txt
  

It avoids encrypting files with the following file extensions:

• .sys
• .ini
• .DLL
• .dll
• .blf
• .bat
• .lnk
• .regtrans-ms