Ransom.Win32.HKITTY.C

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Ransomware does the following:

• Empty Recycled Bin
• It uses WQL to delete shadow copies
• It uses the Windows Restart Manager API to close processes or shut down Windows services that may be keeping a file open and preventing encryption.

It accepts the following parameters:

• -p | --path → Specify the path to encrypt

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• unlock_info.txt
• ntldr
• ntdetect.
• desktop.ini
• autorun.inf
• iconcache.db
• bootsect.bak
• boot.ini
• bootfont
• thumbs.db
• licencse.txt
• ntusers.

It avoids encrypting files found in the following folders:

• windows
• programdata
• $recyclebin
• all users
• winnt
• appdata
• application data
• local setting
• boot

It appends the following extension to the file name of the encrypted files:

• .crypt

It drops the following file(s) as ransom note:

• {Encrypted Directory}\unlock_info.txt
  

It avoids encrypting files with the following file extensions:

• .sys
• .exe
• .dll
• .ico
• .iso
• .cab
• .cat
• .msi
• .chm