Ransom_ANUBI.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It is capable of encrypting files in the affected system.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Acrobat Optimizer x86 = {malware file path and file name}.exe -autorun

Other Details

This Ransomware connects to the following possibly malicious URL:

• stati{BLOCKED}.dns.army/rec.php?msg=

It is capable of encrypting files in the affected system.

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .[anubi@cock.li].anubi

It leaves text files that serve as ransom notes containing the following text:

• {encrypted file path}\__READ_ME__.txt