RANSOM_JUSINOMEL.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information. It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• {malware path}\PLJQKRKMWEZJEHEVT.txt - Serves as ransom note
• {folders containing encrypted files}\README NOW !!!.txt - Serves as ransom note

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• WrXehWMqEUv9ObHQ

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
WrXehWMqEUv9ObHQ = "{malware path}\{malware filename}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\WrXehWMqEUv9ObHQ

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\WrXehWMqEUv9ObHQ
WrXehWMqEUv9ObHQu = "Ee-{random characters)"

HKEY_LOCAL_MACHINE\SOFTWARE\WrXehWMqEUv9ObHQ
WrXehWMqEUv9ObHQp = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\WrXehWMqEUv9ObHQ
WrXehWMqEUv9ObHQs = "1"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\VSS\Diag\
SPP
SppEnumGroups (Enter) = {hex values}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\VSS\Diag\
SPP
SppEnumGroups (Leave) = {hex values}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\VSS\Diag\
SPP
SppGetSnapshots (Enter) = {hex values}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\VSS\Diag\
SP
SppGetSnapshots (Leave) = {hex values}

Other Details

This Trojan connects to the following website to send and receive information:

• http://{BLOCKED}veforyou.com/456/index.php

It renames encrypted files using the following names:

• {filename of encrypted file}.{extension of encrypted file}.id-{unique ID per victim}_sos@juicylemon.biz

It deletes itself after execution.

NOTES:

This ransomware encrypts files in the affected system.

It avoids encrypting files in folders and subfolders with names that start with any of the following strings:

• windows
• program

It avoids encrypting the following files:

• boot.ini
• NTDETECT.COM
• Bootfont.bin
• ntldr
• bootmgr
• BOOTNXT
• BOOTSECT.BAK
• NTUSER.DAT
• PDOXUSRS.NET

It avoids encrypting files with the following extensions:

• .acm
• .ade
• .adp
• .app
• .asa
• .asp
• .aspx
• .ax
• .bas
• .bat
• .bin
• .biz
• .bootmgr
• .chm
• .clb
• .cmd
• .cnt
• .cnv
• .com
• .cpl
• .cpx
• .crt
• .csh
• .dll
• .drv
• .dtd
• .exe
• .fxp
• .grp
• .h1s
• .hlp
• .hta
• .ini
• .ime
• .inf
• .ins
• .isp
• .its
• .js
• .jse
• .ksh
• .lnk
• .mad
• .maf
• .mag
• .mam
• .man
• .maq
• .mar
• .mas
• .mat
• .mau
• .mav
• .maw
• .mda
• .mdb
• .mde
• .mdt
• .mdw
• .mdz
• .msc
• .msi
• .msp
• .mst
• .mui
• .nls
• .ntldr
• .ocx
• .ops
• .pal
• .pcd
• .pif
• .prf
• .prg
• .pst
• .reg
• .scf
• .scr
• .sca
• .sys

It terminates itself if it is found running in the Virtual Box.

It deletes shadow copies.

It displays the following ransom note: