RANSOM_BLACKRUBY.THBGBI

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops and executes the following files:

• %System%\BlackRuby\Svchost.exe -> detected as Coinminer_XMRMINE.SM

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It drops the following copies of itself into the affected system:

• %System%\Black Ruby\WindowsUI.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It creates the following folders:

• %System%\Black Ruby

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• TheBlackRuby

Autostart Technique

This Ransomware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Defender = %System%\BlackRuby\WindowsUI.exe

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
BlackRuby
Install = Max

Other Details

This Ransomware does the following:

• It creates a hidden or system file:
  
  • %System%\BlackRuby
• It deletes shadow copies using the following commands
  • /C vssadmin Delete Shadows /All /Quiet
  • /C wmic shadowcopy delete
  • /C Bcdedit.exe /set {default} recoveryenabled no
  • /C Bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  • /C wevtutil.exe cl Application
  • /C wevtutil.exe cl Security
  • /C wevtutil.exe cl System
• Connects to the following URL to check if the victims current IP Address is located in Iran, otherwise it will continue its malware routine once verified that the victim is not located in Iran:
  
  • http://{BLOCKED}oip.net/json/
• It executes its coin mining component with the following command:
  
  • svchost.exe -o stratum+tcp://de01.{BLOCKED}txmr.com:3333 -u {Username on Mining Pool} -p {Computer Username}:{Computer Machine Name}

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .gif
• .apk
• .groups
• .hdd
• .hpp
• .log
• .m2ts
• .m4p
• .mkv
• .mpeg
• .epub
• .yuv
• .ndf
• .nvram
• .ogg
• .ost
• .pab
• .pdb
• .pif
• .png
• .qed
• .qcow
• .otp
• .s3db
• .qcow2
• .rvt
• .st7
• .stm
• .vbox
• .vdi
• .vhd
• .vhdx
• .vmdk
• .vmsd
• .psafe3
• .vmx
• .vmxf
• .3fr
• .3pr
• .ab4
• .accde
• .accdr
• .accdt
• .ach
• .acr
• .sd0
• .sxw
• .adb
• .advertisements
• .agdl
• .ait
• .apj
• .asm
• .awg
• .back
• .backup
• .sti
• .oil
• .backupdb
• .bay
• .bdb
• .bgt
• .bik
• .bpw
• .cdr3
• .cdr4
• .cdr5
• .cdr6
• .ycbcra
• .cdrw
• .ce1
• .ce2
• .cib
• .craw
• .crw
• .csh
• .csl
• .db_journal
• .dc2
• .pptm
• .dcs
• .ddoc
• .ddrw
• .der
• .des
• .dgc
• .djvu
• .dng
• .drf
• .dxg
• .eml
• .ppt
• .erbsql
• .erf
• .exf
• .ffd
• .fh
• .fhd
• .gray
• .grey
• .gry
• .hbk
• .ibd
• .7z
• .ibz
• .iiq
• .incpas
• .jpe
• .kc2
• .kdbx
• .kdc
• .kpdx
• .lua
• .mdc
• .mef
• .config
• .mfw
• .mmw
• .mny
• .mrw
• .myd
• .ndd
• .nef
• .nk2
• .nop
• .nrw
• .ns2
• .ns3
• .ldf
• .ns4
• .nwb
• .nx2
• .nxl
• .nyf
• .odb
• .odf
• .odg
• .odm
• .orf
• .otg
• .oth
• .py
• .ots
• .ott
• .p12
• .p7b
• .p7c
• .pdd
• .pem
• .plus_muhd
• .plc
• .pot
• .pptx
• .py
• .qba
• .qbr
• .qbw
• .qbx
• .qby
• .raf
• .rat
• .raw
• .rdb
• .rwl
• .rwz
• .conf
• .sda
• .sdf
• .sqlite
• .sqlite3
• .sqlitedb
• .sr2
• .srf
• .srw
• .st5
• .st8
• .std
• .stx
• .sxd
• .sxg
• .sxi
• .sxm
• .tex
• .wallet
• .wb2
• .wpd
• .x11
• .x3f
• .xis
• .ARC
• .contact
• .dbx
• .doc
• .docx
• .jnt
• .jpg
• .msg
• .oab
• .ods
• .pdf
• .pps
• .ppsm
• .prf
• .pst
• .rar
• .rtf
• .txt
• .wab
• .xls
• .xlsx
• .xml
• .zip
• .1cd
• .3ds
• .3g2
• .7zip
• .accdb
• .aoi
• .asf
• .asp
• .aspx
• .asx
• .avi
• .bak
• .cer
• .cfg
• .class
• .cs
• .css
• .csv
• .db
• .dds
• .dwg
• .dxf
• .flf
• .flv
• .html
• .idx
• .js
• .key
• .kwm
• .laccdb
• .lit
• .m3u
• .mbx
• .md
• .mdf
• .mid
• .mlb
• .mov
• .mp3
• .mp4
• .mpg
• .obj
• .odt
• .pages
• .php
• .psd
• .pwm
• .rm
• .safe
• .sav
• .save
• .sql
• .srt
• .swf
• .thm
• .vob
• .wav
• .wma
• .wmv
• .xlsb
• 3dm
• .aac
• .ai
• .arw
• .c
• .cdr
• .cls
• .cpi
• .cpp
• .cs
• .db3
• .docm
• .dot
• .dotm
• .dotx
• .drw
• .dxb
• .eps
• .fla
• .flac
• .fxg
• .java
• .m
• .m4v
• .max
• .mdb
• .pcd
• .pct
• .pl
• .potm
• .potx
• .ppam
• .ppsm
• .ppsx
• .pptm
• .ps
• .r3d
• .rw2
• .sldm
• .sldx
• .svg
• .tga
• .wps
• .xla
• .xlam
• .xlm
• .xlr
• .xlsm
• .xlt
• .xltm
• .xltx
• .xlw
• .act
• .adp
• .al
• .1
• .bkp
• .blend
• .cdf
• .cdx
• .cgm
• .cr2
• .crt
• .dac
• .dbf
• .dcr
• .ddd
• .design
• .dtd
• .fdb
• .fff
• .fpx
• .h
• .iif
• .indd
• .jpeg
• .mos
• .nd
• .nsd
• .nsf
• .nsg
• .nsh
• .odc
• .odp
• .pas
• .pat
• .pef
• .pfx
• .ptx
• .qbb
• .qbm
• .sas7bdat
• .say
• .st4
• .st6
• .stc
• .sxc
• .tlg
• .wad
• .xlk
• .aiff
• .bmp
• .cmt
• .dat
• .dit
• .edb
• .flvv
• .avhd
• .back
• .c
• .ctl
• .dbf
• .disk
• .dwg
• .gz
• .mail
• .nrg
• .ora
• .ova
• .ovf
• .pmf
• .ppt
• .pptx
• .pst
• .pvi
• .pyc
• .sln
• .tar
• .vbs
• .vcb
• .vfd
• .vmc
• .vsd
• .vsdx
• .vsv
• .work
• .xvd
• .123
• .3dm
• .602
• .aes
• .asc
• .brd
• .bz2
• .cmd
• .dch
• .dif
• .dip
• .docb
• .frm
• .gpg
• .jsp
• .lay
• .lay6
• .m4u
• .mml
• .myi
• onetoc2
• .PAQ
• .ps1
• .sch
• .slk
• .snt
• .suo
• .tgz
• .tif
• .tiff
• .uop
• .uot
• .vcd
• .wk1
• .wks
• .xlc

It avoids encrypting files found in the following folders:

• BlackRuby
• Chrome
• Mozilla Firefox
• Opera
• YandexBrowser
• Windows Defender
• ESET
• COMODO
• Windows NT
• Windows Kits
• Windows Mail
• Windows Media Player
• Windows Multimedia Platform
• Windows Phone Kits
• Windows Phone
• Microsoft Help
• Microsoft App
• Silverlight Kits
• Kaspersky Lab
• Internet Explorer
• ntldr
• Wsus
• !!Ant
• iCrypto!!
• Windows Slidebar
• WindowsPowerShell
• NVIDIA Corporation
• Outlook Express
• Movie Maker
• AVG
• Avast
• Dr.Web
• Symantec
• Symantec_Client_Security
• McAfee
• Avira
• Microsoft.NET
• Windows Photo Viewer
• Windows Protable Devices
• Certification Kit
• Temp
• sysconfig
• system volume information
• Microsoft Shared
• Common Files
• Public
• Program Files
• ProgramData
• PerfLogs

It appends the following extension to the file name of the encrypted files:

• {Encrypted_}+{Random Characters}.{BlackRuby}

It drops the following file(s) as ransom note: