TROJ_RANSOM.NS

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\{GUID}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
CryptoLocker = "%Application Data%\{GUID}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\CryptoLocker

HKEY_CURRENT_USER\Software\CryptoLocker\
Files

It adds the following registry entries:

HKEY_CURRENT_USER\Software\CryptoLocker
VersionInfo = "{random values}"

HKEY_CURRENT_USER\Software\CryptoLocker
PublicKey = "{random values}"

Information Theft

This Trojan accepts the following parameters:

• /w00000084 - execute itself

Other Details

This Trojan encrypts files with the following extensions:

• *.accdb
• *.arw
• *.bay
• *.cdr
• *.cer
• *.crt
• *.crw
• *.dbf
• *.dcr
• *.der
• *.dng
• *.doc
• *.docm
• *.docx
• *.dwg
• *.dxf
• *.dxg
• *.eps
• *.erf
• *.indd
• *.kdc
• *.mdb
• *.mdf
• *.mef
• *.mrw
• *.nef
• *.nrw
• *.odb
• *.odc
• *.odm
• *.odp
• *.ods
• *.odt
• *.orf
• *.pdd
• *.pef
• *.pem
• *.pfx
• *.pptm
• *.ppt
• *.pptx
• *.psd
• *.pst
• *.ptx
• *.raf
• *.raw
• *.rtf
• *.rwl
• *.srf
• *.srw
• *.wpd
• *.wps
• *.xlk
• *.xlsb
• *.xlsm
• *.xlsx
• *.xls
• ????????.jpe
• ????????.jpg
• img_*.jpg

It deletes itself after execution.

NOTES:

This ransomware connects to the following IP address to download the key used in encrypting the files:

• {BLOCKED}.{BLOCKED}.136.134

It also connects to random generated IP addresses with the following extensions:

• com
• net
• biz
• org
• co.uk
• info
• ru

It demands users to pay a fine via any of the following payment methods:

• MoneyPak
• Ukash
• cashU
• Bitcoin

This malware uses a random-generated AES key with a public RSA key to encrypt files.