Ransom.Win32.CONTI.FAJF

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• {Log File Path}\{Log Filename} → If -log argument is used

Agrega los procesos siguientes:

• cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{Shadowcopy ID}'" delete → repeated depending on the number of shadow copies

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

• YUIOGHJKCVVBNMFGHJKTYQUWIETASKDHGZBDGSKL237782321344

Otros detalles

Hace lo siguiente:

• It uses the Windows Restart Manager to unlock files it will encrypt.
• When encrypting network shares it will check if the IP address starts with the following to ensure that it is encrypting local, non-Internet, systems:
  • 172.
  • 192.168.
  • 10.
  • 169.
• It accepts the following parameters:
  • -m {all|local|net|backups}
  • all - combination of net and local
  • local - delete backups and encrypt only locally found drives
  • net - delete backups and encrypt only network shares
  • backups - delete backups
  • -p {Directory} - Will encrypt first the folders in the list before proceeding to the others
  • -log {Log File Path}\{Log Filename} - Log output to {Log File Path}\{Log Filename}
  • -nomutex - Creates no mutex allowing multiple process
  • -size {chunk mode}
• By default, it encrypts local drives, removable drives and network shares