Ransom.Win32.BTCAZADI.THDBIBD

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• %System%cmd.exe /c vssadmin.exe delete shadows /all /quiet
• %System%cmd.exe /c ping 127.0.0.1 -n 4 > nul & del {Malware File Name}.{Malware File Extension} - if selfdel parameter is used

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\SENATORMutex

Dropping Routine

This Ransomware drops the following files:

• {Malware File Path}\SENATOR.txt → Contains log activities

Information Theft

This Ransomware accepts the following parameters:

• -path → Used to specify the path to encrypt
• -ratio → Used to specify the encryption ratio
• -nomutex → Used to disable mutex creation
• -nonetdrive → Used to disable encryption of network drives
• -selfdel → Used to delete itself after execution

Other Details

This Ransomware does the following:

• It sets the current process priority to highest
• It empties the Recycled Bin
• By default, it encrypts removable, fixed, and remote drives
• It avoids encrypting files with the following file names:
  • autorun.inf
  • boot.ini
  • bootfont.bin
  • bootmgr
  • bootsect.bak
  • desktop.ini
  • iconcache.db
  • ntldr
  • ntuser.dat
  • ntuser.dat.log
  • ntuser.ini
  • SENATOR ENCRYPTED.TXT
  • SENATOR.TXT
  • thumbs.db

Ransomware Routine

This Ransomware avoids encrypting files found in the following folders:

• $RECYCLE.BIN
• $Windows.~bt
• $windows.~ws
• All Users
• Boot
• Config.Msi
• Default
• google
• Intel
• microsoft
• Microsoft Visual Studio 16.0
• MSOCache
• PerfLogs
• Public
• System Volume Information
• tor browser
• Windows
• windows nt
• windows.old
• yandex

It appends the following extension to the file name of the encrypted files:

• {Original File Name}.{Original Extension}.EMAIL=senatorrans@gmail.com]ID=[{Decryption ID}].SENATOR

It drops the following file(s) as ransom note:

• {Encrypted File Path}\SENATOR_ENCRYPTED.txt
  

It avoids encrypting files with the following file extensions:

• .drv
• .efi
• .lnk
• .msi
• .SENATOR
• .sys