Ransom.Win32.MAKOP.GAIN

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following folders:

• %User Temp%\{Random Characters}.tmp
• %Programs%\JRE Test

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Programs% is the folder that contains the user’s program groups, which is usually C:\Windows\Start Menu\Programs or C:\Documents and Settings\{User name}\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.)

It drops the following files:

• %Programs%\JRE Test\Uninstall.lnk → points to %Application Data%\uninstall.exe
• %Programs%\JRE Test\JRE Test.lnk → points to %Application Data%\jretext.exe
• %Application Data%\402991629
• %User Temp%\{Random Characters}.tmp\System.dll

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• {Malware Path}\{Malware Filename}.exe
• vssadmin delete shadows /all /quiet → deletes shadow copies
• wbadmin delete catalog -quiet → deletes backup catalog
• wmic shadowcopy delete → deletes shadow copies

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• m23071644

It injects codes into the following process(es):

• created {Malware Path}\{Malware Filename}.exe process

Other System Modifications

This Ransomware deletes the following files:

• %User Temp%\{Random Characters}.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• agntsrvc.exe
• dbeng50.exe
• dbsnmp.exe
• encsvc.exe
• excel.exe
• firefoxconfig.exe
• infopath.exe
• isqlplussvc.exe
• msaccess.exe
• msftesql.exe
• mspub.exe
• mydesktopqos.exe
• mydesktopservice.exe
• mysqld-nt.exe
• mysqld-opt.exe
• mysqld.exe
• ocautoupds.exe
• ocomm.exe
• ocssd.exe
• onenote.exe
• oracle.exe
• outlook.exe
• powerpnt.exe
• sqbcoreservice.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlservr.exe
• sqlwriter.exe
• steam.exe
• synctime.exe
• tbirdconfig.exe
• thebat.exe
• thebat64.exe
• thunderbird.exe
• visio.exe
• winword.exe
• wordpad.exe
• xfssvccon.exe

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• boot.ini
• bootfont.bin
• ntldr
• ntdetect.com
• io.sys
• readme-warning.txt
• desktop.ini

It avoids encrypting files found in the following folders:

• RECYCLER
• chrome
• mozilla firefox
• internet explorer
• windows
• winnt
• C:\Windows
• C:\ProgramData\microsoft\windows\caches
• C:\Users\All Users\Microsoft\Windows\Caches
• C:\ProgramData
• C:\Users

It renames encrypted files using the following names:

• {Original Filename}.{Original File Extension}.[{8 Random Characters}].[{BLOCKED}o0213@airmail.cc].vassago

It drops the following file(s) as ransom note:

• {Encrypted Directory}\readme-warning.txt

It leaves text files that serve as ransom notes containing the following text:

It avoids encrypting files with the following file extensions:

• .makop
• .CARLOS
• .shootlock
• .shootlock2
• .1recoesufV8Sv6g
• .1recocr8M4YJskJ7
• .btc
• .KJHslgjkjdfg
• .origami
• .tomas
• .RAGA
• .zbw
• .fireee
• .XXX
• .element
• .HELP
• .zes
• .lockbit
• .captcha
• .gunga
• .fair
• .SOS
• .Boss
• .moloch
• .vassago
• .exe
• .dll