Ransom.Win32.NEFILIM.G

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\scam.jpg

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• "%System%\cmd.exe" /c WmIc ShaDowcoPY delEte - delete shadow copies

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• ONA MOYA ROZA I YA EE LUBLUUUUUUUU, ONA MOYA DOZA - SEGODNYA ZATYANU

Other System Modifications

This Ransomware changes the desktop wallpaper by modifying the following registry entries:

HKEY_CURRENT_MACHINE\Control Panel\Desktop
Wallpaper = %User Temp%\scam.jpg

It sets the system's desktop wallpaper to the following image:

Other Details

This Ransomware does the following:

• It encrypts files in fixed, removable, and network drives
• It can accept arguments to specify which file or folder to encrypt

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• $recycle.bin
• rsa
• ntuser.dat
• programdata
• appdata
• program files
• program files (x86)
• windows

It appends the following extension to the file name of the encrypted files:

• .OFFWHITE

It drops the following file(s) as ransom note:

• {Drive Letter}:\OFFWHITE-MANUAL.txt
  

It avoids encrypting files with the following file extensions:

• .exe
• .log
• .cab
• .cmd
• .com
• .cpl
• .ini
• .dll
• .url
• .ttf
• .mp3
• .pif
• .mp4
• .OFFWHITE
• .msi