Ransom.Win64.BLACKKINGDOM.YEBCU

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It disables the user's mouse and keyboard. This prevents users from removing this malware from the affected computer.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• {Malware Folder}\{Malware Name}.exe
• %System%\cmd.exe /c powershell Get-Service *sql*|Stop-Service -Force 2>$null
• %System%\cmd.exe /c powershell rm (Get-PSReadlineOption).HistorySavePath

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other System Modifications

This Ransomware disables the user's mouse and keyboard.

Other Details

This Ransomware does the following:

• It uploads its generated encryption key to http://m{BLOCKED}a.io with the following credentials:
  • Username: he{BLOCKED}13608@heroulo.com
  • Password: he{BLOCKED}13608@heroulo.com
• It looks for the file {Malware Folder}\target.txt which contains the list of directories it will encrypt. If not found it will start from %System Root%.
• It clears event logs.
• It shows the following window after encryption:
  

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• %System Root%\ProgramData
• %System Root%\Windows
• %System Root%\Program Files
• %System Root%\Program Files (x86)
• \AppData\Roaming\
• \AppData\LocalLow\
• \AppData\Local\

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It appends the following extension to the file name of the encrypted files:

• .{Random Characters}

It drops the following file(s) as ransom note:

• {Encrypted Directory}\decrypt.TxT