Ransom.MSIL.CORVINA.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It propagates via shared networks and drops copies of itself into available networks.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• %AppDataLocal%\{filename}{file extension}
• filename can be any of the following:
  • lsass
  • csrss
  • avp
  • winlogon
  • cacls
  • cftmon
  • GrooveMonitor
  • scvhost
  • inetinf
  • spoolsv
  • drwtsn
  • MSServer
  • rundll32
  • dumprep
  • Cmdlg
  • msiexec
  • ccEtvMgr
  • wuauclt
  • osk
  • sihost
• file extension can be any of the following:
  • .exe
  • .src

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 2A2B2425586352797054307225242B2A

Autostart Technique

This Ransomware drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• 0f81f97a-aaa6-4401-ae29-184e4f718009.lnk - dropped copy
• c4e69908-3cf5-42d4-b396-ca66b478f349.lnk - ransom note

Propagation

This Ransomware propagates via shared networks and drops copies of itself into available networks.

Information Theft

This Ransomware gathers the following data:

• Machine Name
• User Name
• Current date and time
• Hardware identification
• Randomly generated password

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• https://n2019cov.{BLOCKED}hostapp.com/prueba.php

Other Details

This Ransomware does the following:

• Encrypts files in all the drives except files in protected folders
• Checks if:
  • VM is present
  • Operating system is Windows XP
  • Debugger is Attached
  • SbieDll.dll is loaded
  • vboxhook.dll is in environment variable
  • If any of the conditions above is met it starts the following process:
  • cmd.exe /c ping0 -n 2 & del\{malware path and filename}
  • ping 0 -n 2
• Drops copies of itself via shared network:
  • %SystemRoot%\User\{string1}{string2}
  • string1 can be any of the following:
  • video
  • foto
  • amor
  • sexo
  • secreto
  • string2 can be any of the following:
  • .pif
  • .com
  • .scr

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .doc
• .docx
• .xslx
• .xls
• .pdf
• .jpg
• .bmp
• .ppt
• .pptx
• .txt
• .gif
• .jpeg
• .png
• .psd
• .dwg

It appends the following extension to the file name of the encrypted files:

• .P4WN3D

It drops the following file(s) as ransom note:

• %AppDataLocal%\1nF0rM@t1On.txt