Ransom.Win32.SEKHMET.C

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %ProgramData%\syscfg.db
• {Encrypted Directory}\{8 random characters}.lnk → Deleted afterwards
• %User Temp%\VS Update\kb948593581.dll

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• "%System%\MsiExec.exe" /Y "%User Temp%\VS Update\kb948593581.dll"

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %User Temp%\VS Update

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\{16 Random Characters}

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• agntsvc.exe
• dbeng50.exe
• dbsnmp.exe
• dumpcap.exe
• encsvc.exe
• excel.exe
• firefoxconfig.exe
• infopath.exe
• ipython.exe
• isqlplussvc.exe
• msaccess.exe
• msftesql.exe
• mspub.exe
• mydesktopqos.exe
• mydesktopservice.exe
• mysqld-nt.exe
• mysqld-opt.exe
• mysqld.exe
• ocautoupds.exe
• ocomm.exe
• ocssd.exe
• onenote.exe
• oracle.exe
• outlook.exe
• powerpnt.exe
• procexp.exe
• procexp64.exe
• procmon.exe
• procmon64.exe
• python.exe
• QBW32.exe
• QBW64.exe
• sqbcoreservice.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlservr.exe
• sqlwriter.exe
• steam.exe
• synctime.exe
• tbirdconfig.exe
• thebat.exe
• thebat64.exe
• thunderbird.exe
• visio.exe
• winword.exe
• wordpad.exe
• wpython.exe
• xfssvccon.exe

Information Theft

This Ransomware gathers the following data:

• User Name
• Computer Name
• Workgroup
• Domain Name
• AV Information
• Drive Information
• GUID
• Product Name
• Display Name
• Systems Architecture
• Operating System
• Processor Information

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• {BLOCKED}.{BLOCKED}.126.81/update.php?id={Random Numbers}
• {BLOCKED}.{BLOCKED}.126.82/update.php?id={Random Numbers}
• {BLOCKED}.{BLOCKED}.126.83/update.php?id={Random Numbers}
• {BLOCKED}.{BLOCKED}.126.84/update.php?id={Random Numbers}
• {BLOCKED}.{BLOCKED}.126.85/update.php?id={Random Numbers}
• {BLOCKED}.{BLOCKED}.126.86/update.php?id={Random Numbers}
• {BLOCKED}.{BLOCKED}.126.87/update.php?id={Random Numbers}
• {BLOCKED}.{BLOCKED}.126.88/update.php?id={Random Numbers}
• {BLOCKED}.{BLOCKED}.126.89/update.php?id={Random Numbers}

Other Details

This Ransomware does the following:

• It checks for the computer's language and terminates itself if any the following language is detected:
  
  • Armenian
  • Azerbaijani
  • Belarusian
  • Georgian
  • Kazakh
  • Kyrgyz
  • Romanian
  • Russian
  • Tajik
  • Tatar
  • Turkmen
  • Ukrainian
  • Uzbek

However, as of this writing, the said sites are inaccessible.

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• autorun.inf
• boot.ini
• desktop.ini
• ntuser.dat
• iconcache.db
• bootsect.bak
• ntuser.dat.log
• thumbs.db
• Bootfont.bin
• RECOVER-FILES.txt

It avoids encrypting files with the following strings in their file path:

• \Windows
• \Program Files
• \Tor Browser
• \ProgramData\
• \cache2\entries\
• \Low\Content.IE5\
• \User Data\Default\Cache\
• \All Users

It renames encrypted files using the following names:

• {Original Filename}.{Original File Extension}.{Random Characters}

It drops the following file(s) as ransom note:

• {Encrypted Directory}\RECOVER-FILES.txt
  

It avoids encrypting files with the following file extensions:

• .lnk
• .exe
• .sys
• .dll