Ransom.Win32.TORTOISE.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files found in specific folders.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %Temp%\crash.txt -> contains decryption key
• %Temp%\id.txt -> contains the ID

(Note: %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

Other Details

Based on analysis of the codes, it has the following capabilities:

• It sends the decryption key to the following emails:
  • {BLOCKED}2017@gmail.com
  • {BLOCKED}myst@gmail.com
• It uses the following credentials to login to gmail.com:
  • Email address - {BLOCKED}2017@gmail.com
  • Password - {BLOCKED}f

It displays the following message boxes:

Ransomware Routine

This Ransomware encrypts files found in the following folders:

• %User Profile%

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It appends the following extension to the file name of the encrypted files:

• .TORTOISE