RANSOM_HPCERBER.SMONT4

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

It deletes the initially executed copy of itself. It is capable of encrypting files in the affected system.

Arrival Details

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

Installation

This Trojan drops the following files:

• %User Temp%\{random file name}.bmp
• {folders containing encrypted files}\README.hta

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%\{random file name}.bmp

Other Details

This Trojan renames encrypted files using the following names:

• {10 Random Characters}.{4 Random}

It deletes the initially executed copy of itself

It is capable of encrypting files in the affected system.