Trojan.BAT.RAMONWARE.THJOEBC

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• taskkill /f /im explorer.exe
• taskkill /f /im taskk.exe /t
• start explorer.exe
• 7z a -p"%password%" -mhe=on -mx9 "%%~dpnA.7z" "%%A"
• %Application Data%\Microsoft\Windows\Start Menu\Programs\Startup\{Malware file name}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Trojan encrypts files with the following extensions:

• .txt
• .doc
• .xlsx

It does the following:

• Attempts to archive folders in %User Profile%\Documents and %User Profile%\Downloads using 7z
• Attempts to add user account with random name
• Attempts to create {random}\folder

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Ransomware Routine

This Trojan appends the following extension to the file name of the encrypted files:

• .enc

It drops the following file(s) as ransom note:

• %User Profile%\Desktop\how_to_recover_ur_files.txt