Home / malware

PDF

Ransom:Win32/Kitoles.A

First posted on 23 November 2017.
Source: Microsoft

Aliases :

There are no other names known for Ransom:Win32/Kitoles.A.

Explanation :

Installation

This threat can use any of the following file names:

• ADMIN.exe
• locker.exe
• locker_no_amd.exe
• net_local.exe
• sevnz.exe
• svchoste.exe
• systemp.exe

When run, this threat prompts to be given elevated access. Whether or not it is given elevated access, however, this threat continues with its malicious activity.

It drops a copy of itself in the %APPDATA% folder. It then uses the legitimate program mshta.exe to run this new malware copy and delete itself. It also uses mshta.exe to create a registry entry that automatically runs the new malware copy every time the system starts.

Payload

Encrypts files

This threat has an embedded configuration file through which its features can be controlled.

It can connect to a configured URL to report statistics about the infected machine. We have seen this threat connect to the following URL:

• hxxps://iplogger[.]com/1bmym6[.]gif

It can encrypt files on all drives and network shares. Based on the configuration, it can also encrypt file names and file name extensions and append a configurable file name extension. We have this seen threat use the following file name extensions for encrypted files:



For the encryption routine, the configuration requires a modulus N and a public exponent E to be specified in order to generate the public RSA key to be used for encryption.

Although it has the option to encrypt all file types, we've seen samples with a large set of file name extensions configured:

$efs .nrg .0 .00 .000 .0001 .0002 .0003 .0004 .0005 .0006 .0007 .0008 .0009 .001 .001 .0011 .0012 .0013 .0014 .0015 .0016 .0017 .0018 .0019 .002 .002 .0021 .0022 .0023 .0024 .0025 .0026 .0027 .0028 .0029 .003 .003 .004 .005 .006 .007 .008 .009 .00a .00b .00c .00d .00e .00f .00g .00h .00i .00j .00k .00l .00m .00n .00o .00p .00q .00r .00s .00t .00u .00v .00w .00x .00y .00z .010 .011 .012 .013 .014 .015 .016 .017 .018 .019 .02 .021 .022 .023 .024 .025 .026 .027 .028 .029 .030 .031 .032 .033 .034 .035 .036 .037 .038 .039 .040 .041 .042 .043 .044 .045 .046 .047 .048 .049 .050 .051 .052 .053 .054 .055 .056 .057 .058 .059 .06 .061 .062 .063 .064 .065 .066 .067 .068 .069 .070 .071 .072 .073 .074 .075 .076 .077 .078 .079 .080 .081 .082 .083 .084 .085 .086 .087 .088 .089 .090 .091 .092 .093 .094 .095 .096 .097 .098 .099 .0r8 .1 .10 .100 .101 .103 .108 .11 .11 .111 .123 .128 .1cd .1sp .1st .2 .200 .22 .222 .264 .2q0 .2qm .3 .30 .300 .33 .333 .3c .3d .3d4 .3dd .3df .3df8 .3dm .3dr .3ds .3dxml .3fr .3g2 .3ga .3gp .3gp2 .3mm .3pr .3w .4 .400 .44 .444 .4dd .4w7 .5 .5 .55 .555 .6 .600 .602 .66 .666 .7 .700 .73i87a .77 .777 .7z .7zip .8 .8 .806dy .88 .888 .89t .89y .8ba .8bc .8be .8bf .8bi8 .8bl .8bs .8bx .8by .8li .8svx .8xt .9 .900 .99 .999 .9xt .9xy .a .a$v .a2c .a5zfn .a90 .aa .aa3 .aaa .aac .aaf .aah .aaui .ab4 .ab65 .abc .abf .abk .abt .abw .ac2 .ac3 .ac5 .acc .accdb .accde .accdr .accdt .ace .acf .ach .acl .acp .acr .acrobatsecuritysettings .acrodata .acroplugin .acrypt .acsi .acsm .act .act3d .ad .ad3 .ada .adb .adc .add .ade .adf .adi .adl .adm .adml .admx .adoc .ados .adox .adp .adpb .adr .ads .adt .aea .aec .aep .aepx .aes .aet .afdesign .aff .afm .afp .agd1 .agdl .age3rec .age3sav .age3scn .age3xrec .age3xsav .age3xscn .age3yrec .age3ysav .age3yscn .ahf .ahi .ahstore .ai .aif .aiff .aim .aip .ais .ait .ak .al .al8 .ala .alb3 .alb4 .alb5 .alb6 .ald .alf .ali .allet .alm .alt .alt3 .alt5 .aly .am .amf .aml .amr .amt .amu .amx .amxx .anekspakiet .aneksskrypt .anl .ann .ans .ansr .anx .aod .aoi .ap .apa .apd .ape .apf .api .apj .apk .apnx .apo .app .approj .apr .apt .apw .apxl .arc .arch00 .ard .arf .arff .ari .arj .aro .arr .ars .art .arv .arw .as .as$ .as3 .asa .asc .ascm .ascx .asd .ase .asf .ashx .ask .asl .asm .asmx .asn .asnd .asp .aspx .asr .asset .ast .asv .asvx .asx .ath .atl .atomsvc .atw .auc .automaticdestinations-ms .aux .av .avd .avdata .avhd .avhdx .avi .avn .avs .awd .awe .awg .awp .aws .awt .aww .awwp .ax .axc .axmodelstore .axx .azf .azs .azw .azw1 .azw3 .azw4 .b .b27 .b2a .b5i .ba0 .ba1 .ba10 .ba2 .ba3 .ba4 .ba5 .ba6 .ba7 .ba8 .ba9 .bac .back .backup .backup0 .backup1 .backup2 .backup3 .backup4 .backup5 .backup6 .backup7 .backup8 .backup9 .backupdb .bad .bak .bak~ .bak1 .bak2 .bak3 .bak4 .bal .bamboopaper .bank .bar .bas .bat .bau .bax .bay .bbcd .bbl .bbprojectd .bbs .bbxt .bc5 .bc6 .bc7 .bcd .bck .bco .bcp .bda .bdb .bdb2 .bdp .bdr .bdt .bdt2 .bdt3 .bean .benchmark .bfa .bgt .bgv .bi8 .bib .bibtex .bic .big .bik .bil .bin .bina .bitstak .bizdocument .bjl .bk .bk! .bk1 .bk2 .bk3 .bk4 .bk5 .bk6 .bk7 .bk8 .bk9 .bkf .bkg .bkp .bks .bkup .bld .blend .blend2 .blg .blk .blm .blob .blp .bmc .bmf .bmk .bml .bmm .bmml .bmp .bmpr .bna .bnd .boc .book .bop .bp1 .bp2 .bp3 .bpdx .bpf .bpk .bpl .bpm .bpmc .bps .bpw .brd .breaking_bad .brh .brl .brs .brx .bsa .bsk .bso .bsp .bst .bt .btc .btd .btf .btoa .btw .btx .bup .burn .burntheme .bus .bvd .bwd .bwf .bwp .bxx .bzabw .c .c2d .c2e .c6 .cab .cache .cad .cadoc .cae .cag .calca .cam .camproj .camrec .cap .capt .car .caro .cas .cat .catdrawing .catpart .catproduct .cawr .cba .cbf .cbor .cbr .cbu .cbz .cc .ccc .cccrrrppp .ccd .ccf .cch .ccitt .cd .cd1 .cd2 .cdc .cdd .cddz .cdf .cdi .cdk .cdl .cdm .cdml .cdmm .cdmz .cdn .cdpz .cdr .cdr3 .cdr4 .cdr5 .cdr6 .cdrw .cds .cdt .cdtx .cdu .cdx .cdxml .ce1 .ce2 .cef .cer .cerber .cerber2 .cerber3 .cert .cf .cf5 .cfd .cfg .cfp .cfr .cfs .cfu .cfx .cgf .cgfiletypetest .cgi .cgm .cgp .chi .chk .chm .chml .chmprj .chp .chpscrap .cht .chtml .ci .cib .cida .cif .cipo .civ4worldbuildersave .civbeyondswordsave .cl2arc .cl2doc .clam .clarify .class .clb .clkd .clkt .clp .clr .cls .clx .cly .cmake .cmd .cmf .cml .cmp .cms .cmt .cmu .cnf .cng .cnt .cnv .cod .col .com .comicdoc .comiclife .compositionmodel .compositiontemplate .con .conf .config .contact .converterx .coverton .cp .cpbdf .cpc .cpd .cpdt .cphd .cpi .cpio .cpp .cps .cpy .cr2 .crashed .craw .crb .crd .creole .cri .crinf .crjoker .crl .crptrgr .crs .crs3 .crt .crtr .crw .crwl .cry .cryp1 .crypt .crypted .cryptolocker .cryptowall .cryptra .crypz .crysis .cs .cs8 .csa .cse .csh .cshtml .csi .csl .cso .csp .csproj .csr .css .cst .csv .csw .ctb .ctbl .ctd .cte .ctf .ctl .ctt .ctxt .cty .cuc .cue .current .cvj .cvl .cvw .cw3 .cwf .cwk .cwn .cwr .cws .cwwp .cyi .cys .czs .czvxce .d .d2s .d3dbsp .dac .dadx .dag .dal .dap .dar .darkness .das .dash .dat .dat_bak .data .database .datx .dav .dayzprofile .dazip .db .db_journal .db0 .db3 .dba .dbb .dbc .dbd .dbf .dbfv .db-journal .dbk .dbr .dbs .dbx .dc2 .dc4 .dca .dcd .dcf .dch .dcl .dcm .dco .dcp .dcr .dcs .dct .dct5 .dcu .ddc .ddcx .ddd .ddf .ddif .ddoc .ddrw .dds .deb .debian .dec .decryptional .ded .def .default .del .dem .deploy .der .des .desc .description .design .desklink .deskthemepack .det .deu .dev .dex .dfb .dfe .dfl .dfm .dft .dfti .dgc .dgm .dgpd .dgr .dgrh .dgs .dharma .dhe .dia .dic .did .dif .dii .dim .dime .dip .dir .directory .disc .disco .disk .dit .divx .dix .diz .djbz .djv .djvu .dk .dk@p .dl5 .dlc .dlg .dll .dlm .dmbk .dmg .dmp .dmp1 .dmp2 .dmp3 .dmp4 .dmp5 .dmp6 .dmp7 .dmp8 .dmp9 .dmt .dmtemplate .dmv .dmx .dna .dng .dnl .dob .doc .doc# .docb .doce .docenx .dochtml .docl .docm .docmhtml .docs .docset .docstates .doct .documentrevisions-v100 .docx .docxl .docxml .dof .dok .dot .dothtml .dotm .dotmenx .dotx .dotxenx .dox .doxy .doz .dp .dpd .dpf .dpi .dpk .dpl .dpp .dpr .dr .drd .dream .drf .drm .drmx .drmz .drv .drw .dsc .dsd .dsdic .dsf .dsg .dsh .dsk .dsl .dsn .dsp .dsy .dt .dtd .dtddb .dtm .dtml .dtp .dtpage .dtrestore .dtsx .dtx .dtxl .dump .dvb .dvd .dvi .dvr .dvs .dvsdrw .dvx .dvz .dwd .dwdoc .dwf .dwfx .dwg .dwlibrary .dwp .dwt .dxb .dxd .dxe .dxf .dxg .dxn .dxr .dxstudio .dzp .e .e3s .e4a .easmx .ebk .ebs .ec4 .ecc .eco .ecr .edb .edd .edf .edi .edl .edml .edn .edoc .edrwx .edt .edz .efa .efax .efd .eff .efi .efl .efm .efr .eftx .efu .efx .egg .egr .egt .ehp .eif .eip .ekm .el6 .eld .elf .elfo .eln .elo .email .emc .emf .eml .emlxpart .emm .enc .enciphered .encrypt .encrypted .enfpack .enigma .ent .env .enx .enyd .eob .eot .ep .epdf .epf .epk .epp .eprtx .eps .epsf .ept .epub .epx .eql .erbsql .erd .ere .erf .erl .err .es .es3 .esc .esd .esf .esm .esp .esql .ess .est .esv .et .ete .etng .etnt .ets .etx .euc .evn .evo .evtx .evy .ewl .ex .exc .exd .exe .exf .exif .exprwdhtml .exprwdxml .exss .exx .eye .ez .ezc .ezm .ezs .ezz .f .f4v .f90 .f96 .fac .fadein .fae .fantom .faq .fax .fbd .fbk .fbp6 .fbs .fcd .fcf .fcstd .fd .fdb .fdf .fdoc .fdr .fds .fdseq .fdw .fdx .fed .feed-ms .feedsdb-ms .ff .ff2 .ffa .ffd .ffdata .fff .ffl .ffo .fft .ffx .fh .fhd .fig .fin .fk .fkc .fkx .fl .fla .flac .flag .flat .flf .flib .flk .flka .flkb .flm .flp .fls .flt .fltr .flv .flvv .fly .fm .fm3 .fmc .fmd .fmf .fml .fmp .fmp3 .fmt .fmx .fnc .fnf .fo .fob .fodg .fodp .fods .fodt .folio .for .forge .fos .fountain .fp .fp7 .fpage .fpdoclib .fpenc .fphomeop .fpk .fplinkbar .fpp .fpt .fpx .fra .frag .frdat .frdoc .freepp .frelf .frf .frm .frx .fs .fsc .fsd .fsf .fsh .fsp .fss .ft10 .ft11 .ft7 .ft8 .ft9 .ftil .ftr .ful .fun .fwk .fwtemplate .fxd .fxg .fxo .fxp .fxr .fzh .fzip .g .g32 .ga3 .gam .gan .gbk .gbkk .gcsx .gct .gdb .gdbindexes .gdbtable .gdbtablx .gdc .gdoc .ged .gem .geo .gev .gevl .gfe .gform .gfx .ggb .ghe .gho .gif .gil .giw .glink .glk .glo .globe .glos .gly .gm .gml .gmp .gmu .gmx .gnd .gno .gofin .good .gp4 .gpc .gpd .gpf .gpg .gpn .gpx .gpz .gr .gra .grade .gray .grey .grf .grk .grle .groups .grs .grx .gry .gs .gsa .gsf .gsheet .gslides .gsm .gthr .guess .gui .gul .gvi .gxk .gxl .gz .gzig .gzip .h .h1q .h1s .h1w .h2o .h3m .h4r .ha3 .haml .hbk .hbl .hbx .hcl .hcw .hda .hdb .hdd .hdl .hds .hdt .hdx .hed .help .helpindex .herbst .hex .hfd .hfmx .hft .hgt .hhs .hightex .his .hive .hkdb .hkx .hld .hlf .hlp .hlx .hlx2 .hlz .hm2 .hmskin .hnd .hoi4 .hot .hp2 .hpd .hpj .hplg .hpo .hpp .hps .hpt .hpw .hqx .hrx .hs .hsm .hsx .hta .htm .htm~ .html .htmls .htmlz .htms .htpasswd .htz5 .hur .hvpl .hw3 .hwp .hwpml .hwt .hxe .hxi .hxq .hxr .hxs .hyp .hype .i .i00 .i01 .i02 .i03 .i04 .i05 .iab .iaf .ial .iam .iar .ib .ibank .ibcd .ibd .ibk .ibu .ibz .icalevent .icaltodo .icc .icm .icml .icmt .ico .ics .icst .icxs .idap .idc .idd .idl .idml .idp .idw .idx .ie5 .ie6 .ie7 .ie8 .ie9 .ienc .iff .ifp .ign .igr .igs .ihf .ihp .iif .iiq .iks .ila .ildoc .img .imp .imr .incp .incpas .ind .indb .indd .index .indl .indp .indt .inf .info .inform .inform_connected .ini .ink .inld .inlk .inp .inprogress .inrs .inss .installhelper .installstate .insx .int .internetconnect .inv .inx .ioca .iof .ipa .ipe .ipf .ipr .ipt .iqd .irx .ish1 .ish2 .ish3 .iso .ispx .isu .isz .itc2 .itdb .ite .itl .itm .itmz .itp .its .iv2i .iva .ivt .iw44 .iwa .iwd .iwi .iwprj .iwtpl .ix .ixv .j .jac .jar .jav .java .jb2 .jbc .jbig .jbig2 .jc .jdd .jfif .jge .jgz .jhd .jiaf .jias .jif .jiff .jnt .job .joe .jp1 .jpc .jpe .jpeg .jpf .jpg .jpgx .jpm .jpw .jrc .jrf .jrl .jrprint .jrs .js .jsd .json .jsp .jspa .jspx .jtd .jtdc .jtt .jtv .jtx .just .jw .jwl .jww .k .k25 .kbd .kbf .kc2 .kdb .kdbx .kdc .kde .kdf .kdx .kernel_complete .kernel_pid .kernel_time .kes .key .keybtc@inbox_com .keynote .key-tef .kf .kfm .kfp .kgb .khi .khstore .kid .kimcilware .kkk .klp .klq .klw .kmz .knf .knt .kod .kom .kos .kpdx .kpr .kpxe .kraken .kratos .ksb .ksb2 .ksd .ksp .kss .ksw .kuip .kum .kwd .kwm .kwp .l .laccdb .lastlogin .lat .latex .lax .lay .lay6 .layout .lbf .lbi .lbl .lcd .lcf .lck .lcn .lct .ldb .ldc .ldf .ldm .lechiffre .legion .len .lfe .lgd .lgf .lgp .lhd .lib .lic .lid .lit .litemod .ll3 .llv .lmd .lng .lngttarch2 .lnk .localstorage .lock .locked .locky .loe .log .logonxp .lok .lol! .lot .lp .lp2 .lp7 .lpa .lpc .lpd .lpdf .lpx .lrf .lrg .ls5 .lsf .lst .lstore .ltcx .ltm .ltr .ltx .lua .lvd .lvivt .lvl .lvw .lwd .lwl .lwo .lwp .lyr .lyx .lz .lzf .lzx .m .m13 .m14 .m2 .m2ts .m3u .m3u8 .m4 .m4a .m4l .m4p .m4t .m4u .m4v .m7g .m7p .ma0 .ma1 .mac .maca .mag .magic .maker .maml .man .manifest .manu .map .mapimail .marc .mark .markdn .mars .mass .max .maxfr .maxm .mbbk .mbox .mbx .mc9 .mcd .mcdx .mcf .mcgame .mcmac .mcmeta .mcp .mcrp .mcw .md .md0 .md1 .md2 .md3 .md5 .mda .mdb .mdbackup .mdbhtml .mdc .mdccache .mddata .mde .mdf .mdg .mdi .mdk .mdl .mdn .mds .mdt .mecontact .med .mef .meh .mell .mellel .menu .meo .met .metadata_never_index .mf .mfa .mfp .mfw .mga .mgj .mgmt .mgourmet .mgourmet3 .mhp .mht .mhtenx .mhtml .mhtmlenx .mi .mic .micro .mid .mif .mig .mim .mime .mindnode .mip .mission .mix .mjd .mjdoc .mkd .mke .mkr .mks .mkv .mla .mlb .mlj .mlm .mlo .mls .mlsxml .mlx .mm .mm2se .mm6 .mm7 .mm8 .mmap .mmc .mmd .mme .mmjs .mml .mmo .mmsw .mmw .mnu .mny .mo .mobi .mod .moneywell .mos .mov .movie .moz .mp1 .mp2 .mp3 .mp4 .mp4v .mpa .mpe .mpeg .mpf .mpg .mph .mpj .mpp .mpq .mpqge .mpr .mpt .mpv .mpv2 .mrd .mrimg .mrk .mrom .mru .mrw .mrwref .ms .msb .msd .mse .msg .mshc .msi .msie .msl .mso .msor .msp .msq .mst .ms-tnef .msu .msw .mswd .mta .mtdd .mtml .mto .mtp .mts .mtx .mua .mug .mui .mvd .mvdx .mvex .mwd .mwii .mwpd .mwpp .mws .mxd .mxg .mxl .mxp .myapp .myd .mydocs .myi .myo .mz .n .n3 .nar .narrative .nav .navmap .nb .nba .nbak .nbf .nbp .nbu .ncc .ncd .ncf .nd .ndd .ndf .ndl .ndr .nds .ne0 .ne1 .ne3 .nef .nfo .nfs11save .ng .nit .njx .nk2 .nmbtemplate .nmu .nokogiri .nom .nop .note .now .npd .npdf .npp .npt .nrbak .nrg .nri .nrl .nrmlib .nrw .ns .ns2 .ns3 .ns4 .nsd .nsf .nsg .nsh .nst .ntf .ntl .ntp .nts .ntx .number .numbers .nup .nvd .nvdl .nvram .nwb .nwbak .nwcab .nwcp .nwd .nx^d .nx__ .nx1 .nx2 .nxl .nyf .nzb .o .oa2 .oa3 .oab .oad .oas .obd .obj .obr .obt .obx .obz .ocdc .ocr .ocs .ocx .oda .odb .odc .odccubefile .odcodc .odf .odg .odh .odi .odif .odm .odo .odp .ods .odt .odt# .odttf .odz .officeui .ofn .oft .oga .ogc .ogg .oil .ojz .okm .old .ole .ole2 .olf .olv .oly .omg .omlog .omp .onb .one .oos .oot .opal .opax .opd .opf .opj .oplx .opn .opt .opx .opxs .orf .org .ort .osd .osdx .osf .ost .ostore .otc .otf .otg .oth .oti .otn .otp .ots .ott .otw .out .ova .ovd .ovr .owl .oxf .oxps .oxt .p .p10 .p12 .p2s .p3 .p3x .p5tkjw .p65 .p7b .p7c .p7m .p7z .pab .pack .pad .padcrypt .pages .pages-tef .pak .paq .par .partial .pas .pat .paux .paym .paymrss .payms .paymst .paymts .payrms .pays .pbd .pbf .pbk .pbp .pbr .pbs .pbx5script .pbxscript .pcd .pcf .pcj .pct .pcv .pcw .pd .pdb .pdc .pdcr .pdd .pdf .pdf_ .pdf_profile .pdf_tsid .pdfa .pdfe .pdfenx .pdfl .pdfua .pdfvt .pdfx .pdfxml .pdfz .pdg .pdj .pdl .pdp .pdz .peb .pef .pem .pez .pf .pfc .pfd .pfl .pfm .pfp .pfr .pfsx .pft .pfx .pg .pgs .php .phr .phs .pif .pih .pixexp .pj2 .pj4 .pj5 .pk .pkb .pkey .pkg .pkh .pkpass .pl .plan .plb .plc .pld .pli .pln .pls .plt .plus_muhd .ply .pm .pm3 .pm4 .pm5 .pm6 .pm7 .pmd .pmt .pmv .pmx .png .pnm .pnu .po .poar2w .pod .poi .pool .pot .pothtml .potm .potx .pp3 .ppam .ppd .ppdf .ppf .ppj .ppk .ppl .ppp .ppr .pps .ppsenx .ppsm .ppsx .ppt .ppte .pptf .ppthtml .pptl .pptm .pptmhtml .pptt .pptx .ppws .ppx .prc .prd .pre .pref .prel .prf .prj .prn .pro .pro4 .pro4dvd .pro5 .pro5dvd .pro5plx .pro5x .proc .proofingtool .props .proqc .prproj .prr .prs .prt .prtc .prv .prz .ps .ps1 .ps2 .ps3 .psa .psafe3 .psb .psd .pse8db .psf .psg .psi2 .psip .psk .psm .psm1 .psmd .pspimage .pst .psw .psw6 .pswx .psz .pt3 .pt6 .ptb .ptc .ptf .pth .ptk .ptn .ptn2 .ptr .pts .ptx .pub .pubf .pubhtml .pubmhtml .pubx .purge .puz .pvc .pvd .pve .pvf .pw .pwd .pwe .pwf .pwi .pwm .pwp .pwre .pxd .pxl .pxp .py .pyd .pyi .pys .pzc .pzdc .pzf .pzt .q .qba .qbb .qbl .qbm .qbr .qbw .qbx .qby .qch .qcow .qcow2 .qct .qdf .qed .qel .qfl .qfxx .qhp .qht .qhtm .qic .qif .qlgenerator .qm .qnr .qpm .qpx .qr2 .qr3 .qrt .qsd .qt .qtq .qtr .qtw .qtx .quox .qvw .qwd .qwt .qxb .qxd .qxl .qxp .qxt .r .r00 .r01 .r02 .r03 .r0f .r0z .r3d .r5a .ra .ra2 .raf .ram .ramd .rap .rar .rat .raw .razy .rb .rbc .rc .rcb .rd .rd1 .rdb .rdf .rdfs .rdi .rdl .rdlc .rdm .rdo .rdoc .rdoc_options .rdp .rdz .re4 .rec .reg .rekt .rels .rep .res .resbuild .rest .result .resx .rev .rf .rf1 .rft .rgn .rgo .rgss3a .rha .rhif .rhu .rim .rit .rlf .rll .rm .rm5 .rmd .rmf .rmh .rna .rng .rnt .rnw .ro3 .rofl .roi .rokku .rom .ros .rov .row .rox .rpf .rph .rpt .rptr .rqm .rrd .rrk .rrl .rrpa .rrt .rrx .rs .rsdf .rsdoc .rsds .rsm .rsp .rsrc .rst .rsw .rt .rt_ .rtdf .rte .rtf .rtf_ .rtfd .rtk .rtm .rtpi .rts .rtsl .rtsx .rtx .rum .run .rv .rvf .rvt .rw2 .rwl .rwlibrary .rwz .rxdoc .rxl .rzk .rzx .s .s1 .s10 .s11 .s12 .s13 .s14 .s15 .s16 .s17 .s18 .s19 .s2 .s20 .s21 .s22 .s23 .s24 .s25 .s26 .s27 .s28 .s29 .s3 .s3db .s4 .s5 .s6 .s7 .s8 .s8bn .s9 .sa5 .sa7 .sa8 .saas .sad .saf .safe .safetext .sai .sal .sam .sas7bdat .sav .save .say .sb .sbb .sbl .sbn .sbo .sbpf .sbsc .sbst .sbx .sc2save .scd .scdoc .sce .sch .scm .scmt .scn .scp .scr .scriv .scrivx .scs .scspack .scssc .sct .scu .scw .scx .sd .sd0 .sd1 .sda .sdb .sdbz .sdc .sdd .sddraft .sdf .sdi .sdl .sdmdocument .sdn .sdo .sdoc .sdp .sdr .sds .sdt .sdv .sdw .search-ms .secure .securecrypted .sef .sel .sen .seq .sequ .server .ses .set .setup .sev .sf .sff .sfs .sft .sfx .sgf .sgi .sgl .sgm .sgml .sgz .sh .sh6 .shar .shb .shd .show .shp .shr .shs .shtml .shw .shx .shy .si1 .sic .sid .sidd .sidn .sie .sik .sis .skb .skp .sky .sla .sldasm .slddrw .sldm .sldprt .sldx .slf .slk .slm .sls .slt .slz .sm .smd .sme .smf .smh .smlx .smn .smp .sms .smwt .smx .smz .sn1 .sn10 .sn11 .sn12 .sn13 .sn14 .sn15 .sn16 .sn17 .sn18 .sn19 .sn2 .sn20 .sn21 .sn22 .sn23 .sn24 .sn25 .sn26 .sn27 .sn28 .sn29 .sn3 .sn30 .sn4 .sn5 .sn6 .sn7 .sn8 .sn9 .sna .snb .snf .sng .snk .snp .snt .snx .so .soa .soi .sp .spb .spd .spdf .spk .spl .spm .spml .sppt .spr .sprt .sprz .spx .sql .sql1 .sql2 .sqlite .sqlite3 .sqlitedb .sqllite .sqx .sqz .sr2 .src .srf .srfl .srs .srt .srw .ssa .ssh .ssi .ssiw .ssm .sso .ssx .st4 .st5 .st6 .st7 .st8 .sta .stbox .stc .std .step .sti .stm .stp .stpz .struct .stt .stw .stx .stxt .sty .sud .suf .sum .suo .surf .surprise .sv2i .svb .svd .svdl .svg .svi .svm .svn .svp .svr .svs .swd .swdoc .sweb .swf .switch .swp .sxc .sxd .sxe .sxg .sxi .sxl .sxm .sxml .sxw .sym .syn .syncdb .sys .szf .t .t01 .t03 .t05 .t10 .t12 .t13 .t14 .t2 .t2k .t2t .t4g .t80 .ta1 .ta2 .ta9 .tab .tabula-doc .tabula-docstyle .tah .tar .tax .tax2009 .tax2013 .tax2014 .tb .tbb .tbd .tbk .tbkx .tbl .tbz2 .tcd .tch .tck .tcx .tdg .tdl .tdoc .tdr .te1 .template .tested .tex .texi .texinfo .text .textclipping .textile .tfd .tfm .tfr .tfrd .tfz .tg .tga .tgz .thm .thml .thmx .thr .tib .tif .tiff .tjp .tk3 .tkf .tlb .tld .tlg .tlt .tlx .tlz .tm .tm3 .tmb .tmd .tml .tmlanguage .tmp .tmpl .tmv .tmz .tns .tnsp .toast .toc .topx .tor .torrent .totalslayout .tp .tpl .tpo .tpsdb .tpu .tpx .trash .trashinfo .trc .trdp .trdx .tre .trif .trn .trp .ts .tsc .tsf .tt11 .tt2 .ttax .ttf .ttt .ttxt .tu .tur .tvd .twdi .twdx .tww .tx .txd .txe .txf .txm .txn .txt .txtrpt .typ .u .u3d .uax .ubz .ucd .udb .udf .udl .uea .ufi .uhtml .ukr .ulf .uli .ulys .ump .umv .umx .unf .unity3d .unr .unx .uof .uop .uos .uot .upc .updating .updf .upg .upk .upoi .upp .urd-journal .urf .url .urp .usa .user .usr .usx .ut2 .ut3 .utc .utd .ute .utf8 .uti .utm .uts .utx .uu .uud .uue .uvx .uxx .v .v2i .v2t .val .var .vault .vb .vbadoc .vbd .vbk .vbm .vbox .vbox-prev .vbp .vbs .vc .vc4 .vc6 .vc7 .vc8 .vcal .vcd .vce .vcf .vdf .vdi .vdo .vdoc .vdproj .vdt .venusf .ver .vf .vfs0 .vgd .vhd .vhdx .vib .view .vip .vis .viz .vlc .vlt .vmb .vmbx .vmdk .vmem .vmf .vmg .vml .vmm .vmsd .vmsg .vmt .vmx .vmxf .vnsdf .vob .voprefs .vor .vos .vox .vp .vpk .vpl .vpp_pc .vrb .vs .vsd .vsdx .vsf .vsi .vspolicy .vst .vstx .vsv .vtf .vthought .vtv .vtx .vvv .vw .vw3 .vwd .w .w2p .w3g .w3x .w51 .w52 .w60 .w61 .w6bn .w6w .w8bn .w8tn .wab .wad .waff .wallet .war .wav .wave .waw .wb .wb2 .wb3 .wbcat .wbd .wbk .wbt .wbxml .wbz .wcf .wcl .wcn .wcp .wcst .wd .wd0 .wd1 .wd2 .wdbn .wdgt .wdl .wdn .wdoc .wds .wdt .wdx .wdx9 .web .webdoc .webpart .wep .wfa .wflx .wht .wid .wim .windata8s .windows10 .wiz .wk! .wk1 .wk3 .wk4 .wkb .wki .wkl .wks .wlb .wld .wll .wls .wlxml .wm .wma .wmd .wmdb .wmf .wmga .wmk .wml .wmlc .wmmp .wmo .wms .wmv .wmx .wn .wolf .word .wordlist .wotreplay .wow .wp .wp42 .wp5 .wp50 .wp6 .wp7 .wpa .wpc2 .wpd .wpd0 .wpd1 .wpd2 .wpd3 .wpe .wpf .wpk .wpl .wpost .wps .wpt .wpw .wr1 .wrf .wri .wrk .wrl .wrlk .ws .ws1 .ws2 .ws3 .ws4 .ws5 .ws6 .ws7 .wsd .wsf .wsh .wsp .wtbn .wtd .wtf .wtmp .wtp .wtr .wts .wtt .wtv .wtx .wvw .wvx .wwcx .wwi .wwl .wws .wwt .wxmx .wxp .wyn .wzn .wzs .x .x11 .x16 .x32 .x3f .x3g .xal .xamlx .xar .xav .xbd .xbrl .xci .xda .xdc .xdf .xdi .xdo .xdoc .xdw .xel .xf .xfd .xfdf .xfi .xfl .xfn .xfo .xfp .xfx .xgml .xht .xhtm .xhtml .xif .xig .xis .xjf .xl .xla .xlam .xlb .xlc .xle .xlf .xline .xlist .xlk .xll .xlm .xlnk .xlr .xls .xlsb .xlse .xlshtml .xlsl .xlsm .xlst .xlsx .xlsxl .xlt .xlthtml .xltm .xltx .xlv .xlw .xlwx .xma .xmdf .xml .xmmap .xmn .xmp .xms .xmt_bin .xmta .xpc .xpd .xpi .xpm .xpo .xps .xpse .xpt .xpwe .xqm .xqr .xqx .xrdml .xsc .xsd .xsig .xsl .xslt .xsn .xtbl .xtd .xtg .xtml .xtps .xtrl .xv0 .xv2 .xv3 .xva .xvg .xvid .xvl .xwd .xweb3htm .xweb3html .xweb4stm .xweb4xml .xwf .xwp .xxe .xxx .xy .xy3 .xy4v .xyd .xyz .y .y3t1 .y79x0 .yab .ycbcra .yenc .yml .ync .yps .yuv .z .z0 .z02 .z04 .z1 .z10 .z11 .z12 .z13 .z14 .z15 .z16 .z2 .z3 .z4 .z5 .z6 .z7 .z8 .z9 .zap .zbi .zcrypt .zda .zepto .zfo .zi0 .zi1 .zi2 .zi3 .zi4 .zi5 .zib .zip .zipx .zm2 .zoo .zps .ztmp .ztp .zyklon .zzz

It doesn't encrypt fles in the following folders:

• %SystemRoot%
• %APPDATA%
• %LOCALAPPDATA%
• %ProgramData%
• %ProgramFiles%

Deletes backups and shadow copies

This threat deletes backups and shadow copies by issuing several commands.

Drops ransom note

This threat drops a ransom note in every folder where it encrypts files. The file name and the content of the ransom note are configurable. For example, we have seent this threat use the following file names for its ransom note:

• FILE RECOVERY INSTRUCTION.txt
• IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT

It also opens the ransom note in Notepad.







Analysis by Danut Antoche-Albisor

Last update 23 November 2017

 

TOP