Home / malware Ransom:MSIL/Nojocrypt.A
First posted on 05 April 2016.
Source: MicrosoftAliases :
There are no other names known for Ransom:MSIL/Nojocrypt.A.
Explanation :
Installation
This threat can create files on your PC, including:
- %APPDATA%\locker.exe
It modifies the registry so that it runs each time you start your PC. For example:
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "application"
With data: "%APPDATA%\locker.exe"
The malware uses code injection to make it harder to detect and remove. It can inject code into running processes.
Payload
Connects to a remote host
We have seen this threat connect to a remote host, including:Malware can connect to a remote host to do any of the following:
- auth.smtp.1and1.fr using port 587
- Check for an Internet connection
- Download and run files (including updates or other malware)
- Report a new infection to its author
- Receive configuration or other data
- Receive instructions from a malicious hacker
- Search for your PC location
- Upload information taken from your PC
- Validate a digital certificate
This malware description was published using automated analysis of file SHA1 976ee9f6defa78638e5e4b0bc868dd39ad4bd899.Last update 05 April 2016