{"id":6321,"date":"2017-01-23T15:50:21","date_gmt":"2017-01-23T23:50:21","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-159\/"},"modified":"2017-01-23T15:50:21","modified_gmt":"2017-01-23T23:50:21","slug":"news-159","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-159\/","title":{"rendered":"Link (.lnk) to Ransom"},"content":{"rendered":"

We are alerting Windows users of a new type of ransomware that exhibits worm-like behavior. This ransom leverages removable and network drives to propagate itself and affect more users. We detect this ransomware as Ransom:Win32\/ZCryptor.A<\/a>.<\/p>\n

 <\/p>\n

Infection vector<\/h3>\n

Ransom:Win32\/ZCryptor.A<\/a>\u00a0 is distributed through the spam email infection vector. It also gets installed in your machine through other macro malware<\/a>*, or fake installers (Flash Player setup).<\/p>\n

Once ZCryptor is executed, it will make sure it runs at start-up:<\/p>\n

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun<\/p>\n

zcrypt = {path of the executed malware}<\/em><\/p>\n

 <\/p>\n

It also drops autorun.inf<\/em> in removable drives, a zycrypt.lnk<\/em> in the start-up folder:<\/p>\n

%User Startup%zcrypt.lnk<\/em><\/p>\n

..along with a copy of itself as {Drive}:system.exe<\/em> and %APPDATA%<\/em><\/a><\/span>zcrypt.exe,<\/em> and changes the file attributes to hide itself from the user in file explorer.<\/p>\n

For example: c:usersadministratorappdataroamingzcrypt.exe<\/em><\/p>\n

Payload<\/h3>\n

This ransomware will display the following ransom note to users in a dropped HTML file How to decrypt files.html<\/strong>:<\/p>\n

\"Screenshot<\/a><\/p>\n

 <\/p>\n

It will also target, encrypt files with the following extension, and change the file extension to .zcrypt<\/em> once it is done (for example,<originalfilename.zcrypt>):<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
.accdb<\/em><\/td>\n.dwg<\/em><\/td>\n.odb<\/em><\/td>\n.raf<\/em><\/td>\n<\/tr>\n
.apk<\/em><\/td>\n.dxg<\/em><\/td>\n.odp<\/em><\/td>\n.raw<\/em><\/td>\n<\/tr>\n
.arw<\/em><\/td>\n.emlx<\/em><\/td>\n.ods<\/em><\/td>\n.rtf<\/em><\/td>\n<\/tr>\n
.aspx<\/em><\/td>\n.eps<\/em><\/td>\n.odt<\/em><\/td>\n.rw2<\/em><\/td>\n<\/tr>\n
.avi<\/em><\/td>\n.erf<\/em><\/td>\n.orf<\/em><\/td>\n.rwl<\/em><\/td>\n<\/tr>\n
.bak<\/em><\/td>\n.gz<\/em><\/td>\n.p12<\/em><\/td>\n.sav<\/em><\/td>\n<\/tr>\n
.bay<\/em><\/td>\n.html<\/em><\/td>\n.p7b<\/em><\/td>\n.sql<\/em><\/td>\n<\/tr>\n
.bmp<\/em><\/td>\n.indd<\/em><\/td>\n.p7c<\/em><\/td>\n.srf<\/em><\/td>\n<\/tr>\n
.cdr<\/em><\/td>\n.jar<\/em><\/td>\n.pdb<\/em><\/td>\n.srw<\/em><\/td>\n<\/tr>\n
.cer<\/em><\/td>\n.java<\/em><\/td>\n.pdd<\/em><\/td>\n.swf<\/em><\/td>\n<\/tr>\n
.cgi<\/em><\/td>\n.jpeg<\/em><\/td>\n.pdf<\/em><\/td>\n.tar<\/em><\/td>\n<\/tr>\n
.class<\/em><\/td>\n.jpg<\/em><\/td>\n.pef<\/em><\/td>\n.tar<\/em><\/td>\n<\/tr>\n
.cpp<\/em><\/td>\n.jsp<\/em><\/td>\n.pem<\/em><\/td>\n.txt<\/em><\/td>\n<\/tr>\n
.cr2<\/em><\/td>\n.kdc<\/em><\/td>\n.pfx<\/em><\/td>\n.vcf<\/em><\/td>\n<\/tr>\n
.crt<\/em><\/td>\n.log<\/em><\/td>\n.php<\/em><\/td>\n.wb2<\/em><\/td>\n<\/tr>\n
.crw<\/em><\/td>\n.mdb<\/em><\/td>\n.png<\/em><\/td>\n.wmv<\/em><\/td>\n<\/tr>\n
.dbf<\/em><\/td>\n.mdf<\/em><\/td>\n.ppt<\/em><\/td>\n.wpd<\/em><\/td>\n<\/tr>\n
.dcr<\/em><\/td>\n.mef<\/em><\/td>\n.pptx<\/em><\/td>\n.xls<\/em><\/td>\n<\/tr>\n
.der<\/em><\/td>\n.mp4<\/em><\/td>\n.psd<\/em><\/td>\n.xlsx<\/em><\/td>\n<\/tr>\n
.dng<\/em><\/td>\n.mpeg<\/em><\/td>\n.pst<\/em><\/td>\n.xml<\/em><\/td>\n<\/tr>\n
.doc<\/em><\/td>\n.msg<\/em><\/td>\n.ptx<\/em><\/td>\n.zip<\/em><\/td>\n<\/tr>\n
.docx<\/em><\/td>\n.nrw<\/em><\/td>\n.r3d<\/em><\/td>\n.3fr<\/em><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Infected machines are noticed to have zcrypt1.0<\/em> mutex. The mutex denotes that an instance of this ransomware is already running in the infected machine.<\/p>\n

We have also seen a connection to the following URL. However, the domain is already down when we were testing:<\/p>\n

http:\/\/<obfuscated>\/rsa\/rsa.php?computerid={Computer_ID}<\/em> where the {Computer_ID} is entry found inside a dropped file %APPDATA%<\/em><\/a><\/span>cid.ztxt<\/em><\/p>\n

For example, c:usersadministratorappdataroamingcid.ztxt<\/em><\/p>\n

Prevention<\/h3>\n

To help stay protected:<\/p>\n