• svchost.exe (182.784 byte): it's used mainly to show the ransom full-screen popup that blocks the PC.
• scsvserv.exe (17.920 byte):  edit the Windows' registry, disabling errors report and deleting all voices from Run in HKCU and HKLM.

Inside "C:\programdata" there are several folders with numeric names(e.g.: 03230240582). You can find these files into each of them:

• <random number>.dll
• <random number>.bat
• <random number>fspall1.dll
• <random number>.dll.dlls
• BKR<random number>.dll
• S1_<random number>.dlls
• DB1_<random number>.dlls

E.g.: 032302405814.dll
The file <random number>.bat execute the following command: The file BKR<random number>.dll contains a list of .log files.
The file S1_<random number>.dll contains a list of  .jp. txt, pdf and other file extensions files.
The file DB1_<random number>.dll contains a list of .DB files.



The Trojan.Win32.ACCDFISA.B is composed by following file:

• lsassw86s.exe (80.896 - 84.480 byte): its the executable in charge of crypting files, it's executed as a service.

  TheTrojan.Win32.ACCDFISA.B deletes the registry key "SafeBoot", so that it becomes impossible to restart the PC in safe mode.


The malware downloads the following files:
svchost.exe  (404.992 byte) - > RAR Command line tool
cfwin32.dll  (404.992 byte) - > RAR Command line tool
sdelete.dll (155.936 byte) -> Sysinternals' dll, digitally signed from Microsoft, that deletes permanently files from disk without any possibility to recover them.
nsf.exe (48.640 byte) -> Executable infected by Trojan.Win32.NoSafeMode.A
NoSafeMode.dll (12.800 byte) -> Executable infected by Trojan.Win32.NoSafeMode.B

The malware uses the "Command Line RAR" tool to crypt documents.

The Windows' exploit permits at the cracker to log onto the machine with terminal server using an external ip; this allow the cracker to bruteforce the accounts' passwords on the server.

We strongly recommend these three simple operations to protect yourselves from these kinds of attacks:

1) Install all Windows Updates and reboot the server to apply them, since the vulnerability exploited by the cracker has been fixed with the KB2621440 released almost an year ago, (13th of March 2012), and not installed because of poor maintenace of the server.

2) The System Admin should modify Windows' settings to prevent external IP from loggin into the terminal server;

3) You should always set very complex passwords (with numbers, lowecase and uppercase letters, special characters etc. and of a minimum length of 12 characters) on every account of the server, so the individuation of them by the cracker is very difficult if nearly impossible.

This malware, crypts all text files (.txt, .doc, .dat, ecc...) in self-extract archives protected by a complex password sent to the cracker and impossible to recover. On top of that, it creates a  service which crypts all files that weren't crypted the first time, with a new generated password different from the first.