On December 11th, 2015, a new variant of ransomware crypto-malware Trojan.Win32.CryptoFF.A was discovered.
This new variant is called Trojan.Win32.CryptoFF.C and is very similar to Trojan.Win32.CryptoFF.A.
The file analyzed "
216.tmp" was found in the temporary folder of a computer hit by
Trojan.Win32.CryptoFF.C
We don't have any more information as this malware spreads.
File name: 216.tmp
MD5: efb80d07d49ca43d53eb8eb9cd97ce21
Size: 203264 byte
Time Stamp (header): 10/12/2015 - 22.29.17
When running the
Trojan.Win32.CryptoFF.C, it immediately starts to encrypt the files.
When it finds the first victim, it will do the following things:
1) open the document
2) encrypt the document
3) rename the original file with extension "
.1999" (e.g. mydocument.doc -> mydocument.doc.1999)
The first 64 KB of files will be encrypted by
Trojan.Win32.CryptoFF.C
If size of file is below 64 KB, then whole document will be encrypted.
The malware uses AES 256 bit to encrypt the files.
Inside the malware there is a bug when it encrypts file with size below 64 KB, in this case the decrypt of these files makes documents corrupted at end of files.
In each folder it will create 2 files:
SECRETISHERE.KEY (size: 1368 byte)
HELLOTHERE.TXT (size: 1015 byte)
The file "
SECRETISHERE.KEY" contains a key in UUencode, after it's decoded, it will obtain a key of 1024 byte.
The file "
HELLOTHERE.TXT" contains instructions to recover the file encrypted:
Hello.
All your files have been encrypted using our extremely strong private key. There is no way to recover them without our assistance. If you want to get your files back, you must be ready to pay for them. If you are ready to pay, then get in touch with us using a secure and anonymous p2p messenger. We have to use a messenger, because standard emails get blocked quickly and if our email gets blocked your files will be lost forever. So…
Go to http://bitmessage.org/, download and run Bitmessage. Click Your Identities tab, then click New, then click OK. Then click Send tab.
TO: BM-NByDti9xJ9NcFShLaBfE1fkAW8uk51WQ
SUBJECT: name of your PC or your IP address.
MESSAGE: Hi, I am ready to pay.
Click Send button.
You are done.
To get the fastest reply from us with all further instructions, please keep your Bitmessage running on the computer all the time, if possible. If you cooperate and follow the instructions, you will get all your files back intact and very, very soon. Thank you.
|
When Trojan.Win32.CryptoFF.C will terminate to encrypt all document, it will show this image:
The
Trojan.Win32.CryptoFF.C removes the volume shadow copies with this command:
cmd.exe /Q /C vssadmin.exe delete shadows /all /quiet
Clean:
VirIT version 8.0.66 and later.
Analysis by eng. Gianfranco Tonello
C.R.A.M. (Anti-Malware Research Center) by TG Soft