New LockScreen Ransomware Trojan in the wild (Mar 15, 2012)

The Sonicwall UTM research team discovered a new Ransomware Trojan in the wild originating from Russia but targetting UK users. Ransomware simply extorts money from its victims by denying access back to the desktop until a sum of money is paid. This type of Lockscreen Ransomware has also been covered in a previous sonicalert

Once infected, the Trojan pops up the following screen giving a fake justification as to why it is locked:

The screen is positioned to be always-on-top of other windows. The desktop is thus locked until the correct lock code is entered.

The Trojan makes the following changes to the windows registry:

enable startup:

• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “{original run path}”

disables Safe-mode by renaming the following keys:

• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimal to HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootmini
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootNetwork to HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBoot net

The Trojan contains functionality to disable taskmgr.exe, msconfig.exe, regedit.exe and cmd.exe:

The Trojan contains code to report to a remote server and provide backdoor functionality:

Upon further analysis, we discovered two plaintext unlock keys embedded in the executable code. The keys “end!” and “892736loker” can be used to temporarily unlock the desktop. However, these keys do not remove the Trojan from the system. The Trojan lockscreen will appear on next reboot.

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

• GAV: LockScreen.AKE (Trojan)

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.