New French Ransomware spotted in the wild (February 12, 2016)

The Dell SonicWall Threats Research team has received reports of a new Ransomware Trojan which leaves system access intact and encrypts all files except for the system files.

Infection cycle:

The Trojan adds the following files to the filesystem:

• %APPDATA%Locker.exe (copy of original) [Detected as GAV: Filelocker.A_96 (Trojan)]

The Trojan creates the following key to the Windows registry to enable startup after reboot:

• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “”%APPDATA%Locker.exe””

It creates a registry entry for the files that it encrypts the extension .locked

The following DNS queries are made by the Trojan using its Domain Generation Algorithm. This allows the Trojan to connect new C&C servers once the previous servers are offline.

Using SMTP, the Trojan sends the collected system information and the random password whose length is 20.

After some time, the Trojan displays the following dialog informing the user that certain files on the system have been encrypted.

All the program files are being removed and the extension renamed to .locked. The start menu looks like this:

It creates a ini file in each folder:

It creates a text file on desktop which gives details of the files being encrypted:

This is in French. When translated:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

• GAV: Filelocker.A_96 (Trojan)

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.