The Sonicwall Threats Research team have received reports of ransomware known as CryptoShield that is being distributed through compromised websites using the Rig Exploit Kit. The copy of the ransomware that we obtained comes with a twist. Instead of encrypting files and offering their recovery after a ransom is paid it accidentally deletes them due to a bug.
Infection Cycle:
The Trojan has the following hardcoded IP address for the C&C server:
45.76.81.110
The Trojan attempts to report the infection to the C&C server with a unique user ID. The server was not operating as desired by the operators at the time of writing:
The Trojan adds the following key to the Windows registry to enable startup after reboot:
The Trojan adds the following files to the system:
It will then traverse all directories looking for files of predefined filetypes to encrypt. Due to not being able to communicate as expected with the C&C server the "encryption" process results in the files being deleted. The following 2 files are dropped in the directories containing the "encrypted" files:
"# RESTORING FILES #.HTML"
"# RESTORING FILES #.TXT"
The files contain the following data which are presented on-screen by the Trojan. It contains instructions for file retrieval which of course will not work for deleted files:
SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:
Share This Article
An Article By
An Article By
Security News
Security News