SonicWall Security Center
Share: Linkedin Share Facebook Like
Back to SonicALERT


Rig Exploit Kit via EiTest delivers buggy CryptoShield Ransomware (Feb 3rd, 2017)



Description


The Sonicwall Threats Research team have received reports of ransomware known as CryptoShield that is being distributed through compromised websites using the Rig Exploit Kit. The copy of the ransomware that we obtained comes with a twist. Instead of encrypting files and offering their recovery after a ransom is paid it accidentally deletes them due to a bug.

Infection Cycle:

The Trojan has the following hardcoded IP address for the C&C server:

    45.76.81.110

The Trojan attempts to report the infection to the C&C server with a unique user ID. The server was not operating as desired by the operators at the time of writing:

The Trojan adds the following key to the Windows registry to enable startup after reboot:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Windows SmartScreen %APPDATA%\MicroSoftWare\SmartScreen\SmartScreen.exe

The Trojan adds the following files to the system:

  • %APPDATA%\MicroSoftWare\SmartScreen\SmartScreen.exe
  • {shared drives}\Stop Ransomware Decrypts Tools.exe [Detected as GAV: CryptoShield.A (Trojan)]

It will then traverse all directories looking for files of predefined filetypes to encrypt. Due to not being able to communicate as expected with the C&C server the "encryption" process results in the files being deleted. The following 2 files are dropped in the directories containing the "encrypted" files:

      "# RESTORING FILES #.HTML"
      "# RESTORING FILES #.TXT"

The files contain the following data which are presented on-screen by the Trojan. It contains instructions for file retrieval which of course will not work for deleted files:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

  • GAV: CryptoShield.A (Trojan)




Back to top

Back to SonicALERT

Follow: Follow us on Facebook Follow us on Twitter Join the Conversation
#SonicWall
© 2017 SonicWall | Privacy Policy | Conditions for use | Feedback | Live Demo | SonicALERT | Document Library | Report Issues
Version: 13.3 | S2MSW06