SonicWall Security Center
Share: Linkedin Share Facebook Like
Back to SonicALERT

Genasom Ransomware operator requests remote access for fix (Jan 5th, 2018)


The SonicWall Capture Labs Threat Research Team has conducted an experimental dialog similar to our previous PayDay ransomware SonicAlert. This time we look at a ransomware threat known as Genasom where the operators use email to communicate and negotiate payment with their victims. In this case the operator wanted direct access to the infected machine in order to "fix" the problem after which a small donation is requested (according to them).

Infection cycle:

The Trojan uses the following icon:

The Trojan drops the following files onto the system:

  • %APPDATA%\BC0DD974EC.exe [Detected as GAV: Genasom.RSM_2 (Trojan)]
  • _HELP_INSTRUCTION.TXT (in every directory containing encrypted files)

The Trojan adds the following keys to the registry:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 00FF0DD974EC {original run location}
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run BC0DD974EC %APPDATA%\BC0DD974EC.exe

_HELP_INSTRUCTION.TXT contains the following text:


      Attention! All Your data was encrypted!

      For specific informartion, please send us an email with Your ID number:

      Please send email to all email addresses! We will help You as soon as possible!

      DECRYPT-ID-6f179b9f-7506-4075-beea-5791809b6c04 number

From here the victim is left with no choice but to contact the operators via email. The following, is a short conversation we had with the operator:

We do not know what is behind this 'good will' scheme but would advise infected users to never take the bait. The operator will most likely cause more harm than good once granted access. This could range installing further malware and snooping on other machines within the network to launching DDoS attacks from the infected machine.

Sounds too good to be true and probably is.

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

  • GAV: Genasom.RSM (Trojan)
  • GAV: Genasom.RSM_2 (Trojan)
  • GAV: Genasom.A_16 (Trojan)
  • GAV: Genasom.A_17 (Trojan)
  • GAV: Genasom.A_18 (Trojan)
  • GAV: Genasom.A_19 (Trojan)

Back to top

Back to SonicALERT

Follow: Follow us on Facebook Follow us on Twitter Join the Conversation
© 2018 SonicWall | Privacy Policy | Conditions for use | Feedback | Live Demo | SonicALERT | Document Library | Report Issues
Version: 13.13 | S2MSW05