Ransom.MSIL.EGOGEN.THEBBBC

N它以其他恶意软件释放的文件或用户访问恶意网站时不知不觉下载的文件的形式到达系统。

它添加某些注册表项，禁用任务管理器。该操作阻止用户通过任务管理器终止恶意软件进程。

如果检测到自身在虚拟环境中运行，它将终止运行。

新病毒详细信息

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

安装

它植入下列文件：

• %AppDataLocal%\discord.exe
• %Application Data%\ID
• %Application Data%\fondo_antiguo.jpg → Copy of current background
• %User Profile%\Pictures\image[Random 30 characters].jpg → deleted afterwards
• %User Startup%\BXIuSsB.exe
• %User Temp%\Adobe\BXIuSsB.exe
• %User Temp%\[Random 7 characters]_dat.log
• %Application Data%\delback.bat
• %User Startup%\update.bat

(注意: %Application Data% 是当前用户的 Application Data 文件夹，通常位于 C:\Windows\Profiles\{user name}\Application Data (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Application Data (Windows NT)、C:\Documents and Settings\{user name}\Local Settings\Application Data (Windows 2000(32-bit)、XP 和 Server 2003(32-bit)) 和 C:\Users\{user name}\AppData\Roaming (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit))。. %User Profile% 是当前用户的概要文件文件夹，通常位于 C:\Windows\Profiles\{user name} (Windows 98 和 ME)、C:\WINNT\Profiles\{user name} (Windows NT)、C:\Documents and Settings\{user name} (Windows 2000(32-bit)、XP 和 Server 2003(32-bit)) 和 C:\Users\{user name} (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit))。. %User Startup% 是当前用户的启动文件夹，通常位于 C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup (Windows NT)、C:\Documents and Settings\{User name}\Start Menu\Programs\Startup (Windows 2003(32-bit)、XP、2000(32-bit)) 和 C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit))。. %User Temp% 是当前用户的 Temp 文件夹。通常位于 C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)、XP 和 Server 2003(32-bit))、C:\Users\{user name}\AppData\Local\Temp (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit)。)

它植入和执行下列文件：

• %User Startup%\1.exe
• %User Startup%\archive.exe
• %User Startup%\Xarch.exe
• %User Startup%\teleratserver.exe

(注意: %User Startup% 是当前用户的启动文件夹，通常位于 C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup (Windows NT)、C:\Documents and Settings\{User name}\Start Menu\Programs\Startup (Windows 2003(32-bit)、XP、2000(32-bit)) 和 C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit))。)

它添加下列进程：

• %Application Data%\Read Me First!.txt
• cmd "/c @echo off & echo github: https://{BLOCKED}t.me/{BLOCKED}69 & start https://{BLOCKED}t.me/{BLOCKED}69"
• vssadmin delete shadows /all /quiet
• bcdedit.exe /set {default} recoveryenabled no
• bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
• ping -n 1 -w 5000 {BLOCKED}.{BLOCKED}.254.254
• del "%User Startup%\BXIuSsB.exe"

它创建下列文件夹：

• %User Temp%\Adobe → deleted after encryption

(注意: %User Temp% 是当前用户的 Temp 文件夹。通常位于 C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)、XP 和 Server 2003(32-bit))、C:\Users\{user name}\AppData\Local\Temp (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit)。)

自启动技术

它添加下列注册表项，在系统每次启动时自行执行：

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
1 = %User Startup%\1.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
archive = %User Startup%\archive.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Xarch = %User Startup%\Xarch.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
discord = %AppDataLocal%\discord.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
teleratserver = %User Startup%\teleratserver.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
BXIuSsB = %User Startup%\BXIuSsB.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
BXIuSsB.exe = %User Temp%\Adobe\BXIuSsB.exe

其他系统修改

它添加下列注册表项，禁用任务管理器：

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

它通过修改下列注册表项，更改桌面壁纸：

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Profile%\Pictures\image[Random 30 characters].jpg

它将系统的桌面壁纸设置为下列图像：

进程终止

它终止在受感染的系统内存中运行的下列进程：

• taskmgr
• sqlagent
• winword
• sqlbrowser
• sqlservr
• sqlwriter
• oracle
• ocssd
• dbsnmp
• synctime
• mydesktopqos
• agntsvc.exeisqlplussvc
• xfssvccon
• mydesktopservice
• ocautoupds
• agntsvc.exeagntsvc
• agntsvc.exeencsvc
• firefoxconfig
• tbirdconfig
• ocomm
• mysqld
• sql
• mysqld-nt
• mysqld-opt
• dbeng50
• sqbcoreservice

其他详细信息

如果检测到自身在虚拟环境中运行，它将终止运行。

该程序执行以下操作：

• It does not proceed with its encryption routine if one of the following conditions are met:
  
  • Registry data under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Disk\Enum contains the following strings:
    • VBOX
    • Virtual
    • VMware
  • Processes contain the following strings:
    • VBox
    • prl_
    • srvc.exe
    • vmtoolsd
• It will drop this ransom note instead if it meets one of the following conditions:
  • If the OS name contains "Serv" and System Language is one of the following:
  • Arabic, Dutch, English, French, German, Italian, Korean, Portuguese, Spanish, Swedish, Bulgarian, Catalan, Czech, Danish, Greek, Estonian, Basque, Finnish, Hungarian, Japanese, Lithuanian, Norwegian, Polish, Romanian, Sami, Slovak, Slovenian, Turkish
  • The number of encrypted files is greater than 5000
  
  
• Renames the encrypted files to [(Original File Name) converted to base64]
• It encrypts fixed, removable and network drives
• It terminates if the machine has the following system language:
  • Russian
  • Belarusian
  • Ukrainian
  • Kazakh
  • Armenian
  • Georgian
  • Tatar
  • Uzbek
• Displays a fake Windows Update upon installation