Ransom:Win32/Teerac

Installation

Ransom:Win32/Teerac can be downloaded by other malware, such as TrojanDownloader:O97M/Donoff. It can also arrive on your PC as a spam email attachment using a file name such as:

• fatura.exe
• Parcel_Information.exe
• track_<random numbers>.exe

When run, it can inject itself to valid system processes and drop a copy of itself in %windir% or <commonappdata> with a random name. For example:

• <commonappdata> \ovijhbij.exe
• %windir% \yjyricb.exe

It can also install other files onto your PC that can be used by the malware as reference startup points. We have seen it use the following format:

• <commonappdata> \<random characters>\00000000...02000000, for example c:\programdata\umevenupasyxuxof\00000000 ...02000000

It changes the following registry entries so that it runs each time you start your PC:

• In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Sets value: "<random name>", for example "yjyricb"
  With data: "%windir%\<random name>.exe", for example "%windir%\yjyricb.exe"
• In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  Sets value: "<random name>", for example "uziviqow"
  With data: "<commonappdata>\<random name>.exe", for example "<commonappdata>\ovijhbij.exe"
• The malware can also modify other registry entries as part of its installation, for example:
• In subkey: HKCU\Software\Bit Torrent Application\Configuration
  Sets value: "01000000"
  With data: "%windir%\<random name>.exe", for example "%windir%\epabaleq.exe"
• In subkey: HKCU\Software\<random characters>, for exampe HKCU\Software\ahawomuxevoporop
  Sets value: "01000000"
  With data: "<Binary data>", for example "m.."

Payload

Encrypts your files

Ransom:Win32/Teerac can encrypt files on your PC that have the following extensions.  

• avi
• bmp
• ico
• inf  
• gif
• mp3
• png
• txt
• wav
• xml

It adds ".encrypted" to the extension names of the encrypted files, for example sample.avi.encrypted.

The malware avoids encrypting these file extensions and file paths:

• bat
• chm
• cmd 
• dll
• exe
• ini
• log
• lnk
• msi  
• scr
• sys
• tmp

Shows you a ransom screen

Once your files are encrypted Ransom:Win32/Teerac shows you the following ransom screens demanding payment to give you back access to your files.

Early versions used the following message:

More recent variants use this updated message: