Ransom:MSIL/Fantomcrypt.A

Installation

This threat has been observed to arrive as an obfuscated .NET executable file. It is based on the open-source ransomware called "hiddentear" and we have seen it use the following file names:

• critical_updates.exe
• dissdkchk.exe
• servicec.exe

This threat may appear as a critical Windows update to lure potential victims to apply the fake update, thus trigerring the document encryption process that runs in the background.

Malicious hackers add fictitious details such as file properties, file names, and a Microsoft copyright to make the "critical update" file name appear legitimate. Unsuspecting victims can then be lead to download the update.

Payload

This threat searches for files in your folders and can target files with the following extensions to encrypt:

It also deletes shadow files to prevent you from restoring your files from a local backup. We have seen it run the following commands:

• vssadmin delete shadows /all /quiet
   

This threat might connect to the following urls:

• hXXp://content.screencast.com/users/Gurudrag/folders/Default/media/9289aabe-7b4a-4c7f-b3bb-bdf3407e7a2f/fantom1.jpg
• hXXp://powertoolsforyou.com/themes/prestashop/cache/stats.php
• hXXp://templatesupdates.dlinkddns.com/falssk/fksgieksi.php

This malware description was published from analyzing the following SHA1 files: