Ransom:Win32/Sorikrypt.A

Arrival and installation

This ransomware is generated by attackers using a free ransomware construction called Xorcist. The kit allows attackers to build fully customized ransomware in terms of target files, file name extension for encrypted files, ransom note message and file name, and unlock password.

Based on the sample analyzed (SHA1:503fcaa5a63abf3bda11b40a10903d7261133484), when executed, this ransomware creates copies of itself in the %TEMP% folder using a random file name. It then creates the following autostart entry in the registry:

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Alcmeter"
With data: "%TEMP%\<malware file name>"

It may also creates additional registry keys, for example:

In subkey: HKEY_CLASSES_ROOT\.bs7912
Sets value: "(Default)"
With data: "QVHXQDQKOFLBYBV"

In subkey: HKEY_CLASSES_ROOT\QVHXQDQKOFLBYBV
Sets value: "(Default)"
With data: "CRYPTED!"

In subkey: HKEY_CLASSES_ROOT\QVHXQDQKOFLBYBV\DefaultIcon
Sets value: "(Default)"
With data: "<malware file name>,0"

In subkey: HKEY_CLASSES_ROOT\QVHXQDQKOFLBYBV\shell\open\command
Sets value: "(Default)"
With data: "<malware file name>"

Payload

Encrypts files

This ransomware can encrypts files. Based on the sample analyzed, it encrypts data with certain file name extensions, for example:

• .txt
• .html
• .pdf
• .bmp
• .pif
• .jpg
• .wav
• .wma
• .lnk 

It appends the following string to the file name of encrypted files:

• .bs7912

It can also create the following file:

• HOW TO DECRYPT FILES.txt

It can also display a ransom note, which can be an image that is saved in resource and extracted and displayed during execution.

Analysis by Steven Zhou