Ransom.MSIL.EGOGEN.THEBBBC

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

它添加某些注册表项，禁用(yòng)任務(wù)管理(lǐ)器。该操作(zuò)阻止用(yòng)户通过任務(wù)管理(lǐ)器终止恶意软件进程。

如果检测到自身在虚拟环境中(zhōng)运行，它将终止运行。

新(xīn)病毒详细信息

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

安(ān)装(zhuāng)

它植入下列文(wén)件：

• %AppDataLocal%\discord.exe
• %Application Data%\ID
• %Application Data%\fondo_antiguo.jpg → Copy of current background
• %User Profile%\Pictures\image[Random 30 characters].jpg → deleted afterwards
• %User Startup%\BXIuSsB.exe
• %User Temp%\Adobe\BXIuSsB.exe
• %User Temp%\[Random 7 characters]_dat.log
• %Application Data%\delback.bat
• %User Startup%\update.bat

(注意: %Application Data% 是当前用(yòng)户的 Application Data 文(wén)件夹，通常位于 C:\Windows\Profiles\{user name}\Application Data (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Application Data (Windows NT)、C:\Documents and Settings\{user name}\Local Settings\Application Data (Windows 2000(32-bit)、XP 和 Server 2003(32-bit)) 和 C:\Users\{user name}\AppData\Roaming (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit))。. %User Profile% 是当前用(yòng)户的概要文(wén)件文(wén)件夹，通常位于 C:\Windows\Profiles\{user name} (Windows 98 和 ME)、C:\WINNT\Profiles\{user name} (Windows NT)、C:\Documents and Settings\{user name} (Windows 2000(32-bit)、XP 和 Server 2003(32-bit)) 和 C:\Users\{user name} (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit))。. %User Startup% 是当前用(yòng)户的启动文(wén)件夹，通常位于 C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup (Windows NT)、C:\Documents and Settings\{User name}\Start Menu\Programs\Startup (Windows 2003(32-bit)、XP、2000(32-bit)) 和 C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit))。. %User Temp% 是当前用(yòng)户的 Temp 文(wén)件夹。通常位于 C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)、XP 和 Server 2003(32-bit))、C:\Users\{user name}\AppData\Local\Temp (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit)。)

它植入和执行下列文(wén)件：

• %User Startup%\1.exe
• %User Startup%\archive.exe
• %User Startup%\Xarch.exe
• %User Startup%\teleratserver.exe

(注意: %User Startup% 是当前用(yòng)户的启动文(wén)件夹，通常位于 C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup (Windows NT)、C:\Documents and Settings\{User name}\Start Menu\Programs\Startup (Windows 2003(32-bit)、XP、2000(32-bit)) 和 C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit)、10(64-bit))。)

它添加下列进程：

• %Application Data%\Read Me First!.txt
• cmd "/c @echo off & echo github: https://{BLOCKED}t.me/{BLOCKED}69 & start https://{BLOCKED}t.me/{BLOCKED}69"
• vssadmin delete shadows /all /quiet
• bcdedit.exe /set {default} recoveryenabled no
• bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
• ping -n 1 -w 5000 {BLOCKED}.{BLOCKED}.254.254
• del "%User Startup%\BXIuSsB.exe"

它创建下列文(wén)件夹：

• %User Temp%\Adobe → deleted after encryption

(注意: %User Temp% 是当前用(yòng)户的 Temp 文(wén)件夹。通常位于 C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)、XP 和 Server 2003(32-bit))、C:\Users\{user name}\AppData\Local\Temp (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit)。)

自启动技(jì )术

它添加下列注册表项，在系统每次启动时自行执行：

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
1 = %User Startup%\1.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
archive = %User Startup%\archive.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Xarch = %User Startup%\Xarch.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
discord = %AppDataLocal%\discord.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
teleratserver = %User Startup%\teleratserver.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
BXIuSsB = %User Startup%\BXIuSsB.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
BXIuSsB.exe = %User Temp%\Adobe\BXIuSsB.exe

其他(tā)系统修改

它添加下列注册表项，禁用(yòng)任務(wù)管理(lǐ)器：

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

它通过修改下列注册表项，更改桌面壁纸：

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Profile%\Pictures\image[Random 30 characters].jpg

它将系统的桌面壁纸设置為(wèi)下列图像：

进程终止

它终止在受感染的系统内存中(zhōng)运行的下列进程：

• taskmgr
• sqlagent
• winword
• sqlbrowser
• sqlservr
• sqlwriter
• oracle
• ocssd
• dbsnmp
• synctime
• mydesktopqos
• agntsvc.exeisqlplussvc
• xfssvccon
• mydesktopservice
• ocautoupds
• agntsvc.exeagntsvc
• agntsvc.exeencsvc
• firefoxconfig
• tbirdconfig
• ocomm
• mysqld
• sql
• mysqld-nt
• mysqld-opt
• dbeng50
• sqbcoreservice

其他(tā)详细信息

如果检测到自身在虚拟环境中(zhōng)运行，它将终止运行。

该程序执行以下操作(zuò)：

• It does not proceed with its encryption routine if one of the following conditions are met:
  
  • Registry data under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Disk\Enum contains the following strings:
    • VBOX
    • Virtual
    • VMware
  • Processes contain the following strings:
    • VBox
    • prl_
    • srvc.exe
    • vmtoolsd
• It will drop this ransom note instead if it meets one of the following conditions:
  • If the OS name contains "Serv" and System Language is one of the following:
  • Arabic, Dutch, English, French, German, Italian, Korean, Portuguese, Spanish, Swedish, Bulgarian, Catalan, Czech, Danish, Greek, Estonian, Basque, Finnish, Hungarian, Japanese, Lithuanian, Norwegian, Polish, Romanian, Sami, Slovak, Slovenian, Turkish
  • The number of encrypted files is greater than 5000
  
  
• Renames the encrypted files to [(Original File Name) converted to base64]
• It encrypts fixed, removable and network drives
• It terminates if the machine has the following system language:
  • Russian
  • Belarusian
  • Ukrainian
  • Kazakh
  • Armenian
  • Georgian
  • Tatar
  • Uzbek
• Displays a fake Windows Update upon installation