RANSOM_SPORA.B

它以其他(tā)恶意软件释放的文(wén)件或用(yòng)户访问恶意网站时不知不觉下载的文(wén)件的形式到达系统。它开始执行然后再删除。

安(ān)装(zhuāng)

它使用(yòng)不同的文(wén)件名(míng)在下列文(wén)件夹中(zhōng)植入自身的副本：

• %Desktop%{random values}.exe - set attributes to Hidden
• %AppDataLocal%\Temp\{random values}.exe
• {all removable and fixed drives}\{random values}.exe - set attributes to Hidden

(注意: %Desktop% 是当前用(yòng)户的桌面，通常位于 C:\Windows\Profiles\{user name}\Desktop (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Desktop (Windows NT) 和 C:\Documents and Settings\{User Name}\桌面 (Windows 2000、XP 和 Server 2003)。)

它植入下列文(wén)件：

• %Desktop%\{unique id}.HTML - ransom note
• %Desktop%\{unique id}.KEY
• %Application Data%\{unique id}.HTML - ransom note
• %Application Data%\{unique id}.KEY
• %Application Data%\{unique id}.LST
• %Application Data%\Microsoft\Windows\Templates\{unique id}.HTML - ransom note
• %Application Data%\Microsoft\Windows\Templates\{unique id}.KEY
• %Application Data%\Microsoft\Windows\Templates\{unique id}.LST
• {Fixed and Removable Drive Letter}:\{Shortcut files with the filename of every folder in the removable and fixed drive}
  • The malware creates these shortcut files in order to trick the user due to its folder icon and legit filenames.
  • The target path of these shortcuts is set to: %System%\cmd.exe /C explorer.exe "{folder name - where original files are stored}" & type "{random values}.exe - dropped copy of the malware" - "%tmp%\{random values}.exe - dropped copy of the malware" & start "{folder name - where original files are stored}" "%tmp%\{random values}.exe - dropped copy of the malware"
• %Application Data%\{10 digit number}

(注意: %Desktop% 是当前用(yòng)户的桌面，通常位于 C:\Windows\Profiles\{user name}\Desktop (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Desktop (Windows NT) 和 C:\Documents and Settings\{User Name}\桌面 (Windows 2000、XP 和 Server 2003)。. %Application Data% 是当前用(yòng)户的 Application Data 文(wén)件夹，通常位于 C:\Windows\Profiles\{user name}\Application Data (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Application Data (Windows NT) 和 C:\Documents and Settings\{user name}\Local Settings\Application Data (Windows 2000、XP 和 Server 2003)。)

其他(tā)详细信息

它使用(yòng)下列扩展名(míng)加密文(wén)件：

• .backup
• .7z
• .rar
• .zip
• .tiff
• .jpeg
• .jpg
• .accdb
• .sqlite
• .dbf
• .1cd
• .mdb
• .cd
• .cdr
• .dwg
• .psd
• .pdf
• .odt
• .rtf
• .docx
• .xlsx
• .doc
• .xls