New LockScreen Ransomware Trojan in the wild

May 11, 2012

The Sonicwall UTM research team discovered a new Ransomware Trojan in the wild originating from Russia but targetting UK users. Ransomware simply extorts money from its victims by denying access back to the desktop until a sum of money is paid. This type of Lockscreen Ransomware has also been covered in a previous sonicalert

Once infected, the Trojan pops up the following screen giving a fake justification as to why it is locked:

The screen is positioned to be always-on-top of other windows. The desktop is thus locked until the correct lock code is entered.

The Trojan makes the following changes to the windows registry:

enable startup:

  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "{original run path}"

disables Safe-mode by renaming the following keys:

  • HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimal to HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootmini
  • HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootNetwork to HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBoot net

The Trojan contains functionality to disable taskmgr.exe, msconfig.exe, regedit.exe and cmd.exe:

The Trojan contains code to report to a remote server and provide backdoor functionality:

Upon further analysis, we discovered two plaintext unlock keys embedded in the executable code. The keys "end!" and "892736loker" can be used to temporarily unlock the desktop. However, these keys do not remove the Trojan from the system. The Trojan lockscreen will appear on next reboot.

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

  • GAV: LockScreen.AKE (Trojan)