Rig Exploit Kit via EiTest delivers buggy CryptoShield Ransomware

February 3, 2017

The Sonicwall Threats Research team have received reports of ransomware known as CryptoShield that is being distributed through compromised websites using the Rig Exploit Kit. The copy of the ransomware that we obtained comes with a twist. Instead of encrypting files and offering their recovery after a ransom is paid it accidentally deletes them due to a bug.

Infection Cycle:

The Trojan has the following hardcoded IP address for the C&C server:

The Trojan attempts to report the infection to the C&C server with a unique user ID. The server was not operating as desired by the operators at the time of writing:

The Trojan adds the following key to the Windows registry to enable startup after reboot:

  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun Windows SmartScreen %APPDATA%MicroSoftWareSmartScreenSmartScreen.exe

The Trojan adds the following files to the system:

  • %APPDATA%MicroSoftWareSmartScreenSmartScreen.exe
  • {shared drives}Stop Ransomware Decrypts Tools.exe [Detected as GAV: CryptoShield.A (Trojan)]

It will then traverse all directories looking for files of predefined filetypes to encrypt. Due to not being able to communicate as expected with the C&C server the "encryption" process results in the files being deleted. The following 2 files are dropped in the directories containing the "encrypted" files:


The files contain the following data which are presented on-screen by the Trojan. It contains instructions for file retrieval which of course will not work for deleted files:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

  • GAV: CryptoShield.A (Trojan)