Win32/Filecoder.Maze [Threat Name] go to Threat
Win32/Filecoder.Maze.A [Threat Variant Name]
| Category | trojan |
| Size | 368160 B |
| Aliases | Ransom:Win32/Maze.PA!MTB (Microsoft) |
| Ransom.Maze (Symantec) |
Short description
Win32/Filecoder.Maze.A is a trojan that encrypts files on fixed, removable and network drives. To decrypt files the user is requested to comply with given conditions in exchange for a password/instructions.
Installation
The trojan does not create any copies of itself.
Payload information
Win32/Filecoder.Maze.A is a trojan that encrypts files on fixed, removable and network drives.
The trojan searches for files with the following file extensions:
- *.*
It avoids files which contain any of the following strings in their path:
- :\Windows
- \All Users
- \cache2\entries\
- \Games\
- \Local Settings\
- \Low\Content.IE5\
- \Program Files
- \ProgramData\
- \Tor Browser\
- \User Data\Default\Cache\
- {0AFACED1-E828-11D1-9187-B532F1E9575D}
- AhnLab
- AppData\Local
- IETldCache\
It avoids files with the following filenames:
- autorun.inf
- boot.ini
- Bootfont.bin
- bootsect.bak
- DECRYPT-FILES.txt
- desktop.ini
- iconcache.db
- ntuser.dat
- ntuser.dat.log
It avoids files with the following extensions:
- .dll
- .exe
- .lnk
- .sys
The trojan encrypts the file content.
The RSA, ChaCha encryption algorithm is used.
The extension of the encrypted files is changed to:
- %originalfilepath%%variable%
A string with variable content is used instead of %variable% .
To decrypt files the user is requested to comply with given conditions in exchange for a password/instructions.
When searching the drives, the trojan creates the following file in every folder visited:
- DECRYPT-FILES.txt
It contains the following text:
The following file is dropped:
- %temp%\000.bmp (3145782 B)
This file/image is set as a wallpaper.
Some examples follow.
Information stealing
Win32/Filecoder.Maze.A is a trojan that steals sensitive information.
The trojan collects the following information:
- user name
- computer name
- size of hard disk drive
- operating system version
- list of shared folders
The trojan contains a list of 10 IP addresses.
The trojan attempts to send gathered information to a remote machine.
Other information
The trojan may execute the following commands:
- %system%\wmic.exe shadowcopy delete
The trojan may terminate specific running processes.
The trojan may create the following files:
- %remotedrive%\CLASSIFIED.{0AFACED1-E828-11D1-9187-B532F1E9575D}\target.lnk (455 B)
- %remotedrive%\SECRET.{0AFACED1-E828-11D1-9187-B532F1E9575D}\target.lnk (455 B)