• Home
• >Threat Encyclopaedia
• >Descriptions
• > Win32/ZinoCrypt.A

Short description

Win32/ZinoCrypt.A is a trojan that encrypts files on fixed, removable and network drives. To decrypt files the user is requested to comply with given conditions in exchange for a password/instructions.

Installation

When executed, the trojan creates the following folder:

The trojan may create the following files:

The trojan may create copies of itself using the following filenames:

This copy of the trojan is then executed.

The trojan may set the following Registry entries:

The trojan may delete the following folders:

The trojan may delete the following files:

The trojan may delete the following Registry entries:

Payload information

Win32/ZinoCrypt.A is a trojan that encrypts files on fixed, removable and network drives.

The trojan searches local, removable and network drives for files with one of the following extensions:

It avoids files which contain any of the following strings in their path:

The trojan encrypts the file content.

The name of the encrypted file is changed to:

When searching the drives, the trojan creates the following file in every folder visited:

To decrypt files the user is requested to comply with given conditions in exchange for a password/instructions.

The trojan removes all of the volume shadow copies in order to prevent restoring the original files.

Other information

The trojan can create and run a new thread with its own program code within the following processes:

The trojan may execute the following files:

The trojan executes the following command:

The trojan can download a file from the Internet.

The trojan contains a list of (2) URLs. The HTTP protocol is used in the communication.

The file is stored in the following location:

This file/image is set as a wallpaper.

The trojan can detect presence of debuggers and other analytical tools.

Trojan is able to bypass User Account Control (UAC).

• Contact |
• Privacy |
• Legal Information |
• Sitemap