SHA1 a72200e7d8918b8d76e74bbb74bdde4ae4f1b8a2
Encryption ransomware that has been distributed via mass mailings since November 2, 2015. The Trojan is disguised as a small file containing a JavaScript script. Once launched, this file extracts from its body an application that ensures the Trojan's running.
The malware adds an encrypted dynamic-link library (.DLL) to the Windows system registry and then injects a small piece of code into explorer.exe. The code loads the file from the registry into the memory, decrypts it, and transfers control to this file. The library is compressed with UPACK and has the size of about 20 KB.
The list of files to be encrypted is stored in the HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\ registry branch. For every file, Trojan.Encoder.2843 generates a unique key (0x38) consisting of uppercase Latin letters. Files are encrypted with Blowfish ECB (448-byte key); at that, the maximum length of an encrypted data block is 0x14000000. Each encrypted file is appended with the .vault extension.
A session key is encrypted with RSA using CryptoAPI.