Bitcrypt v2.0 ~ Anti-Malware Laboratory

Bitcrypt is a ransomware program where in it encrypts certain types of file in the system using RSA public-key cryptography. This malware will display a message offering the user to decrypt the data once the payment is made through Bitcoin.

Summary

Upon execution, it will create a thread that will periodically check and terminate running instance of taskmgr.exe and regedit.exe.

It will also check the existence of the following registry entry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

Value Name: Bitcomint
%APPDATA%\[RANDOM FILE NAME].exe

If the above registry entry doesn't exist it will create one and also create a copy of itself in %APPDATA%. After ensuring that the malware will start every time the Windows start, it will execute the following commands:

/K bcdedit /set {bootmgr} displaybootmenu no
/K bcdedit /set {default} bootstatuspolicy ignoreallfailures

It will set country or region location of windows through the following registry entry:

HKEY_CURRENT_USER\Control Panel\International\Geo

Value Name: Nation
Data : 244 (244 is the country code of US)

It will then check if the following files exists in %APPDATA%, if not it will create a copy of the following files and then execute a copy of itself in %APPDATA%, then terminate and delete the currently running file.

bitcrypt.ccw

This file contains base 64 strings, BitCrypt ID and status of encryption of files in the system

BitCrypt ID format

WIN -<region location of Windows>-<4 random numbers><index of base64 strings>

BitCrypt.txt

This file contains information where to download the program decryptor. This note is in 10 different languages: English, French, German, Russian, Italian, Spanish, Portuguese, Japanese, Chinese and Arabic. In this note it also claims that files are encoded using RSA-1024 key. As of this moment, links given by this note is not accessible.

It will create del.bat to delete the currently running file and execute the copy of itself in %APPDATA%.

Extraction of base 64 strings

This malware creates jump table of the available random base 64 string arrays. Using Delphi generator it randomly chose an index of what set of strings to use at the time of infection.