New Crypto 3.0 sample

August 11, 2015, one of our systems managed to get a new sample belonging to the family of Cryptowall 3 (Crowti).

Using ThreatSecure Networks' behavioral determination, we were able to confirm the "maliciousness" of this sample as it exhibited the following notable behaviors

"Runs an exe in the system folder"
"Creates a hidden file"
"Known malicious behavior, Crowti related"
"Opens Windows configuration files"
"Searches for credentials"
"Executes non-standard memory operations"
"Creates a registry entry to start itself at each boot"
"Disables or removes Windows services"
"Checks for kernel debugger"

Cryptowall is a known ransomware that encrypts files on a targeted PC. It urges the victim to pay in exchange for decrypting the "hostaged" files.

Fig 1. HELP_DECRYPT.PNG

One of the most noticeable features of this sample, is it's icon, which is technically nothing (See Fig 2)

Fig 2. Notice the "invisible" icon?

The sample also beacons out to known malicious IP addresses, attempting to download and POST data gathered from the victims PC.

ip-addr.es

myexternalip.com/raw

curlmyip.com

glamazona.com

fortecegypt.com