MSIL/Filecoder.Samas [Threat Name] go to Threat

MSIL/Filecoder.Samas.A [Threat Variant Name]

Category	trojan
Size	221184 B
Aliases	Ransom:MSIL/Samas.B (Microsoft)
	Trojan.Encoder.4331 (Dr.Web)

Short description

MSIL/Filecoder.Samas.A is a trojan that encrypts files on fixed, removable and network drives. To decrypt files the user is requested to comply with given conditions in exchange for a password/instructions.

Installation

The trojan does not create any copies of itself.

The trojan creates the following files:

%commonappdata%\BackupHomeDir\macrosoft10.exe
%commonappdata%\BackupHomeDir\gomacro10.bat
%variable%HOW_TO_DECRYPT_FILES.html

A string with variable content is used instead of %variable% .

Other information

MSIL/Filecoder.Samas.A is a trojan that encrypts files on fixed, removable and network drives.

The trojan searches for files with the following file extensions:

.3dm
.3ds
.3fr
.3g2
.3gp
.3pr
.7z
.ab4
.accdb
.accde
.accdr
.accdt
.acr
.act
.adb
.ads
.agdl
.ach
.ai
.ait
.al
.apj
.arw
.asf
.asm
.asmx
.asp
.aspx
.asx
.avi
.awg
.back
.backup
.backupdb
.bak
.bank
.bay
.bdb
.bgt
.bik
.bkf
.bkp
.blend
.bpw
.c
.cdf
.cdr
.cdr3
.cdr4
.cdr5
.cdr6
.cdrw
.cdx
.ce1
.ce2
.cer
.cfp
.cgm
.cib
.class
.cls
.cmt
.config
.cpi
.cpp
.cr2
.craw
.crt
.crw
.cs
.csh
.csl
.csv
.dac
.db
.db3
.dbf
.db-journal
.dbx
.dc2
.dcr
.dcs
.ddd
.ddoc
.ddrw
.dds
.der
.des
.design
.dgc
.djvu
.dng
.doc
.docm
.docx
.dot
.dotm
.dotx
.drf
.drw
.dtd
.dwg
.dxb
.dxf
.dxg
.eml
.eps
.erbsql
.erf
.exf
.fdb
.ffd
.fff
.fh
.fhd
.fla
.flac
.flv
.fmb
.fpx
.fxg
.gray
.grey
.gry
.h
.hbk
.hpp
.htm
.html
.ibank
.ibd
.ibz
.idx
.iif
.iiq
.incpas
.indd
.jar
.java
.jpe
.jpeg
.jpg
.jsp
.kbx
.kc2
.kdbx
.kdc
.key
.kpdx
.lua
.m
.m4v
.max
.mdb
.mdc
.mdf
.mef
.mfw
.mmw
.moneywell
.mos
.mov
.mp3
.mp4
.mpg
.mrw
.msg
.myd
.nd
.ndd
.nef
.nk2
.nop
.nrw
.ns2
.ns3
.ns4
.nsd
.nsf
.nsg
.nsh
.nwb
.nx2
.nxl
.nyf
.oab
.obj
.odb
.odc
.odf
.odg
.odm
.odp
.ods
.odt
.oil
.orf
.ost
.otg
.oth
.otp
.ots
.ott
.p12
.p7b
.p7c
.pab
.pages
.pas
.pat
.pbl
.pbl
.pcd
.pct
.pdb
.pdd
.pdf
.pef
.pem
.pfx
.php
.php5
.phtml
.pl
.plc
.png
.pot
.potm
.potx
.ppam
.pps
.ppsm
.ppsx
.ppt
.pptm
.pptx
.prf
.ps
.psafe3
.psd
.pspimage
.pst
.ptx
.py
.qba
.qbb
.qbm
.qbr
.qbw
.qbx
.qby
.r3d
.raf
.rar
.rat
.raw
.rdb
.rm
.rtf
.rw2
.rwl
.rwz
.s3db
.sas7bdat
.say
.sd0
.sda
.sdf
.sldm
.sldx
.sql
.sqlite
.sqlite3
.sqlitedb
.sr2
.srf
.srt
.srw
.st4
.st5
.st6
.st7
.st8
.std
.sti
.stw
.stx
.svg
.swf
.sxc
.sxd
.sxg
.sxi
.sxm
.sxw
.tex
.tga
.thm
.tib
.tif
.tlg
.txt
.vb
.vob
.wallet
.war
.wav
.wb2
.wmv
.wpd
.wps
.x11
.x3f
.xis
.xla
.xlam
.xlk
.xlm
.xlr
.xls
.xlsb
.xlsm
.xlsx
.xlt
.xltm
.xltx
.xlw
.xml
.ycbcra
.yuv
.zip

It avoids files with the following extensions:

.dll
.exe
.ini
.justbtcwillhelpyou
.lnk
.msi
.scf
.search-ms
.sys
.wim

It avoids files which contain any of the following strings in their path:

%systemdrive%\windows
%systemdrive%\winnt
%systemdrive%\boot
%systemdrive%\users\all users
%systemdrive%\documents and settings\all users
%systemdrive%\users\default
reference assemblies\microsoft
recycle.bin
search-ms
microsoft\windows
appdata
%commonappdata%
gomacro10.bat
macrosoft10.exe
HOW_TO_DECRYPT_FILES.html
%malwarefilename%
desktop.ini
ntuser.dat

The trojan encrypts the file content.

The Rijndael-128 encryption algorithm is used.

The extension of the encrypted files is changed to:

%originalfilepath%.justbtcwillhelpyou

To decrypt files the user is requested to comply with given conditions in exchange for a password/instructions.

The trojan executes the following files:

%commonappdata%\BackupHomeDir\macrosoft10.exe
%commonappdata%\BackupHomeDir\gomacro10.bat

The trojan then removes itself from the computer.