Home Malware Programs Trojans Trojan.Ransomlock.AE

Trojan.Ransomlock.AE

Posted: May 10, 2013

Threat Metric

Threat Level: 9/10
Infected PCs: 19
First Seen: May 10, 2013
Last Seen: February 1, 2022
OS(es) Affected: Windows

Trojan.Ransomlock.AE is a Trojan that locks the desktop of the targeted PC and makes the computer system unusable. Trojan.Ransomlock.AE displays a full-screen warning message and asks the affected PC user to pay a so-called ransom to unlock the computer. Trojan.Ransomlock.AE may spread through a website, which hosts an exploit kit. When executed, Trojan.Ransomlock.AE may create the potentially malicious file. Trojan.Ransomlock.AE may create the registry entry so that it can be executed automatically whenever Windows is started. Trojan.Ransomlock.AE may also create other registry entries. Trojan.Ransomlock.AE then grabs system information from the infected computer, which includes operating system version and user ID. Trojan.Ransomlock.AE then uploads the information to one of the command-and-control (C&C) servers.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%CurrentFolder%\[THREAT FILE NAME] File name: %CurrentFolder%\[THREAT FILE NAME]
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"Sysyem Cleaner" = "%CurrentFolder%\[THREAT FILE NAME]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon\"Userinit" = "%Windir%\userinit.exe,%SystemDrive%\[BINARY CONTENT]"
Loading...