Emerging threat on CRYPWALL version 4

Product / Version includes:

Interscan Web Security Virtual ApplianceAll , Deep SecurityAll , Interscan Messaging Security Virtual ApplianceAll , ScanMail for ExchangeAll

Last updated: 2024/05/16

Solution ID: KA-0006035

Category: Configure , Troubleshoot , Remove a Malware / Virus , Update

Summary

CRYPWALL v4 is usually downloaded by a DLOADER which arrives as an attachment on spam mail, or downloaded from the Internet.

The spam mail appears to be a mail containing a resume or a billing statement as attachment. This attachment contains a JS file which downloads CRYPWALL. No exploit is being used in the spam mail. You will have to click to execute the JS file. When executed, It will encrypt your files and will ask for ransom to recover your encrypted files.

For further information on the previous version, TROJ_CRYPWALL that Trend Micro already detects, click here.

Antispam Pattern

LAYER	Details	Pattern Version	Release Date (GMT+8)
EXPOSURE	Spam mail with JS attachment	AS 1978	12/2/2015

VSAPI Pattern (Malicious File Detection)

LAYER	Detection	Pattern Branch	Release Date (GMT+8)
INFECTION	JS_CRYPLOD.SMA	OPR 12.169	11/23/2015
INFECTION	TROJ_CRYPWALL.DE	OPR 12.163	11/20/2015
INFECTION	Ransom_CRYPWALL.SMB	OPR 12.159	11/18/2015
INFECTION	Ransom_CRYPWALL.XXUAL	OPR 12.157	11/17/2015
CLEAN-UP	HS_WALLNOTE.SM1	OPR 12.147	11/12/2015

WRS Pattern (Malicious URL and Classification)

LAYER	Malicious URL	Classification	Blocking Date (GMT+8)
EXPOSURE	http://{BLOCKED}46.30.43.183/syria.exe	Virus Accomplice	11/3/2015
EXPOSURE	http://{BLOCKED}46.30.45.73/export.exe	Ransomware, Virus Accomplice	11/13/2014
EXPOSURE	http://{BLOCKED}46.30.45.73/mert.exe	Virus Accomplice, Disease Vector	11/18/2015
EXPOSURE	http://{BLOCKED}46.30.42.78/import.exe	Ransomware, Virus Accomplice	11/11/2015
EXPOSURE	http://{BLOCKED}siddharthbunglows.com/wp-content/themes/twentythirteen/5Q4rte.php?v=1u2bv6eod5qf0n	C&C, Virus Accomplice	11/20/2015
EXPOSURE	http://{BLOCKED}siddharthbunglows.com/wp-content/themes/twentythirteen/5Q4rte.php?v=4y4lqj4krkt8	C&C, Virus Accomplice	11/20/2015
EXPOSURE	http://{BLOCKED}siddharthbunglows.com/wp-content/themes/twentythirteen/5Q4rte.php?x=xava0s2h50wux	C&C, Virus Accomplice	11/20/2015
EXPOSURE	http://{BLOCKED}daxpolska.com/x_files/1.php?e=43gn4du2ju3waq	Ransomware, Virus Accomplice	11/18/2015
EXPOSURE	http://{BLOCKED}daxpolska.com/x_files/1.php?m=qpg7e5o152yn1h	Ransomware, Virus Accomplice	11/18/2015
EXPOSURE	http://{BLOCKED}limret.com/form/mailformpro/2.php?e=43gn4du2ju3waq	Ransomware, Virus Accomplice	11/18/2015
EXPOSURE	http://{BLOCKED}limret.com/form/mailformpro/2.php?k=qpg7e5o152yn1h	Ransomware, Virus Accomplice	11/18/2015
CLEAN-UP	http://{BLOCKED}3wzn5p2yiumh7akj.onion	Ransomware, Disease Vector	11/19/2015
CLEAN-UP	http://{BLOCKED}therealdiehls.com/K3_J96.php	Ransomware, Virus Accomplice	11/18/2015
CLEAN-UP	http://{BLOCKED}konstructmarketing.com/Ml63Pu.php	C&C, Virus Accomplice	11/13/2015
CLEAN-UP	http://{BLOCKED}nobilighting.com/eX8yjr.php	C&C, Virus Accomplice	11/13/2015
CLEAN-UP	http://{BLOCKED}project976.org/zyS9Kf.php	C&C, Virus Accomplice	11/13/2015
CLEAN-UP	http://{BLOCKED}promofordbekasi.com/6jVb5D.php	C&C, Virus Accomplice	11/13/2015
CLEAN-UP	http://{BLOCKED}reanimator-service.com/Y1U5s7.php	C&C, Virus Accomplice	11/13/2015
CLEAN-UP	http://{BLOCKED}theboomerzblog.com/fQu7UH.php	C&C, Virus Accomplice	11/13/2015
CLEAN-UP	http://{BLOCKED}zemamranews.com/jxke9u.php	C&C, Virus Accomplice	11/13/2015
CLEAN-UP	http://{BLOCKED}sadefuar.com/xdqHcr.php	C&C, Virus Accomplice	11/13/2015
CLEAN-UP	http://{BLOCKED}shopshe.com/jECfKN.php	C&C, Virus Accomplice	11/13/2015
CLEAN-UP	http://{BLOCKED}vlsex.net/O4vH1A.php	C&C, Virus Accomplice	11/13/2015
CLEAN-UP	http://{BLOCKED}wpwarriors.com/gnHPMv.php	C&C, Virus Accomplice	11/13/2015
CLEAN-UP	http://{BLOCKED}primemovies.net/z6Hfan.php	Virus Accomplice	11/12/2015
CLEAN-UP	http://{BLOCKED}xn--e1asbeck.xn--p1ai/7xSCFU.php	Virus Accomplice	11/12/2015
CLEAN-UP	http://{BLOCKED}webandnoticias.com/t6xe1z.php	Disease Vector	11/11/2015
CLEAN-UP	http://{BLOCKED}rationwalaaa.com/QOPYrs.php	Ransomware, Virus Accomplice	11/11/2015
CLEAN-UP	http://{BLOCKED}spideragroscience.com/cWo1T2.php	Ransomware, Virus Accomplice	11/11/2015
CLEAN-UP	http://{BLOCKED}virginia-education.com/8Ycy6k.php	Ransomware, Virus Accomplice	11/11/2015
CLEAN-UP	http://{BLOCKED}46.30.45.73/import.exe	Disease Vector	11/10/2015
CLEAN-UP	http://{BLOCKED}3wzn5p2yiumh7akj.effectwaytopay.com	Ransomware, Disease Vector	11/9/2015
CLEAN-UP	http://{BLOCKED}3wzn5p2yiumh7akj.forkinvestpay.com	Ransomware, Disease Vector	11/9/2015
CLEAN-UP	http://{BLOCKED}3wzn5p2yiumh7akj.marketcryptopartners.com	Ransomware, Disease Vector	11/9/2015
CLEAN-UP	http://{BLOCKED}3wzn5p2yiumh7akj.partnersinvestpayto.com	Ransomware, Disease Vector	11/9/2015
CLEAN-UP	http://{BLOCKED}thecarnivalfest.com/mQF14M.php	Ransomware, Virus Accomplice	11/6/2015
CLEAN-UP	http://{BLOCKED}meaarts.com/bMUmqv.php	Ransomware, Virus Accomplice	11/5/2015
CLEAN-UP	http://{BLOCKED}perpabaskievi.net/VCOzj5.php	Ransomware, Virus Accomplice	11/5/2015
CLEAN-UP	http://{BLOCKED}pretor.su/ZLoNyf.php	Ransomware, Virus Accomplice	11/5/2015
CLEAN-UP	http://{BLOCKED}safepeace.com/_QXEd6.php	Ransomware, Virus Accomplice	11/5/2015
CLEAN-UP	http://{BLOCKED}sparshsewa.com/5a8CTM.php	Ransomware, Virus Accomplice	11/5/2015
CLEAN-UP	http://{BLOCKED}tmp3malinium.com/7DSCmu.php	Ransomware, Virus Accomplice	11/5/2015
CLEAN-UP	http://{BLOCKED}noblevisage.com/2qs9Rr.php	Disease Vector	11/3/2015
CLEAN-UP	http://{BLOCKED}travancy.com/8GBn_t.php	Disease Vector	11/3/2015
CLEAN-UP	http://{BLOCKED}tamazawatokuichiro.com/TkCs3y.php	C&C, Virus Accomplice	11/2/2015

AEGIS Pattern (Behavior Monitoring Pattern)

LAYER	Policy	Pattern Version	Release Date
DYNAMIC	4126T	OPR 1499	12/1/2015 (Batch 1)
DYNAMIC	4127T	OPR 1499	12/1/2015 (Batch 1)

DCT Pattern (System Clean Pattern)

LAYER	Detection	Pattern Version	Released Date
DYNAMIC	DCT Genclean	latest OPR	pre-existing

Network Pattern

LAYER	PATTERN Name	Pattern Version	Release Date
CLEAN-UP	HTTP_CRYPDEF_REQUEST	Endpoint RR 1.10115.00	4/28/2015
CLEAN-UP	OPS_HTTP_CRYPDEF_REQUEST	Endpoint RR 1.10125.00	7/28/2015

Make sure to always use the latest pattern available to detect the old and new variants of CRYPWALL VERSION 4.

Solution Map - What should customers do?

Major Products	Versions	Virus Pattern	Behavior Monitoring	Web Reputation	DCT Pattern	Antispam Pattern	Network Pattern
OfficeScan	10.6 and above	Update Pattern via web console	Update Pattern via web console	Enable Web Reputation Service*	Update Pattern via Web console	Not Applicable	Update Pattern via Web console
Deep Security	8.0 and above		Not Applicable		Update Pattern via Web console	Not Applicable	Update Pattern via Web console
ScanMail	SMEX 10 and later		Not Applicable		Not Applicable	Update Pattern via Web console	Not Applicable
ScanMail	SMD 5 and later		Not Applicable		Not Applicable		Not Applicable
InterScan Messaging	IMSVA 8.0 and above		Not Applicable		Not Applicable		Not Applicable
InterScan Web	IWSVA 6.0 and later		Not Applicable		Not Applicable		Not Applicable
Deep Discovery	DDI 3.0 and later		Not Applicable		Not Applicable	Not Applicable	Update Pattern via web console

*Refer to the Product Administrator’s Guide on how to enable the Email Reputation or Web Reputation services features.

Recommendations

Best practices in configuring WFBS for malware protection:
Best practice configuration for malware prevention in Worry-Free Business Security Services (WFBS-SVC)

Threat Report

http://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/RANSOM_CRYPWALL.XXUAB

Was this article helpful?

Featured

Automation Center

Education Portal

Online Help Center

Service Status

TrendConnect

Emerging threat on CRYPWALL version 4

Emerging threat on CRYPWALL version 4

Product / Version includes:

Summary