Ransom.Linux.TARGETCOMP.YXEEQT

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {Malware File Path}\TargetInfo.txt

Information Theft

This Ransomware gathers the following data:

• Hostname
• Language
• IP Address
• Operating System
• CPU Architecture

Stolen Information

This Ransomware sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}.{BLOCKED}.{BLOCKED}.142/QWEwqdsvsf/ap.php

Other Details

This Ransomware connects to the following URL(s) to get the affected system's IP address:

• http://{BLOCKED}fy.org

It does the following:

• It encrpyts disk image files with the following extension if the system name matches "vmkernel":
  • .vmdk
  • .vmem
  • .vswp
  • .vmsn
  • .vmx
  • .nvram
• It requires being executed with Administrative privileges to proceed with its routine.

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .locked

It drops the following file(s) as ransom note:

• {Encrypted Directory}\HOW TO DECRYPt.txt