Ransom.Linux.AVOSLOCKER.YXCAKZ

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Ransomware does the following:

• Terminates VMware Elastic Sky X Integrated (ESXi) and Virtual Machine File System (VMFS) processes
• Displays the following if an argument is not given:
  
• Displays the following in the terminal while encrypting:
  

It accepts the following parameters:

• {Thread Count} {path} {path2}
  • {Thread Count} - Number of threads to be used for the encrpytion routine.
  • {path} - Directory to be encrypted (required)
  • {path2} - Additional directory to be encrypted (optional)

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .avoslinux

It leaves text files that serve as ransom notes containing the following text:

• {Encrypted Directory}\README_FOR_RESTORE