Ransom.FreeBSD.INTERLOCK.THJBBBD

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Ransomware accepts the following parameters:

• -d | --directory → encrypts a specified directory including its subdirectories
• -f | --file → encrypts a specified file
• -del | --delete → encrypts files then deletes itself using unlink() system call
• -s | --system

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• {Any String}boot.cfg
• {Any String}!__README__!.txt

It avoids encrypting files found in the following folders:

• bin
• boot
• cdrom
• dev
• etc
• home
• lib
• lib32
• lib64
• libx32
• lost+found
• media
• mnt
• opt
• proc
• root
• run
• sbin
• snap
• srv
• sys
• tmp
• usr
• var

It appends the following extension to the file name of the encrypted files:

• .interlock

It drops the following file(s) as ransom note:

• {Encrypted Path}/!__README__!.txt
  

It avoids encrypting files with the following file extensions:

• .b00
• .sf
• .t00
• .v00
• .v01
• .v02
• .v03
• .v04
• .v05
• .v06
• .v07
• .interlock