Ransom.Linux.RANINC.YXDLOT

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops and executes the following files:

• If the '-esxi' parameter is used:
  • {Malware File Path}/kill

Other Details

This Ransomware accepts the following parameters:

• --debug → Print debugging logs of the malware to the terminal.
• --daemon → Creates a duplicate child process of itself.
• --file {File Path} → Encrypts the specified file.
• --dir {Direcrtory Path} → Encrypts the specified directory.
  • --motd → Modifies the content of the "Message of the Day" system file '/etc/motd' into the ransom note text.
• --esxi → Kill ESXi servers. Disables autostart for the host, powers off all virtual machines, and remove all snapshots from each virtual machine.
  • --skip {Virtual Machine name} → Excludes the specified virtual machine from the termination process.

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .vmdk
• .vmem
• .vmx
• .vswp
• .vmsn

It avoids encrypting files with the following strings in their file name:

• INC

It appends the following extension to the file name of the encrypted files:

• {original filename}.{original extension}.INC

It drops the following file(s) as ransom note:

• {Encypted Directory}\INC-README.txt
  
• {Encypted Directory}\INC-README.html