Ransom.MacOS.LOCKBIT.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Ransomware does the following:

• It disables the autostart using the following command:
  • vim-cmd hostsvc/autostartmanager/enable_autostart false
• It runs this command to power off the running virtual machine:
  • esxcli vm process kill--type force--world-id

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• restore-my-files.txt
• xkeyboard-config
• ntuser.dat.log
• bootsect.bak
• autorun.inf
• thumbs.db
• iconcache.db

It appends the following extension to the file name of the encrypted files:

• .lockbit

It leaves text files that serve as ransom notes containing the following text:

It avoids encrypting files with the following file extensions:

• cmd
• ani
• adv
• msi
• msp
• com
• nls
• ocx
• mpa
• cpl
• mod
• hta
• prf
• rtp
• rdp
• bin
• shs
• wpx
• bat
• rom
• msc
• spl
• ics
• key
• exe
• dll