Ransom.Linux.CRYPTED.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• /{Malware Path}/lambda.log → logs list of files to be encrypted and if encryption is successful.

Other Details

This Ransomware does the following:

• It requires the following parameters to perform its intended routine:
  
  • {Malware Filename} {File Path to start encryption}

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .crypted

It drops the following file(s) as ransom note:

• /{Encrypted Directory}/{Filename of Encrypted File}.crypted.README_TO_RESTORE
  

It avoids encrypting files with the following file extensions:

• .crypted
• .a
• .so
• .la
• .o