Ransom.Linux.CHEERSCRYPT.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Ransomware does the following:

• It requires to be executed together with the directory to be encrypted as its parameter
• It shuts down Virtual Machines

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .log
• .vmdk
• .vmem
• .vswp
• .vmsn

It appends the following extension to the file name of the encrypted files:

• .Cheers

It drops the following file(s) as ransom note:

• {Encrypted directory}\How to Restore Your Files.txt