Ransom.Linux.YSORR.THEOEBF

It does not have any backdoor routine.

Installation

It drops the following files:

• /tmp/.sorry_{hostname}.log — daemon execution log (stdout/stderr redirect)

It adds the following processes:

• nohup {malware path} >/tmp/.sorry_{victim id}.log 2>&1 &

Other System Modifications

• This ransomware executes the following commands to stop services before encryption:
  
  • service sshd stop
  • service ssh stop
  • service mysql stop
  • service mysqld stop
  • service oracle stop
  • service mongod stop
  • service mongodb stop
  • service mariadb stop
  • service cassandra stop
  • service postgresql stop
  • service redis-server stop
  • service elasticsearch stop
  • systemctl stop sshd
  • systemctl stop ssh
  • systemctl stop mysql
  • systemctl stop redis
  • systemctl stop mariadb
  • systemctl stop elasticsearch
  • systemctl stop mongod
  • systemctl stop postgresql
  • systemctl stop cassandra
  • systemctl disable "mysql*"
  • systemctl disable "oracle*"
  • systemctl disable "postgresql*"
  • /etc/init.d/mysqld stop

This ransomware deletes the original unencrypted version of each targeted file after encryption is complete.

Propagation

• This ransomware drops the following copy(ies) of itself on remote systems accessible via SSH:
  
  • {remote host}:{path}/{malware filename}

• It spreads to remote Linux hosts by performing the following steps:
  
  • Reads /etc/passwd and ~/.ssh/known_hosts files to build a list of SSH target hosts
  • Brute-forces SSH credentials using the following hardcoded username and password wordlists:

On successful SSH authentication, copies itself to the remote host via SFTP and executes it remotely

Backdoor Routine

It does not have any backdoor routine.

Rootkit Capabilities

It does not have rootkit capabilities.

Information Theft

It gathers the following data:

• System Information:
  • Hostname — read from /proc/sys/kernel/hostname to generate a victim identifier in the format sorry_id_{hostname}

Stolen Information

It sends the gathered information via HTTP POST to the following URL:

• hxxp[://]68[.]{BLOCKED}[.]253:80

Other Details

It connects to the following URL(s) to check for an Internet connection:

• hxxp[://]{BLOCKED}le[.]com

It does the following:

• Performs a recursive traversal of the filesystem to locate files matching targeted extensions
• Enumerates local user accounts by reading /etc/passwd
• Enumerates previously-contacted SSH hosts by reading ~/.ssh/known_hosts files
• Reads /proc/self/mountinfo to enumerate filesystem mount points
• Reads /proc/self/cgroup for container environment detection
• Reads /dev/urandom to generate random key material
• Skips directories where README.md already exists to prevent re-encryption
• Writes a .sorry_exist marker file in each processed directory

It does not exploit any vulnerability.

Ransomware Routine

This ransomware encrypts files found in the affected system.

• It targets files with the following file extensions for encryption:
  
  • .accdb
  • .accde
  • .accdr
  • .accdt
  • .blend
  • .class
  • .hprof
  • .ibank
  • .nvram
  • .pages
  • .qcow2
  • .sqlite
  • .backup
  • .config
  • .design
  • .erbsql
  • .groups
  • .incpas
  • .laccdb
  • .psafe3
  • .wallet
  • .ycbcr
  • .sqlitedb
  • .backupdb
  • .mapimail
  • .pspimage
  • .sas7bdat
  • .db3
  • .dbf
  • .dbx
  • .fdb
  • .mdb
  • .mdf
  • .ndf
  • .sql
  • .ldf
  • .sdf
  • .3db
  • .bak
  • .bdb
  • .edb
  • .dmp
  • .doc
  • .dot
  • .pdf
  • .txt
  • .rtf
  • .odt
  • .ods
  • .odp
  • .ott
  • .xls
  • .xlt
  • .ppt
  • .pot
  • .pps
  • .psd
  • .eps
  • .svg
  • .png
  • .jpg
  • .gif
  • .bmp
  • .tif
  • .ico
  • .raw
  • .cr2
  • .nef
  • .orf
  • .dng
  • .raf
  • .arw
  • .fpx
  • .dwg
  • .dxf
  • .skp
  • .1cd
  • .3dm
  • .3ds
  • .3fr
  • .3g2
  • .3gp
  • .3pr
  • .602
  • .ps1
  • .aac
  • .ab4
  • .ach
  • .acr
  • .act
  • .adb
  • .adp
  • .ads
  • .aes
  • .ait
  • .aoi
  • .apj
  • .arc
  • .asc
  • .asf
  • .asm
  • .asp
  • .asx
  • .avi
  • .awg
  • .bat
  • .bay
  • .bgt
  • .bik
  • .bin
  • .bkp
  • .bpw
  • .brd
  • .cdf
  • .cdr
  • .cdx
  • .ce1
  • .ce2
  • .cer
  • .cfg
  • .cgm
  • .cib
  • .cls
  • .cmd
  • .cmt
  • .cpi
  • .cpp
  • .crt
  • .crw
  • .csh
  • .csl
  • .csr
  • .css
  • .csv
  • .dac
  • .dat
  • .dc2
  • .dch
  • .dcr
  • .dcs
  • .ddd
  • .dds
  • .der
  • .des
  • .dgc
  • .dif
  • .dip
  • .dit
  • .djv
  • .drf
  • .drw
  • .dtd
  • .dxb
  • .dxg
  • .eml
  • .erf
  • .exf
  • .ffd
  • .fff
  • .fhd
  • .fla
  • .flf
  • .flv
  • .frm
  • .fxg
  • .gpg
  • .gry
  • .hbk
  • .hdd
  • .hpp
  • .hwp
  • .ibd
  • .ibz
  • .idx
  • .ini
  • .iif
  • .iiq
  • .jar
  • .jnt
  • .jpe
  • .jsp
  • .kc2
  • .kdc
  • .key
  • .kwm
  • .lay
  • .lit
  • .log
  • .lua
  • .m3u
  • .m4p
  • .m4u
  • .m4v
  • .max
  • .mbx
  • .mdc
  • .mef
  • .mfw
  • .mid
  • .mkv
  • .mlb
  • .mml
  • .mmw
  • .mny
  • .mos
  • .mov
  • .mp3
  • .mp4
  • .mpg
  • .mrw
  • .msg
  • .myd
  • .myi
  • .ndd
  • .nk2
  • .nop
  • .nrw
  • .ns2
  • .ns3
  • .ns4
  • .nsd
  • .nsf
  • .nsg
  • .nsh
  • .nwb
  • .nx2
  • .nxl
  • .nyf
  • .oab
  • .obj
  • .odb
  • .odc
  • .odf
  • .odg
  • .odm
  • .ogg
  • .oil
  • .ost
  • .otg
  • .oth
  • .otp
  • .ots
  • .p12
  • .p7b
  • .p7c
  • .pab
  • .paq
  • .pas
  • .pat
  • .pcd
  • .pct
  • .pdb
  • .pdd
  • .pef
  • .pem
  • .pfx
  • .php
  • .pif
  • .plc
  • .prf
  • .pst
  • .ptx
  • .pwm
  • .qba
  • .qbb
  • .qbm
  • .qbr
  • .qbw
  • .qbx
  • .qby
  • .qed
  • .r3d
  • .rar
  • .rat
  • .rdb
  • .rvt
  • .rw2
  • .rwl
  • .rwz
  • .sav
  • .say
  • .sch
  • .sd0
  • .sda
  • .slk
  • .sr2
  • .srf
  • .srt
  • .srw
  • .st4
  • .st5
  • .st6
  • .st7
  • .st8
  • .stc
  • .std
  • .sti
  • .stm
  • .stw
  • .stx
  • .swf
  • .sxc
  • .sxd
  • .sxg
  • .sxi
  • .sxm
  • .sxw
  • .tar
  • .tbk
  • .tex
  • .tga
  • .tgz
  • .thm
  • .tmp
  • .tlg
  • .uop
  • .uot
  • .vbs
  • .vdi
  • .vhd
  • .vmx
  • .vob
  • .wab
  • .wad
  • .war
  • .wav
  • .wb2
  • .wk1
  • .wks
  • .wma
  • .wmv
  • .wpd
  • .wps
  • .x11
  • .x3f
  • .xis
  • .xla
  • .xlc
  • .xlk
  • .xlm
  • .xlr
  • .xlw
  • .xml
  • .yml
  • .yuv
  • .zip
  • .db
  • .ai
  • .7z
  • .al
  • .cs
  • .fh
  • .gz
  • .js
  • .md
  • .nd
  • .pl
  • .ps
  • .py
  • .rb
  • .rm
  • .sh
  • .vb
  • .git
  • .ssh
  • .docx
  • .docb
  • .docm
  • .dotm
  • .dotx
  • .xlsx
  • .xlsb
  • .xlsm
  • .xltm
  • .xltx
  • .pptm
  • .pptx
  • .potm
  • .potx
  • .ppsm
  • .ppsx
  • .ppam
  • .jpeg
  • .tiff
  • .webp
  • .indd
  • .livp
  • .heic
  • .heif
  • .agdl
  • .aiff
  • .aspx
  • .bac

It avoids encrypting files found in the following folders:

• /boot/
• /proc/
• /lost+found
• /node_modules
• /.trash
• /.cache
• /dev/

It drops the following file(s) as ransom note:

• {Encrypted Directory}/README.md

It appends the following extension to the file name of the encrypted files:

• .sorry