Ransom.Linux.REDNIEV.YXCGH

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Ransomware accepts the following parameters:

• -p Path (Encrypts files in a directory)
• -f File (Encrypts a file)
• -r Recursive (Used with -p)
• -t Show encryption time
• -n Search without file encryption (File info)
• -x Debug Tests (Asymmetric cryptography performance tests)
• -h List of command options
• -w Stops running VMs by calling an esxcli command:
  • esxcli –formatter=csv –format-param=fields==”WorldID,DisplayName” vm process list | tail -n +2 | awk -F $’,’ ‘{system(“esxcli vm process kill –type=force –world-id=” $1)}’

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .log
• .vmdk
• .vmem
• .vmsn
• .vswp

It drops the following file(s) as ransom note:

• {Infected Directory}/HOW_TO_RESTORE