Ransom.Win32.LIVEDE.THLBHBC

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• {malware directory}\libgobject-2.0-0.dll
• {malware directory}\libiconv-2.dll
• {malware directory}\libintl-8.dll
• {malware directory}\libpcre2-8-0.dll
• {malware directory}\livelocked.exe
• {malware directory}\windows_encryptor_180870197840.exe
• {malware directory}\libffi-8.dll
• {malware directory}\libglib-2.0-0.dll

Fügt die folgenden Prozesse hinzu:

• bcdedit /set {current} recoveryenabled no
• bcdedit /set {default} recoveryenabled no
• bcdedit /set {current} bootstatuspolicy ignoreallfailures
• bcdedit /set {default} bootstatuspolicy ignoreallfailures
• vssadmin Delete Shadows /All /Quiet
• wbadmin DELETE BACKUP -keepVersions:0 -quiet
• taskkill /F /IM {process name}
• net stop {service name} /y
• wevtutil cl application
• wevtutil cl security
• wevtutil cl system

Andere Systemänderungen

Stellt auf dem System das folgende Bild als Desktop-Hintergrundbild ein:

Andere Details

Es macht Folgendes:

• The file is a self-extracting archive.
• Clears event logs to hide its malicious behaviors.
• It encrypts drives from A:\ to Z:\