Ransom.Linux.BRAINCIPHER.THHOIBD

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• If parameter -onvm {ID1, ID2, ID3, ...} is used:
  • /tmp/running_vms.txt → contains active VM IDs retrieved from the system.

Fügt die folgenden Prozesse hinzu:

• If parameter -onvm {ID1, ID2, ID3, ...} is used:
  • vim-cmd vmsvc/getallvms | grep '^[0-9]' | awk '{print $1}' > /tmp/running_vms.txt → retrieves information about all VMs on an ESXi host and stores the IDs in a text file.
  • vim-cmd vmsvc/power.getstate {VM ID} | grep 'Powered on' → checks the power state of VMs on an ESXi host based on the VM IDs specified in the parameter.
  • vim-cmd vmsvc/power.off {VM ID} → powers off VMs on an ESXi host if found running.
  • rm /tmp/running_vms.txt → permanently deletes the text file.

Andere Details

Es macht Folgendes:

• It displays the following output in the terminal: