Ransom.Linux.GONNACRY.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Andere Systemänderungen

Stellt auf dem System das folgende Bild als Desktop-Hintergrundbild ein:

Andere Details

Es macht Folgendes:

• It is able to run itself in the startup using the following methods:
  • Creating a daemon of itself at ~/.config/autostart
  • Creating an autostart service of its daemon using systemctl
  • Creating an autostart file for its daemon at /etc/profile, ~/.bash_profile, ~/.bash_login, ~/.profile, ~/.bashrc
  • Creating a crontab for its daemon
• It runs its decryptor as a subprocess using the following commands:
  • gnome-terminal --command .{Decryptor path}
  • xfce4-terminal --command=.{Decryptor path}