Ransom.Linux.KUIPER.THLODBC

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Wird ausgeführt und löscht sich dann selbst.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• If the argument -reboot is not set to "no":
  • /bin/bash -c reboot
• If the argument -safe is set to "yes":
  • /bin/bash -c shutdown /r /t 0

Wird ausgeführt und löscht sich dann selbst.

Andere Details

Es macht Folgendes:

• It prints the number of processors and execution logs to the console.
  
• It checks if the file size is greater than 466,616,310 bytes. Only a certain percentage of the file will be encrypted.
• It checks if the file extension of the large file is any of the following. A different percentage of the file will be encrypted.
  • .backup
  • .blend1
  • .iso
  • .jpa
  • .jpg
  • .mbk
  • .mp3
  • .mp4
  • .nba
  • .pdf
  • .png
  • .pvm
  • .raw
  • .sis
  • .spg
  • .vdi
  • .vhd
  • .vmx
  • .vsv
  • .zip
  • .abk
  • .acp
  • .adi
  • .bkz
  • .doc
  • .dsb
  • .gho
  • .abu1
  • .avdx
  • .avhd
  • .docx
  • .qbmb
  • .vhdx
  • .vmcx
  • .vmdk
  • .vmem
  • .vmrs
  • .vmsd
  • .vmsn
  • .xlsx
  • .vbox-prev
  • .scripa
  • .subvol
  • .wx
  • .nvram
  • .qcow2
• It checks if the file extension is any of the following. These files will be encrypted in its entirety regardless of the file size.
  • .sql
  • .txt
  • .db
  • .json