Ransom.Linux.TELLUDPASS.THLBOBA

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbindet sich mit einer bestimmten Website, um Daten zu versenden und zu empfangen.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• home\{user}\encfile.txt → list of encrypted files
• home\{user}\public.txt
• home\{user}\showkey.txt

Fügt die folgenden Prozesse hinzu:

• /bin/bash -c service mysql stop
• /bin/bash -c service oracle stop
• /bin/bash -c systemctl disable postgresql*
• /bin/bash -c systemctl disable mysql*
• /bin/bash -c systemctl disable oracle*

Andere Details

Verbindet sich mit der folgenden Website, um Daten zu versenden und zu empfangen:

• http://{BLOCKED}.{BLOCKED}.216.148

Es macht Folgendes:

• It scans the following local IP addresses for SSH connection:
  • {BLOCKED}.{BLOCKED}.0.0/24
  • {BLOCKED}.{BLOCKED}.0.1/12
  • {BLOCKED}.{BLOCKED}.0.0/8
• It searches for keys in the following folders to use for SSH connection:
  • /home/{username}/.ssh → if ran without admin rights
  • /root/.ssh → if ran with admin rights