Ransom.Win64.RUTHENS.THLABBC

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Prozesse hinzu:

• wmic.exe shadowcopy delete
• bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
• wbadmin.exe delete systemstatebackup -keepVersions:3
• wbadmin.exe delete systemstatebackup
• bcdedit.exe /set {default} recoveryenabled No
• vssadmin.exe delete shadows /all /quiet
• wbadmin.exe delete catalog-quiet
• notepad.exe {Drive}:\Contact Us.txt

Prozessbeendigung

Beendet die folgenden Dienste, wenn sie auf dem betroffenen System gefunden werden:

• mepocs
• memtas
• veeam
• svc$
• backup
• sql
• vss
• msexchange
• vmm
• vmwp

Beendet Prozesse oder Dienste, die einen oder mehrere dieser Zeichenfolgen enthalten, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

• encsvc
• thebat
• mydesktopqos
• xfssvccon
• firefox
• infopath
• winword
• steam
• synctime
• notepad
• ocomm
• onenote
• mspub
• thunderbird
• agntsvc
• sql
• excel
• powerpnt
• outlook
• wordpad
• dbeng50
• isqlplussvc
• sqbcoreservice
• oracle
• ocautoupds
• dbsnmp
• msaccess
• tbirdconfig
• ocssd
• mydesktopservice
• visio

Andere Details

Es macht Folgendes:

• It accepts the following argument:
  • -c {username}:{password} → Required. Specifies the username and password to access the contact page
  • -a, -attach, --attach → Enables logging
  • -A, -no-aggressive, --no-aggressive → Disables the deletion of backups and recovery
  • -E, -no-extension, --no-extension → Disables appending of extension to files
  • -m, -min-size, --min-size → Specifies the minimum file size for encryption (in bytes)
  • {File or Path to encrypt} → Encrypts a specific file or directory
• It encrypts fixed, removable, and network drives.