Ransom.Linux.BRAINCIPHER.THHOIBD

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• If parameter -onvm {ID1, ID2, ID3, ...} is used:
  • /tmp/running_vms.txt → contains active VM IDs retrieved from the system.

Agrega los procesos siguientes:

• If parameter -onvm {ID1, ID2, ID3, ...} is used:
  • vim-cmd vmsvc/getallvms | grep '^[0-9]' | awk '{print $1}' > /tmp/running_vms.txt → retrieves information about all VMs on an ESXi host and stores the IDs in a text file.
  • vim-cmd vmsvc/power.getstate {VM ID} | grep 'Powered on' → checks the power state of VMs on an ESXi host based on the VM IDs specified in the parameter.
  • vim-cmd vmsvc/power.off {VM ID} → powers off VMs on an ESXi host if found running.
  • rm /tmp/running_vms.txt → permanently deletes the text file.

Otros detalles

Hace lo siguiente:

• It displays the following output in the terminal: