Ransom.Linux.GONNACRY.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Otras modificaciones del sistema

Este malware establece la imagen siguiente como fondo de escritorio del sistema:

Otros detalles

Hace lo siguiente:

• It is able to run itself in the startup using the following methods:
  • Creating a daemon of itself at ~/.config/autostart
  • Creating an autostart service of its daemon using systemctl
  • Creating an autostart file for its daemon at /etc/profile, ~/.bash_profile, ~/.bash_login, ~/.profile, ~/.bashrc
  • Creating a crontab for its daemon
• It runs its decryptor as a subprocess using the following commands:
  • gnome-terminal --command .{Decryptor path}
  • xfce4-terminal --command=.{Decryptor path}