Ransom.Win32.LIVEDE.THLBHBC

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• {malware directory}\libgobject-2.0-0.dll
• {malware directory}\libiconv-2.dll
• {malware directory}\libintl-8.dll
• {malware directory}\libpcre2-8-0.dll
• {malware directory}\livelocked.exe
• {malware directory}\windows_encryptor_180870197840.exe
• {malware directory}\libffi-8.dll
• {malware directory}\libglib-2.0-0.dll

Agrega los procesos siguientes:

• bcdedit /set {current} recoveryenabled no
• bcdedit /set {default} recoveryenabled no
• bcdedit /set {current} bootstatuspolicy ignoreallfailures
• bcdedit /set {default} bootstatuspolicy ignoreallfailures
• vssadmin Delete Shadows /All /Quiet
• wbadmin DELETE BACKUP -keepVersions:0 -quiet
• taskkill /F /IM {process name}
• net stop {service name} /y
• wevtutil cl application
• wevtutil cl security
• wevtutil cl system

Otras modificaciones del sistema

Este malware establece la imagen siguiente como fondo de escritorio del sistema:

Otros detalles

Hace lo siguiente:

• The file is a self-extracting archive.
• Clears event logs to hide its malicious behaviors.
• It encrypts drives from A:\ to Z:\