Ransom.Win64.LDRADO.THCBOBD

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Agrega los procesos siguientes:

• vssadmin Delete Shadows /all /quiet
• cmd "/c chcp 65001 & systeminfo"

Robo de información

Acepta los siguientes parámetros:

• -skip-local → Skip processing local files.
• -skip-net → Skip processing shares
• -keep → Disable self-deletion after execution (Self-deletion is enabled by default).
• -n → Specify network in CIDR format. If not specified, values from active network interfaces will be used. A file with a list of networks can also be specified.
• -d → Specifies a domain.
• -u → Specifies username for SMB.
• -p → Specifies password for SMB.

Otros detalles

Hace lo siguiente:

• It gathers the following data via systeminfo:
  • Operating System Information:
  • Name
  • Version
  • Manufacturer
  • Configuration
  • Build Type
  • Registered Owner
  • Registered Organization
  • Product ID
  • Installation date
  • Host name
  • System Boot Time
  • System Manufacturer
  • System Architecture
  • Processor information
  • System Language
  • Time Zone Information
  • BIOS Version
  • Total and Available Physical Memory
  • Virtual Memory Information (Max, Available, In Use)
  • Page file locations
  • Domain
  • Logon server
  • Hotfix(es)
  • Network card(s)
• It displays its logs on a console:
  
• It sends some of its logs to the following IP Address:
  • {BLOCKED}.{BLOCKED}.{BLOCKED}.152:443