Ransom.Linux.LIMPOOP.THBACBD
UDS:Trojan-Ransom.Linux.Babuk.h (KASPERSKY); Trojan.Linux.Generic.333384 (BITDEFENDER)
Linux
Threat Type: Ransomware
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
Downloaded from the Internet, Dropped by other malware
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It encrypts files with specific file extensions. It drops files as ransom note. It avoids encrypting files with the following file extensions.
TECHNICAL DETAILS
65,264 bytes
ELF
No
12 Feb 2024
Encrypts files
Arrival Details
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Other Details
This Ransomware does the following:
- It prints the following upon execution:
- Encrypted file names
- Number of encrypted files
- Number of files skipped
- Total number of files scanned
- Total size of encrypted files
It accepts the following parameters:
- {Path to encrypt} → Required
Ransomware Routine
This Ransomware encrypts files with the following extensions:
- .log
- .vmdk
- .vmsd
- .vmem
- .vswp
- .vm
- .db
- .vmx2
- .vmxf
- .vmss
- .vmtx
- .vmtm
- .nvram
- .vsb
- .vbm
- .vlb
- .vrb
- .hlog
- .rar
- .vsm
- .vib
- .vbk
- .zip
- .iso
- .gz
- .tgz
- .bco
- .dump
- .gzip
- .bk
- .bck
- .bkp
- .tmp
- .vmx
- .ova
- .ovf
- .tar
- .mf
- .vmd
- .vmsn
It appends the following extension to the file name of the encrypted files:
- {Original fllename}.{Original extension}.LIMPOPO
It drops the following file(s) as ransom note:
- {Encrypted Directory}/LIMPOPO.txt
It avoids encrypting files with the following file extensions:
- .LIMPOPO
SOLUTION
9.800
19.156.03
13 Feb 2024
19.157.00
14 Feb 2024
Step 1
Scan your computer with your Trend Micro product to delete files detected as Ransom.Linux.LIMPOOP.THBACBD. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:
Step 2
Restore encrypted files from backup.
Did this description help? Tell us how we did.