Ransom.SH.ESXIARGS.THBOFBC

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• /tmp/public.pem ← Public RSA key used to encrypt the key

Other System Modifications

This Ransomware deletes the following files:

• /store/packages/vmtools.py
• All .log files
• Itself and its component files

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• VMX related processes

Other Details

This Ransomware does the following:

• It requires the following components in order to execute:
  • /tmp/encrypt ← Encryptor ELF executable
  • /tmp/encrypt.sh ← shell script that as the logic for the attack
  • /tmp/motd ← Ransom note in text form
  • /tmp/index.html ← Ransom note in HTML form
• It overwrites /sbin/hostd-probe with /sbin/hostd-probe.bak
• It establishes persistence by adding the following:
  • /bin/auto-backup.sh ← ESXI configuration file
  • Starting an SSH server on host "/etc/init.d/SSH start"
• It executes differently depending on the VMware build version:
  • If build version is 7.0:
    - It modifies and overwrites the contents of /bin/hostd-probe file
  • If build version is not 7.0:
    - It deletes cronjobs
    - It recreates /var/spool/cron/crontabs/root file then deletes the original file

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .vmdk
• .vmx
• .vmxf
• .vmsd
• .vmsn
• .vswp
• .vmss
• .nvram
• .vmem

It appends the following extension to the file name of the encrypted files:

• .args

It drops the following file(s) as ransom note:

• /etc/motd ← Ransom note in text form
• /usr/lib/vmware/index.html ← Ransom note in HTML form