Ransom.Linux.EBANUL.THGOCBD

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Ransomware does the following:

• It won't proceed to encryption unless the parameter -p | --path is specified.

It accepts the following parameters:

• -h | --help → show help message
• -p | --path {Path} → encrypt files in the specified path
• -m | --mode local → encrypt mode - only local (default)
• -l | --log {Filename} → log file path
• -v | --verbose → enable verbose mode
• --exclude-vms {Filename} → filename path with VMS names for excluding encrypting
• --esxi-vm-killer-off → disable ESXi VMS killer
• --no-mutex → start program without checking global sync object

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .NBA

It avoids encrypting files with the following file extensions:

• .NBA
• .NBA{Any String}