Ransom.Linux.LUNACRYPT.THGBBBB

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Ransomware does the following:

• It does not encrypt if no argument is passed.
• It does not encrypt folders recursively.

It accepts the following parameters:

• -file {path of file to encrypt}
• -dir {directory to encrypt}

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• If the argument -dir {directory to encrypt} is passed:
  • .ini
  • .exe
  • .dll
  • .lnk
  • Luna

It avoids encrypting files found in the following folders:

• If the argument -dir {directory to encrypt} is passed:
  • openserver
  • windows
  • program files
  • recycle.bin
  • programdata
  • appdata
  • all users

It appends the following extension to the file name of the encrypted files:

• .Luna

It drops the following file(s) as ransom note:

• If the argument -dir {directory to encrypt} is passed:
  • /home/{Username}/{Encrypted Folder}/readme-Luna.txt
  • /home/{Username}/{Encrypted Folder}/{Folder Name}\readme-Luna.txt