RANSOM_CRYPTOR.C
Trojan.Linux.Encoder.A (BitDefender), Linux/Filecoder.D (ESET-NOD32),
Unix, Linux
Threat Type: Trojan
Destructiveness: No
Encrypted: No
In the wild: Yes
OVERVIEW
Dropped by other malware, Downloaded from the Internet
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It deletes the initially executed copy of itself.
TECHNICAL DETAILS
257263 bytes
ELF
Yes
15 Jan 2015
Encrypts files
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan drops the following non-malicious files:
- README_FOR_DECRYPT.txt - to all folders where files are encrypted.
Other Details
This Trojan encrypts files with the following extensions:
- .php
- .html
- .tar
- .gz
- .sql
- .js
- .css
- .tgz
- .war
- .jar
- .java
- .class
- .ruby
- .rar
- .zip
- .db
- .7z
- .doc
- .xls
- .properties
- .xml
- .jpg
- .jpeg
- .png
- .gif
- .mov
- .avi
- .wmv
- .mp3
- .mp4
- .wma
- .aac
- .wav
- .pem
- .pub
- .docx
- .apk
- .exe
- .dll
- .tpl
- .psd
- .asp
- .phtml
- .aspx
- .csv
It opens the following files:
- ./readme.crypto - Contains data to be written in README_FOR_DECRYPT.txt
- ./index.crypto
It renames encrypted files using the following names:
- {Filename}.encrypted
It deletes the initially executed copy of itself
NOTES:
This Trojan initially encrypts files found in the following folders:
- /etc/apache2
- /etc/nginx
- /home
- /root
- /var/lib/mysql
- /var/log
- /var/www
It avoids encrypting files in the following folders:
- /root/.ssh
- /usr/bin
- /etc/ssh
SOLUTION
9.800
12.275.00
16 Jan 2016
Scan your computer with your Trend Micro product to delete files detected as RANSOM_CRYPTOR.C. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.