Ransom.Win64.METAENCRYPTOR.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Process Termination

This Ransomware terminates the following services if found on the affected system:

• Firebird
• MSSQL
• SQL
• Exchange
• wsbex
• postgresql
• BACKP
• tomcat
• SBS
• SharePoint

Information Theft

This Ransomware gathers the following data:

• Total Memory
• Used Memory
• System Name
• Kernel Version
• OS Version
• System Host Name
• CPU

Other Details

This Ransomware accepts the following parameters:

• USAGE:
  • {Malware Filename} [FLAGS]
  • {Malware Filename} [OPTIONS]
• FLAGS:
  • -h | --help → Prints help information
  • -V | --version → Prints version information
• OPTIONS:
  • -d | --debug → Debug mode, more verbose output [default: false]
  • --disable-shares → Do not encrypt SMB shares [default: false]
  • -e | --exclude {file path} → Exclude specific file for encryption
  • --fast → Activate FAST mode [default: false]
  • -f | --only-files {file} → Encrypts the specified file
  • -k | --kill-processes → Terminates all non-windows processes. [default: false]
  • --no-sort-files → Sort files by date
  • --only-wait → Only wait, do nothing. for debug purposes. [default: false]
  • -p | --paths → Encrypts specified directory
  • --raise-privs → Execute with admin privilege [default: true]
  • --no-vss → Do not remove Volume Shadow Copies [default: true]
  • --shred-at-end → Delete itself after encryption [default: false]
  • --shred-now → Delete itself immediately [default: false]
  • -t | --threads → Threads count, by default selecting by number of CPU cores [default: 0]
  • --wait-mm → Time delay in minutes [default: 0]

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .metaencrypted

It drops the following file(s) as ransom note:

• {Encrypted Directory}\!metaencrypter.txt