Ransom.Win32.GOHIVE.RCY

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Se ejecuta y, a continuación, se elimina.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• {Malware File Path}hive.bat → Deleted Afterwards
• {Malware File Path}shadow.bat → Deleted Afterwards
• {Drive Letter}:\{22 Random Characters}.key.hive
• {Drive Letter}:\HOW_TO_DECRYPT.txt
• {Encrypted Directory}\HOW_TO_DECRYPT.txt

Agrega los procesos siguientes:

• cmd /c hive.bat>NUL 2>NUL
• cmd /c shadow.bat>NUL 2>NUL
• vssadmin.exe delete shadows /all /quiet

Se ejecuta y, a continuación, se elimina.

Finalización del proceso

Finaliza los servicios siguientes si los detecta en el sistema afectado:

• bmr
• sql
• oracle
• postgres
• redis
• vss
• backup
• sstp

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• mspub
• msdesktop

Otros detalles

Hace lo siguiente:

• It accepts the following argument:
  • -kill {process name} → Regular expression for the names of processes to be stopped.
  • -no-clean → Skip clean disk space stage
  • -skip {file name} → Regular expression for file names to be skipped
  • -stop {service name} → Regular expression for stopping services
  • -t {int} → Number of encryptor threads
• It encrypts fixed, removable and network drives