The analysis of this ransomware variant targeting ESXi servers reveals several key aspects:
Overview
-
Target: The ransomware specifically targets ESXi (Enterprise Server Virtual Infrastructure) environments, focusing on virtual machine disk files and other critical system files.
-
Encryption Method:
- Uses ChaCha8 encryption with unique keys for each file.
- RSA-4096 public key is embedded in the malware to encrypt the symmetric keys used by ChaCha8.
- Metadata containing encrypted keys, IVs, and markers (e.g., "KYBER", "CDTA", "ATDC") are appended to files.
-
Partial Encryption Strategy:
- Files under 1MB: Entire file is encrypted.
- Files between 1MB and 4MB: Only the first 1MB is encrypted.
- Files above 4MB: A calculated portion of each file is encrypted, controlled by a user-defined parameter (default value observed is 10%).
Workflow
- Initial Steps:
- The ransomware binary replaces critical files to ensure that any interaction with the system presents the ransom note immediately.
/etc/motdfor SSH access.
- The ransomware binary replaces critical files to ensure that any interaction with the system presents the ransom note immediately.
Read the full article at Rapid7 Blog
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.
2
Contents
alinemati1983-6987Written by alinemati1983-6987
