Ransom:Linux/Erebus.A

Installation

This threat runs on Linux system and drops the following files for instruction to decrypt the files. Files are dropped in the same directory.

_DECRYPT_FILE.txt
_DECRYPT_FILE.html

Payload

Encrypts files and asks for ransom

This threat searches for and encrypts files (encryption is in RSA) with the following file name extensions:

Then, the ransomware adds the extension .ecrypt to the encrypted files.

Here is a sample message on the ransom note:

Warning!! Your documents, photos, databases, important files have been encrypted!
If you modify any file, it may cause make you cannot decrypt!!!
To decrypt your files please visit the following website: <payment sites>
If the above address will be unable to open or very slow, follow these steps:
1. Download and install the tor browser.
2. After successful installation, run the browser, waiting to initialize.
3. In the address bar enter:
Machine ID:
Offline ID:

Connects to a remote host

• 216.126.224.128
• Tor payment sites:
• 7fv4vg4n26cxleel.gbe0.top
• 7fv4vg4n26cxleel.hiddenservice.net
• 7fv4vg4n26cxleel.onion
• 7fv4vg4n26cxleel.onion.nu
• fv4vg4n26cxleel.onion.to
• qzjordhlw5mqhcn7.gbe0.top
• qzjordhlw5mqhcn7.hiddenservice.net
• qzjordhlw5mqhcn7.onion
• qzjordhlw5mqhcn7.onion.to
• qzjordhlw5mqhcn7.onion.nu
  
  

Analysis by:

Francis Tan Seng