Ransom.Win32.LYNXRANSOM.THGBIBD

N

安(ān)装(zhuāng)

它植入下列文(wén)件：

• %User Temp%\background-image.jpg
• %System%\spool\PRINTERS\00002.SPL
• %System%\spool\PRINTERS\00002.SHD

(注意: %User Temp% 是当前用(yòng)户的 Temp 文(wén)件夹。通常位于 C:\Documents and Settings\{user name}\Local Settings\Temp (Windows 2000(32-bit)、XP 和 Server 2003(32-bit))、C:\Users\{user name}\AppData\Local\Temp (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit)。. %System% 是 Windows 的 system 文(wén)件夹，通常位于 C:\Windows\System (Windows 98 和 ME)、C:\WINNT\System32 (Windows NT 和 2000) 和 C:\WINDOWS\system32 (Windows 2000(32-bit)、XP、Server 2003(32-bit)、Vista、7、8、8.1、2008(64-bit),2012(64bit) 和 10(64-bit))。)

其他(tā)系统修改

它通过修改下列注册表项，更改桌面壁纸：

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%\background-image.jpg

它将系统的桌面壁纸设置為(wèi)下列图像：

• %User Temp%\background-image.jpg
  

进程终止

它终止在受感染的系统上运行的下列服務(wù)：

• backup
• exchange
• sql
• veeam

它终止在受感染的系统内存中(zhōng)运行的下列进程：

• backup
• exchange
• java
• notepad
• sql
• veeam

信息窃取

它接受下列参数:

• --file → Encrypt only specified file
• --dir → Encrypt only specified directory
• --help → Print the help message
• --verbose → Display logs in the console
• --stop-processes → Uses Windows Restart Manager APIs to close processes or shut down Windows services that may be keeping a file open and preventing encryption.
• --encrypt-network → Encrypt network shares
• --load-drives → Load hidden drives
• --hide-cmd → No function as of this writing
• --no-background → Disable changing background image
• --no-print → Disable printing ransom note on printers
• --kill → Kill processes/services
• --safe-mode → No function as of this writing
• --mode → No function as of this writing

其他(tā)详细信息

该程序执行以下操作(zuò)：

• It terminates all dependent services to the following services:
  • backup
  • exchange
  • sql
  • veeam
• It encrypts removable, fixed, remote drives.
• It empties the Recycle Bin
• It enumerates printers in the network to print the ransom note.
• It deletes volume shadow copies using the DeviceIoControl API.
• It displays its logs on a console when the parameter --verbose is used: