Ransom.Win64.LDRADO.THCBOBD

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

新(xīn)病毒详细信息

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

安(ān)装(zhuāng)

它添加下列进程：

• vssadmin Delete Shadows /all /quiet
• cmd "/c chcp 65001 & systeminfo"

信息窃取

它接受下列参数:

• -skip-local → Skip processing local files.
• -skip-net → Skip processing shares
• -keep → Disable self-deletion after execution (Self-deletion is enabled by default).
• -n → Specify network in CIDR format. If not specified, values from active network interfaces will be used. A file with a list of networks can also be specified.
• -d → Specifies a domain.
• -u → Specifies username for SMB.
• -p → Specifies password for SMB.

其他(tā)详细信息

该程序执行以下操作(zuò)：

• It gathers the following data via systeminfo:
  • Operating System Information:
  • Name
  • Version
  • Manufacturer
  • Configuration
  • Build Type
  • Registered Owner
  • Registered Organization
  • Product ID
  • Installation date
  • Host name
  • System Boot Time
  • System Manufacturer
  • System Architecture
  • Processor information
  • System Language
  • Time Zone Information
  • BIOS Version
  • Total and Available Physical Memory
  • Virtual Memory Information (Max, Available, In Use)
  • Page file locations
  • Domain
  • Logon server
  • Hotfix(es)
  • Network card(s)
• It displays its logs on a console:
  
• It sends some of its logs to the following IP Address:
  • {BLOCKED}.{BLOCKED}.{BLOCKED}.152:443