ypt publickeyfile
…then it will scramble writable files on your computer, using a public key provided in a separate file for its encryption.
Scrambled files are obvious: they end up with the text string .encrypted at the end of their names.
Additionally, if the crook feeds the malware a file called readme.crypto, you will find a copy of that file under the name README_FOR_DECRYPT.txt in every directory where the malware did any damage.
That file serves as a ransom note, so the crook can use it to tell you how much you’re supposed to pay, and how.
Later on, if you manage to acquire the corresponding private key from the crook, by whatever means he has specified, you can do this…
$ ./ransom decrypt privatekeyfile
…to reverse the effects.
The details of how the crook generates the public-private key pairs, where he stores them, how he sells them, and how much he charges, is up to him.
Linux/Ransm-C just gives him the malicious mechanism he needs to do the scrambling, so he can put the squeeze on you to pay up.
What to do?
All our usual advice applies:
- Patch! To use this malware, a crook needs to sneak just two small files onto your computer: the malware program and a public key. Any remote code execution hole could be enough to lock you and your customers out of your own server.
- Backup! If you have a reliable way of restoring a ruined server, even if you lose a few recent changes, you can recover from this sort of attack without engaging with the crooks.
- Protect! Yes, a Linux anti-virus can help. On a Linux server protected by Sophos Antivirus, for example, Linux/Ransm-C would trigger an alarm as soon as the crook uploaded it – and then he wouldn’t be able to run the malware anyway, because the anti-virus would block it.
While you’re about it, make sure you pick proper passwords, to stop crooks logging in remotely without even needing to hack.
Also, consider using two-factor authentication so that a stolen or leaked password isn’t enough on its own for a crook to login.
And why not listen to our podcast, Malware on Linux – When Penguins Attack?
Let Sophos security expert Chester Wisniewski tell you what he found when he looked at how much help the Linux ecosystem is inadvertently giving to the cyberunderworld…
Malware on Linux – When Penguins Attack
Sophos Antivirus for Linux is available for free, with no time limit, for desktops and servers, at work and at home.