AvosLocker – Modern Linux Ransomware Threats

This article was written by Sudhir Devkar

Summary

AvosLocker Ransomware is a recent ransomware with the capability to encrypt Linux systems. AvosLocker seems to be targeting the VMware ESXi virtual machines and Virtual Machine File System (VMFS) files. By targeting VMs, AvosLocker takes advantage of faster and easier encryption of multiple servers with a single command.

Behavioral Summary

On execution, AvosLocker on Linux systems shows usage instructions to the user to run commands with parameters, as shown in Figure 1. These parameters control aspects like the number of threads to be created for encryption and the path of the directory which will get encrypted.

Figure 1: Command Line Usage guide

After providing the parameters, before encryption it drops ransom note files to folders specified on the command line with the name “README_FOR_RESTORE”. In the ransom note AvosLocker asks the user to download the Tor browser and to visit the given Tor onion link. There is no specific ransom amount demanded in the ransom note; it instructs to provide the ID mentioned at the end in the ransom note to get pricing details.

Figure 2: Ransom Note

While looking into code, the malware checks if the command line parameter contains “esxi” and “vmfs”. If so, AvosLocker checks for VMware Elastic Sky X Integrated (ESXi) and Virtual Machine File System (VMFS), respectively, and tries to force their shutdown if they are running.

Figure 3: Code snippet to kill ESXi

Command used to kill ESXi and VMFS services:

esxcli –formatter=csv –format-param=fields==”WorldID,DisplayName” vm process list | tail -n +2 | awk -F $’,’ ‘{system(“esxcli vm process kill –type=force –world-id=” $1)}’

Further, it creates a given number of threads with mutex lock/unlock to synchronise operation to prevent encryption process overlap.

Figure 4: Create Thread and Mutex lock/Unlock

On further execution AvosLocker creates the number of threads provided by command line parameters and starts encrypting files from a given path. Analysis showed that each file was encrypted with a unique encryption key. During encryption AvosLocker checks file size if greater than ~12MB. If so, then the data will be encrypted in ~1Mb blocks. Once encryption completes, the malware stores the encryption key, with base64 encoding, at the end of each encrypted file. The ransomware then renames the encrypted file with extension “.avoslinux”, as shown in Figure:5

Figure 5: Encryption code flow

The encrypted files are appended with 171 bytes of base64 data. Analysis of code flow shows this to be the encryption key stored in base64 encoded, shown in Figure:6.

Figure 6: key appended in encrypted files

After encryption, AvosLocker appends the encrypted file name with the extension .avoslinux. (Figure:7)

Figure 7: Encrypted files with .avoslinux extension

Yara

Rule :

MITRE ATT&CK TIDs

Table 1: MITRE ATT&CK TIDs

Indicators of Compromise (IOCs)

Table 2: Indicator of Compromise

Read more threat analysis insights.

Based on VMware’s Threat Analysis Unit research, Exposing Malware in Linux-Based Multi-Cloud Environments offers a comprehensive look at  malware threats targeting  multi-cloud environments.