SHA1:
- 14ffe3ef5ccfbbc9a03ebd67d70b7cbf521db3f2
- 541966dd25ce48a8f54b270b9aed2fba3f021d29
- 57cf90a1cea89e13c3fd625854dd6b81228796b9
- aebb9bf852d848e22e8a7bba4d64874c7953460d
- b45f8f33ff54ece377fad73a8f89857c2bc114ac
Encryption ransomware for Linux written in C using the OpenSSL library. In most ways, it is similar to Linux.Encoder.1. However, in this modification cybercriminals implemented some other features as well:
- Does not save access privileges in encrypted file headers.
- Employs another pseudorandom number generator.
- Instead of PolarSSL, uses the OpenSSL library.
- Encrypts files in the AES-OFB-128 mode with context reinitialization every 128 bytes, that is every 8 AES blocks.
Doctor Web security researchers have developed a new technique that, in most cases, can help decrypt files compromised by the malware.