Skip to content

Commit

Permalink
Update 2023-11-29-Luckbit-Ransomware.md
Browse files Browse the repository at this point in the history
  • Loading branch information
0xk4n3ki authored Nov 29, 2023
1 parent ddb041a commit 361c569
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions _posts/2023-11-29-Luckbit-Ransomware.md
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,7 @@ The malware first traverses all directories, encrypting files with extensions su

After encrypting the files, the malware creates a <!-- [<span style="color:red"><ins>README_K.log</ins></span>](/assets/img/luckbit/README_K.log) --> README_K.log file in each directory. This file contains the ransom note detailing the attack and includes instructions on how to pay the ransom. It modifies the wallpaper by replacing it with an image containing a message about Luckbit along with information from the README_K.log file.

```txt
```log
Urgent Notice - Your Data Has Been Encrypted
Attention,
Expand Down Expand Up @@ -189,7 +189,7 @@ ZNH

Observing the process activity, it initiates a process with <span style="color:lightgreen">powershell.exe</span> and executes a script in file <!-- [<span style="color:red"><ins>tmpF593.tmp.ps1</ins></span>](/assets/img/luckbit/tmp.ps1) --> tmpF593.tmp.ps1.

```ps1
```powershell
$soNJkXUO = Get-Process 3K0JfF4BjXG6mMisOnUXL2mGOOBeDHM7vZK4ILhZbtc -ErrorAction SilentlyContinue
while ($soNJkXUO) {
Expand Down

0 comments on commit 361c569

Please sign in to comment.