Dela Cruz, A. et al. (2022, May 25). New Linux-Based Ransomware Cheerscrypt Targeting ESXi Devices Linked to Leaked Babuk Source Code. Retrieved December 19, 2023.
Not cited by any technique.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1059.012 Hypervisor CLI |
MalwareCheerscrypt | Cheerscrypt has leveraged `esxcli` in order to terminate running virtual machines. |
| T1083 File and Directory Discovery |
MalwareCheerscrypt | Cheerscrypt can search for log and VMware-related files with .log, .vmdk, .vmem, .vswp, and .vmsn extensions. |
| T1486 Data Encrypted for Impact |
MalwareCheerscrypt | Cheerscrypt can encrypt data on victim machines using a Sosemanuk stream cipher with an Elliptic-curve Diffie–Hellman (ECDH) generated key. |
| T1489 Service Stop |
MalwareCheerscrypt | Cheerscrypt has the ability to terminate VM processes on compromised hosts through execution of `esxcli vm process kill`. |
| T1673 Virtual Machine Discovery |
MalwareCheerscrypt | Cheerscrypt has leveraged `esxcli vm process list` in order to gather a list of running virtual machines to terminate them. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
